The new controls are for "intrusion software" (e.g. malware) and "IP network communications surveillance systems or equipment." There are specific definitions

The new controls are for "intrusion software" (e.g. malware) and "IP network communications surveillance systems or equipment." There are specific definitions for those terms with technical specifications. Then there are licenses/exemptions that mean you don't have to seek a license if you are selling to nongovernment customers in certain (friendlier) countries. There's also larger exemptions in export controls related to commercial off the shelf equipment and fundamental research that would apply as well. Generally the take away is that if you're selling malware, exploits, or network surveillance equipment, you might want to talk to an export control lawyer first.