"How the Pall Mall Process Can Help Combat Commercial Spyware Abuse" 8 May 2025

Twenty-five governments have agreed to a promising new initiative to combat the irresponsible use of commercial cyber intrusion capabilities, including commercial spyware. Civil society should hold them accountable to their commitments.

The abuse of commercial spyware—spyware that a government purchases, rather than develops itself—threatens fundamental freedoms by facilitating improper surveillance that violates privacy rights, encourages self-censorship, and harms freedom of expression...Spyware abuse also threatens national security. Government officials around the world, including members of the European Parliament, a Polish politician, UK officials, and US diplomats and elected officials, have all been surveilled with spyware—leaving sensitive information about contacts, meetings, and location vulnerable to collection and misuse...

... In April, the [UK and French] governments announced the Pall Mall Process Code of Practice for States, which aims to establish best practices for CCIC use. Twenty-five governments signed on to the nonbinding code, including the United States...

...While the Code of Practice is a step in the right direction, it contains shortcomings. Notably, while it includes some references to international human rights law standards regarding “decisions to use CCICs,” these references are tempered with qualifiers and gray areas...