The United States this week signed on to an international set of industry standards for commercial offensive cyber tools that human rights groups and other advocates wish had been stronger.
The Pall Mall Process voluntary industry guidelines for commercial cyber intrusion capabilities (CCICs), such as spyware, are the second step in a U.K.- and France-led initiative, following last year’s code for nations.
“Through the Industry Guidelines, we aim to disincentivise irresponsible activity across the market for CCICs; improve transparency for regulators, vendors and customers; and provide clarity for businesses operating both within and peripherally to the industry,” the U.K. and French foreign ministries said after the guidelines were finalized Wednesday.
The guidelines have four main pillars: compliance with regulations and norms, due diligence, risk management and monitoring of compliance. They contain recommendations like complying with export controls, creating a risk assessment process, implementing technical controls on access such as encryption and continuously observing who can use the capabilities.
The end result is a compromise that some advocates wish had gone further.
“The guidelines clearly reflect the fact that they are the product of multiple stakeholders with often contradicting views: states, industry, academia, ethical hackers, and civil society,” said Natalia Krapiva, senior tech-legal counsel for Access Now. “While civil society has advocated for more robust standards and measures, including mandatory technical kill switches, more transparency and stronger due diligence requirements, we will continue working with the Pall Mall Process to ensure that these guidelines help limit the uncontrolled proliferation and misuse of cyber intrusion tools, including spyware.”
Gayatri Khandhadai, head of technology and human rights at the Business and Human Rights Centre, said the real potential of the Pall Mall Process is in governing commercial spyware through cooperation between nations.
“Unfortunately, the outcome falls short of what is truly needed to hold this industry to account,” she said about the industry guidelines. “There is little evidence that spyware companies meet even their minimum responsibilities under international human rights law and the U.N. Guiding Principles on Business and Human Rights.”
“States must raise the bar if they are serious about implementing concrete change,” she continued. “That means setting clear limits on use, attaching binding conditions to public procurement, extending scrutiny across the supply chain, guaranteeing victim notification and remedy, and moving from voluntary guidance to enforceable law.”
Allison Pytlak, senior fellow and director of the cyber program at the Stimson Center, said that through negotiations, a prior heavier focus in the guidelines on national security and proliferation arguments shifted toward a better balance with human rights in the final version.
She also said that the guidelines reflect the scope of the problem and the need for taking action.
“I think everyone just has obvious questions like, ‘What next? Will this be implemented? What impact will it have?’” she said. “It’s got some good momentum. It’s created like a very clear space to really zoom in on this problem. But I think it’s going to need to show some results soon to keep up support and momentum.”
The industry guidelines were finalized during this week’s meetings, where a key topic of discussion was how artificial intelligence might impact the Pall Mall Process. The next agenda item is how the code for states and industry guidelines will be implemented.
“Countries are doing things at a national level, but there isn’t any kind of clear and coherent way to track that,” Pytlak said. “It happens in their own national context, and there isn’t really a feedback or reporting mechanism. So I think a lot of what was talked about at this meeting was, for both the code and the guidelines is, that’s got to be concretized a little bit better.”
The State Department did not respond to a request for comment.
Source: CyberScoop · 2026-11-13