Do these controls actually work? As in, do they prevent banned states from getting this technology or papers describing how to build it? My intuition says no.
And even if they are effective, is it worth the bureaucratic overhead?
RSA used to be export restricted by ITAR, and the situation became a running joke. There's a Perl 3 liner made into a t-shirt that was subject to the regulation. http://www.cypherspace.org/rsa/
And even if they are effective, is it worth the bureaucratic overhead?