I want to ask, is the US export control applicable only to US citizens?
E.g. I think Bouncy Castle are Australians.
Do use of their library fall into export control regulations?
I do not understand this export control
As I understand it, if I build it from within the US and sell it to other countries it's under export control.
If I consume someone else's libraries while I am in the US that were built either in or out of the US and sell it to other countries its under export control.
If I consume someone else's libraries that were built in or out of the US and only sell to companies in the US, it's not under export control. However, those who I've sold it to are under export control if they resell the product to an external country.
There are about four relevant concepts:
Export control is a set of rules about exporting. If you are in the US and are downloading BouncyCastle from a server in Australia, then you are importing it, and thus you are theoretically subject to the US import rules. The people operating the Australian server, on the other hand, are subject to the Australian export rules. Also, those Australians are also providing the system to you.
Where the library was designed and/or compiled is irrelevant to import/export regulations; what matters is when the software crosses a border. At that time, the applicable laws are the export rules from the source country and the import rules from the destination country. Generally speaking, US rules are lenient about import, but still have a few requirements for export.
See this site for a thorough survey of cryptographic regulations around the world.
No, if you are working for a US company and produce a work for that company, the work is subject to US export control.
I do not think it would fall under US export control if
In short if it was made entirely outside the US by people who are unafillited with the US or US business then it would not be subject to US export regulations.
Not many people do.
NASA has a good presentation http://oiir.hq.nasa.gov/nasaecp/Webbrfg/sld001.htm The introduction describes export as a transfer of anything to a 'foreign person' by any means, anywhere, anytime.
Basically if there is knowledge, technology, or artifacts that the US government does not want to be available to other countries, it can only be known, used, seen, described, or otherwise interacted with by US citizen, US lawful permant residents or US companies and organizations.