Enough Musk Spam

ITAR technically applies to all US Citizens, the only exception I'm aware of is in a university research setting. The text of the law is pretty short and boils down to anything that the US Government deems military technology or technology that can be used against the US must remain within the US unless written permission to "export" that technology is granted by the department of state. In this case "export" means the information leaving US soil or where you can't prove that the information hasn't left US soil. So if you're talking about some controlled technology in the middle of nowhere Kansas and happen to be next to some German tourist? Boom: Export.

From there you find yourself dealing with EAR on exactly what counts as an export and how to handle the export process. Exports happen all the time legally but they're all funneled through the DoS. If you don't control your exports the DoS starts getting fine-happy and if you do it enough times your company gets disbarred so all those sweet sweet over charged contracts that Musk likes to hide and distract from go away.

One method of controlling your export is to make sure that US citizens are the only people in your facility. That's why SpaceX's policy makes sense

From briefly having worked on a project where this was a relevant issue, and I had to throw good people of foreign nationality off the team due to higher up NASA decisions: ITAR also becomes relevant when you want to access data and hardware that is ITAR regulated for use in your mission. This is the case for all space missions -- even for SpaceX, who likes to do things in-house -- since the advanced electronics, alloys, etc. will come from elsewhere and fall under regulation.

It's not one specific law, it's a whole ton of them. ITAR (International Trade in Arms Regulations) is the keyword to use if you wanna look into it.