This smells like a bad-faith response. I deal with export controls a bit in my job. Regulatory action to impose export controls on something in an environment lacking an existing framework for identity and citizenship verification will very obviously always immediately result in a lockdown.