The State Department cited the International Traffic in Arms Regulation for the request. ITAR is a series of regulations on exports; the idea is that by uploading the CAD files to the internet, Defense Distributed is, um, distributing them internationally. "Please note that disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the United States or abroad, is considered an export," reads the letter. So it looks like web disclosure is included, or at least, the State Department thinks it is.