I have quite an interest in this area too. Here are a few things that may help: 1) Commercial Penetration Testing Software is already controlled. Here's a self

I have quite an interest in this area too. Here are a few things that may help: 1) Commercial Penetration Testing Software is already controlled. Here's a self-post to reddit on how these controls work and apply today: https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_about_us_export_controls_and_hacking/ https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_... If you choose to comment; it's helpful to understand the current law and how it works. This way it's easier to know what to ask for. 2) If you use software that may be controlled (for example: pen testing software); this issue affects you. Here are a few suggestions of things you could put in your comment: https://www.reddit.com/r/netsec/comments/3dusae/the_public_comments_on_the_proposed_wassenaar/ct9rjqu https://www.reddit.com/r/netsec/comments/3dusae/the_public_c... 3) As of last night, there were 101 public comments posted. Most were far below the quality you would hope for a good discussion on HN, let alone a note to a policy maker to request a change. If you have an interest in this area and have something constructive to suggest--the public comment process is your opportunity to do it. http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb=postedDate;po=0;dct=PS;D=BIS-2015-0011 http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb...