There's no effective way of enforcing export controls on local software like PGP etc. Whatever they say someone will leak it.

It is possible to shutdown access to hosted services, as happened with Fable, but it can't really be done selectively. The US government wanted to allow it for US nationals only but Anthropic couldn't do that and so shut it down for everyone. Even if they did tie Claude accounts to nationality some people would set up "proxy servers" to allow access (either for montetary gain or because they don't agree with the restrictions)

They can restrict it to US citizens only: just do KYC and enforce it. Any citizen exporting ITAR capabilities would be committing a felony.

I think it is inevitable that more capable models will require export controls, KYC, background checks, verification of credentials, etc. Even if you don’t buy Anthropic’s marketing of their current models, there is a future where models are capable of developing chemical weapons, biological weapons, cyber weapons, etc. which are genuine security threats governments will care about controlling and preventing. Maybe this prevents big commercial labs from developing more capable models until they figure out appropriate safeguards, but this is a good thing, a world where you can ask an LLM for an airborne rabies genome and it will simply produce it for you is not a world we should want to live in.

You could quite effectively set up access to Fable with know-your-customer, attested clients/workstations, and then inspection of what the session is actually used for to detect out-of-country use. It's not impossible.