My guess would be that the US found some dodgy software that happened to make use of cURL, add flagged him as part of it, given what he's previously said about receiving emails from people that have found his details in other software: https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/