Britain, France set out first guidelines for commercial hacking firms

Fourteen governments participating in the Pall Mall Process, a diplomatic effort led by Britain and France to rein in the global spyware industry, adopted their first guidelines for commercial hacking businesses on Wednesday.

The French Foreign Ministry said the guidelines, aimed at addressing abuses associated with the proliferation of commercial cyber intrusion capabilities (CCICs), set out “the first global standard of responsible conduct.”

“Access to certain capabilities once reserved for a handful of specialized government agencies has gradually widened: any actor can now buy ‘off the shelf’ the ability to silently penetrate a phone,” the ministry said.

While it acknowledged those tools have been used in intelligence operations and to tackle organized crime, the ministry warned they “have also been implicated in surveillance campaigns targeting journalists, political officials, activists or businesses.”

The guidelines are non-binding and endorsed by governments rather than industry organizations. They call on businesses that develop, sell or finance CCICs to vet their customers, establish technical safeguards against misuse and to maintain systems for monitoring and reporting abuses.

Companies should halt sales and support when serious misuse is a credible risk, according to the text, and are asked to “consider” remedies for victims of human rights abuses. There are no penalties for non-compliance and enforcement pressure is expected to come from governments which buy the tools and license their export.

The point of the industry guidelines is “to disincentivise irresponsible activity across the market for CCICs; improve transparency for regulators, vendors and customers; and provide clarity for businesses operating both within and peripherally to the industry,” said the British Foreign Office.

The guidelines were endorsed at the Pall Mall initiative’s third conference, attended by representatives from 43 countries. Fewer than half signed up to endorse them, with signatories including the United Kingdom and France, alongside the United States, Germany, Italy and Japan.

The guidelines “are voluntary in nature,” the ministry said. “They do not create new international legal obligations and do not call into question uses that states consider legitimate in the fields of national security, defense, the fight against organized crime or cybersecurity.

“A voluntary code is not, however, an optional code: one’s word, given before one’s peers, one’s industries and one’s citizens, is a commitment.”

The Pall Mall Process has faced persistent challenges since its launch in London in 2024. While that event drew large technology and cybersecurity firms, it did not feature the controversial businesses whose products had been linked to abuses.

A year later, participants raised concerns that the initiative lacks the ability to actually change how these tools are traded and used. Some noted that Britain and France were seeking to restrict other states’ access to these tools while championing their own spyware industries.

Last year’s conference produced the first code of practice for governments, but no agreement on how to influence company behavior. Twenty-seven countries have since signed the code. It is not clear why the remaining 15 did not endorse the new code on Wednesday.

The ministry said participants would continue their work as “artificial intelligence, the growing automation of certain functions and the emergence of new business models” raise new questions for governments and companies.