It's probably worth remembering that there is an open source exemption. If a piece of 'intrusion software' has been published the export controls no longer apply.

Publish your exploits to github before you send them overseas or travel to the conference to announce them.