We covered this Wassenaar Arrangement thing before. The latest version of the agreement included 0-days, exploits, and backdoors as regulated and export-controlled “dual-use” technologies. Previously, the US wasn’t recognizing these most recent additions but that is all changing come later this month
more here............https://www.novainfosec.com/2014/09/07/will-selling-your-0-days-soon-be-illegal/
more here............https://www.novainfosec.com/2014/09/07/will-selling-your-0-days-soon-be-illegal/