Strong encryption used to be classified as munitions under ITAR, so maybe there's some precedent there.