Security and law enforcement -- who exactly? I don't know of any outfit in the government that handles this. It's really up to Sprint, et. el. who operate the backbones and that's not quite how it ought to be. When a domain refuses to filter their traffic for the good of the net, then it ought to be done for them. There are border routers on both sides of a leased line. If the domain owner won't add the filtering then the carrier should be required by law to do so.
Looks like cybersecurity's going to be under direct presidential control!