ITAR feels a lot like Bernstein v. US all over again. Until very recently, everyone who can do anything that would be covered by ITAR was a giant corporation that likes the moat that regulations create, so it's unthinkable to challenge it. But that is changing, just like cryptography was in the early 90s.