"One Step Forward? Agreement on Spyware Regulation in the Pall Mall Process" 9 May 2025

On April 3–4, 21 countries, led by France and the United Kingdom, signed a non-binding Code of Practice to address the multiple challenges they face from the proliferation and irresponsible use of “the development, facilitation, purchase, transfer and use of commercial cyber intrusion capabilities (CCIC).” I have written previously on the potential of the “Pall Mall Process,” emerging from the U.K.-France Cyber Initiative to regulate spyware. Now this new Code of Practice demonstrates concrete action to advance regulation and accountability of a surveillance tech market conspicuously defined by misuse, egregious human rights violations and a lack of transparency...

...The reasons for regulation are compelling. As the 2024 Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware led by the United States unequivocally set out, such powerful and invasive tools have been used to “target and intimidate perceived opponents and facilitate efforts to curb dissent; limit freedoms of expression, peaceful assembly, or association; enable human rights violations and abuses or suppression of civil liberties; or track or target individuals without proper legal authorization, safeguards, or oversight.” The Code of Practice is a significant advancement, injecting new momentum to regulatory efforts–but it also comes with drawbacks and concerns that I set out below...

...Worryingly, we appear to be marching toward a new world of normalized spyware usage. The move is highly challenging for rights protection, for civil society and for State security. The Code accepts that there is a legitimate state market for these tools including spyware, and de facto affirms they are in widespread usage..

...The Code’s approach ignores previous calls for a ban or moratorium on the use of surveillance tools like mercenary spyware. Even as human rights experts, including myself, have called for regulation, we have done so by arguing for a capabilities-based or compliance-by-design approach...

...Moreover, the Code adopts a weak framework for regulation, namely the terminology of ‘proliferation and irresponsible use’, which has emerged in arms control and new technology spaces as a for state commitments and actions when States were unwilling to develop concrete, binding norms...

...In short, the Code marks real progress and demonstrates a serious commitment by some States to ensure practical regulation of digital surveillance tools, including spyware.  But it stops short of agreeing to a hard legal standard by which States commit to preventing spyware abuses in their domestic law and does not give us a roadmap to accountability and remedy for victims of spyware abuses. The Pall Mall Code must be treated as floor—not a ceiling...