A few others have mentioned this. The EO is tailored towards those outside the US and is a response to overwhelming cyber attacks. Sanctions are one of the US's tried and true international political weapons. They aren't going to be sanctioning US researchers, nor US-allied parties. The EFF seems to be confusing what is an EO targetting Chinese and Russian hackers and their funders with civil law? The EFF is normally very careful about these sorts of distinctions - so I'm very confused.
It has a clear purpose the public can get behind, but it will almost certainly be abused for persecuting domestic political rivals, software developers among them.
Here are some entertaining thought exercises:
A cyber 9/11 is linked to Bitcoin. Can Bitcoin developers be sanctioned?
A cyber 9/11 is linked to Tor. Can Tor developers be sanctioned?
You donate to Wikileaks, which is linked to a national security threat. Can you be sanctioned?
Section 1(ii)(B) applies to _any_ individual or entity, domestic or abroad, developing or facilitating development of pentesting or related software employed against vague and faceless "national security interests". But don't you worry, because this is only applicable to the "Chinese" threat which may actually be true for the first couple of years to build political support for the eventual, predictable abuses of power.
The EFF's news sites are almost never careful about these distinctions. The EFF does some important work, but their online advocacy programs aren't part of it. EFF's layperson explanations of the law are almost uniformly misleading.
