The U.S. government and companies should not present evidence of why specific data risks exist before restricting Chinese data flows, as the burden of proof is inappropriately high and the precautionary principle should apply.