ITAR, like all US federal regulations codified in the CFR, have the full force and effect of the law. See the first couple paragraphs here for further explanation: http://library.law.unh.edu/AdminLaw

How do you know if something is subject to ITAR? The State Department has a big list. It's called the US Munitions List (USML). At the time Zimmerman said that, PGP probably wasn't on the list. But I assure you, blueprints of guns are absolutely on the list.