To sell these tools to other foreign groups, cryptographic controls require sellers to obtain a license from Commerce’s Bureau of Industry and Security, which often grants them for four years or more, and asks only that sellers report biannual sales in return. Pen-testers, exploit brokers, and spyware makers argue encryption controls are adequate; digital rights activists call that ludicrous.
