Back in the 90s the US Government prohibited export of SSL stronger than 40 bits. I believe this is what they're referring to.