u/Affectionate-Cost920

Hello everyone. I am a newcomer to this field, so please excuse me if I have misunderstood anything.

I recently discovered a case involving a U.S. citizen who signed a contract with a company for an ITAR-controlled project. The individual used a VPN IP address based at a residential location in the USA. Later, while traveling abroad, he continued to work (as recorded in the activity logs) by routing data through that residential address to connect to the company in the USA. I believe this constitutes a violation of data export regulations. Should I report this?