IT leaders question US security mandates