A foreign company might also qualify as an entity. Even a company that merely has offices abroad might qualify. US Citizens who work for foreign entities might very well be included.
The law makes it clear that US persons (defined as citizens or legal residents) are not to be included whether they are presently in the USA or travelling abroad.
Even foreign persons who are under surveillance are to be excluded when they travel to the US.
Care to point out where the law makes that clear? It's my understanding that communications to/from "foreign entities" are subject to monitoring; as are any communications which have been routed outside the continental US, without regard to the endpoints.
