U.S. legislation on spread of cyber tools passes after Reuters investigation

> The legislation directs the State Department to report to Congress within 90 days on how it controls the spread of cyber tools and to disclose any action it has taken to punish companies for violating its policies.

Good.

> Under U.S. law, companies selling hacking products or services to foreign governments must first obtain permission from the State Department.

Are these requests all available under FOIA?

So what exactly is a "cyber tool"? For example, would a debugger be considered such, and what would it mean for open source tools?