An international arms control regime is planning to create export controls for some software security tools on the grounds that they might be used for nefarious purposes.