Can the Pall Mall Process Curb Spyware Abuse?

Vas Panagiotopoulos is a fellow at Tech Policy Press.

In early 2024, France and the United Kingdom launched the Pall Mall Process (PMP), an international initiative that brought together governments, industry, civil society, and academia to tackle “the proliferation and irresponsible use of commercial cyber intrusion capabilities (CCICs),” an umbrella term referring to spyware, software vulnerabilities, hackers-for-hire, and related technologies.

The PMP emerged in the aftermath of significant cases of spyware abuse, coupled with a growing global demand for such technologies. According to UK intelligence, approximately 100 countries have procured CCICs, highlighting the declining barriers to entry for states seeking these capabilities.

In April 2025, a non-binding Code of Practice for States, now signed by 27 countries, was adopted, setting out commitments for government action in relation to the development, facilitation, purchase, and use of CCICs. A Code of Practice for Industry is currently being developed and is expected to be finalized at the Paris Peace Forum in November.

To this end, France and the UK launched a public consultation that received 68 responses, including 27 from private industry, among them companies based in the United States, Europe, and the Middle East, according to diplomatic sources.

Among other findings, the consultation highlighted the central role of customer vetting, supply chain due diligence, and transparent business information (e.g. beneficial ownership). However, these practices were implemented unevenly across the market, reflecting differences in companies' size, maturity, and commitment to such safeguards, according to a consultation summary report seen by Tech Policy Press.

Putting CCIC risks on government agendas

PMP has played an important role in making governments recognize the risks that CCICs pose to human rights and national security, particularly by adopting an effective, results-oriented approach.

“In the past, we have seen a number […] of cyber diplomacy initiatives that gathered a large number of states but brought few results,” says Alexandra Paulus, a senior associate on international security at the German Institute for International and Security Affairs (SWP).

“PMP is decidedly not taking that approach. Instead, its initiators seek to bring together a small group of like-minded states, focused on a narrowly scoped problem, to make progress in that field,” she explains.

Such countries include those with significant influence over the global CCIC market (the United States); countries that host spyware vendors, or parts of their multi-jurisdictional corporate structures (e.g. Italy, Luxembourg, and Ireland); and countries where significant abuses involving this technology have occurred (e.g. Poland, Hungary, and Greece).

“The drafting process of the Code of Practice for States sparked a series of government debates about the use of CCICs that had not taken place before,” observes Paulus.

Now, by drafting a code of practice also for businesses, Alexandra Paulus hopes that states will meaningfully engage with industry, too. “Both [codes] can inspire national policies on CCICs,” she says.

Will the PMP contribute to spyware normalization?

Yet, the PMP has also attracted significant criticism. A key point of condemnation from legal experts and civil society is that the PMP – whose scope, it should be noted, does not extend to government-developed CCICs – appears to form part of a broader process of normalizing spyware use.

“Pall Mall moves us from a denialism of use to an embrace of use. And in fact, in many ways, we can see it as a framework that encourages, recognizes, and anticipates further spyware use,” says Fionnuala Ní Aoláin, a former special rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism for the UN Human Rights Council and a professor at the University of Minnesota, who recently published a legal and political assessment of the PMP.

Ní Aoláin observes that the PMP’s Code of Practice for States fails to articulate, with sufficient specificity, what states' obligations are in relation to this technology, particularly given its well-documented risks and the requirements of international human rights law.

Similarly, the PMP's framing around responsible use is problematic, as is its failure to define the relationship between domestic law and international frameworks, particularly where these don’t align.

“The Code of Practice for States specifies several criteria for assessing responsible use like domestic law, international law, respect for human rights and fundamental freedoms, and the UN framework for responsible state behavior. However, there is much debate about how each of these should be operationalized and what they mean in practice,” explains SWP’s Alexandra Paulus.

Another point of concern is the nature of civil society's engagement in the PMP, given that activists are often the targets of spyware attacks. “It is ad hoc and unsystematic, and it always feels like civil society is brought in at the last minute,” observes Ní Aoláin.

She argues that the process surrounding the Code of Practice for Industry “is moving very quickly without substantive engagement from human rights experts or civil society.”

Diplomatic sources, however, stress that the PMP's accelerated timeline reflects the “high international demand to act swiftly,” resulting in tight timeframes for all stakeholders.

Finally, two additional points of criticism is that the PMP, in its current form, does not address the need for ‘hard’ regulation to prevent the acquisition of CCICs by non-state groups; as well as concerns that without a robust exclusion capacity the PMP could be used by companies such as NSO Group – whose association with systematic human rights violations is well documented – as a means of rehabilitation and a way to mitigate the impact of sanctions imposed against them. Diplomatic sources maintain that the PMP will not involve consultations with companies or individuals that are sanctioned, subject to restrictions for irresponsible conduct, or facing legal proceedings in participating states' jurisdictions.

Next steps: industry code, implementation and expansion

In the next phase of the PMP, alongside the adoption of the Code of Practice for Industry, France and the UK are seeking to expand global participation through international outreach. Events have already been held in the Western Balkans, Southeast Asia, and Latin America, with a workshop planned for Africa in autumn 2026.

Yet key states where commercial providers of CCICs are based – including Israel and India – are still not participating. This is unsurprising to some extent, but “the absence of countries like Spain, for example, is striking,” says SWP’s Alexandra Paulus.

Securing a commitment from all EU member states to join the Pall Mall Process would send a strong signal, diplomatic sources stress.

France and the UK are also supporting the implementation of the Code of Practice for States through quarterly workshops for signatory governments aimed at strengthening national governance and sharing best practices. They also intend to monitor progress and measure the impact of the PMP's recommendations.

It is worth noting, however, that the Code of Practice for States does not include any accountability mechanisms for participating states that fail to meet their commitments. “Without one, the document becomes a mere declaration of intent that will hardly have political consequences,” says SWP’s Alexandra Paulus.

“But […] for many governments, particularly those with less well-resourced militaries and intelligence agencies, CCICs are a capability that they deem important to national security, and I consider it unlikely that they will voluntarily submit to any accountability mechanism.”