Voluntary ‘Pall Mall Process’ seeks to curb spyware abuses

The 21 signatories support a number of steps, such as banning vendors who behave illegally, in a document agreed to last week in Paris.

Twenty-one nations signed on to a voluntary accord last week in Paris to govern the use of commercial hacking tools commonly known as spyware, after more than a year of work on the agreement.

The Pall Mall Process, or Code of Practices for States, has four pillars for the responsible use of the surveillance tech, which it labels “commercial cyber intrusion capabilities” (CCICs): accountability, precision, transparency and oversight.

Among its recommendations are establishing steps to ban vendors who engaged in illegal or irresponsible behavior, writing regulations to ensure that the technology is used only in lawful and necessary situations, applying export controls with consideration for human rights, creating policies that define the appropriate use of technology for cybersecurity purposes, and encouraging vendors to publish coordinated vulnerability disclosure procedures.

It’s the second major international voluntary agreement to counter the misuse of commercial spyware, following a United States-led effort in 2023 that as of earlier this year had 23 signatories, including many who enlisted with the France/United Kingdom-led Pall Mall Process. It comes in response to a growing market for commercial hacking tools that threaten human rights and cybersecurity, according to the text of the code.

“Without international and meaningful multistakeholder action, the growth, diversification, and insufficient oversight across this market raises the likelihood of increased irresponsible targeting of a range of public and private targets, including journalists, human rights defenders and government officials, as well as critical national infrastructure,” the code states. “It also risks facilitating the spread of potentially destructive or disruptive cyber capabilities to a wider range of actors, including cyber criminals.

“Increasing access to sophisticated capabilities may expand the complexity of incidents and opportunities for irresponsible use, and could contribute to unanticipated risks arising from the  interaction of multiple actors in cyberspace, including potential unintentional escalation in cyberspace,” it continues.

The nations signing on to the accord were Austria, Denmark, Estonia, France, Germany, Ghana, Greece, Hungary, Ireland, Italy, Japan, Kosovo, Luxembourg, Moldova, Netherlands, Poland, Slovakia, Slovenia, Sweden, Switzerland and the United Kingdom. Some of those nations are confirmed or suspected spyware users, but the list excludes Israel, a major hub for spyware firms, and many of the worst alleged abusers.

The supporting nations say the document isn’t the end of the initiative.

“We intend to regularly review progress on the implementation of these voluntary good practices and on improving accountability across the market,” the code reads. “We resolve to keep this Code of Practice up to date with developments in the threat landscape.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure