US State Department will not classify “cyber products” as munitions in export control list
Electronic Frontier Foundation :
Context & Ripple Effects
This decision closes out a year-long fight over how the US would implement the Wassenaar Arrangement's cyber language. After the May proposal to require licenses for exporting zero-day flaw information outside the US, security researchers warned that treating exploits as arms would criminalize routine vulnerability research — and by August the Commerce Department had agreed to rewrite the initial Wassenaar proposal, a move experts publicly welcomed.
By keeping "cyber products" off the munitions list, the State Department is choosing not to route this trade through the State-controlled USML at all. That leaves the question of where — and how strictly — intrusion tools get controlled to the Commerce regime, which is exactly where the story moves next.
First-order effects
- Security researchers and vulnerability brokers are immediately spared munitions-level licensing for publishing or selling exploit information, the outcome EFF and the research community had pressed for since the May zero-day licensing proposal.
Second-order effects
- Regulatory responsibility for hacking tools consolidates under the Commerce Department instead of State — the same agency that later issued [[a:971974|rules banning the export or resale of tools like NSO's Pegasus to China, Russia, and other countries of concern]], and that now runs entity-list designations against Chinese quantum, semiconductor, and aerospace groups.
Third-order effects
- If the pattern holds, US cyber-weapon control settles into a two-track structure — broad research activity left unlicensed while specific tools and destinations are named on Commerce lists — trading the predictability researchers wanted for a regime that can be tightened target-by-target without treaty renegotiation.
The trend: US control of offensive cyber tools is migrating away from blanket munitions-style rules toward Commerce-administered, destination-specific bans and entity listings.