Launched in early 2024 by France and the UK, the Pall Mall Process aims to address the unchecked spread and misuse of commercial spyware capabilities by establishing guidelines and fostering cooperation among governments, industry players, civil society, and academia.
- 27 countries have signed PMP's Code of Practice for States since 2025.
- PMP emphasizes customer vetting, supply chain diligence, and transparency.
- Critics warn PMP may inadvertently legitimize spyware use.
What happened
In early 2024, France and the United Kingdom launched the Pall Mall Process to tackle the growing global proliferation and reckless use of commercial cyber intrusion capabilities, such as spyware and hacking tools. The initiative brings together a coalition of governments, civil society, industry, and academics to formulate coordinated strategies against the misuse of these technologies.
By April 2025, a non-binding Code of Practice for States was adopted and signed by 27 countries, committing them to measures regulating the development, sale, and use of these cyber tools. A complementary Code of Practice for Industry is under development and is expected to be finalized at the Paris Peace Forum in November 2026 following a broad consultation process involving companies from the US, Europe, and the Middle East.
Why it matters
The rapid acquisition and abuse of commercial cyber intrusion capabilities pose significant challenges to human rights and national security worldwide. Approximately 100 countries have accessed such spyware technologies, lowering barriers for states and potentially non-state actors to conduct surveillance and cyber operations without adequate safeguards.
The Pall Mall Process stands out by focusing on a smaller group of committed states with direct influence over this market and significant stakes in mitigating abuse. It has catalyzed new government discussions on spyware oversight and aims to foster greater transparency and responsibility within the spyware industry through both governmental and business codes of conduct.
What to watch next
The forthcoming launch of the Code of Practice for Industry will be a critical moment to observe whether private sector entities adopt standardized vetting, supply chain due diligence, and transparency measures consistently. This will indicate if the Pall Mall Process can influence corporate behavior meaningfully.
However, scrutiny remains around the initiative’s limitations, particularly its failure to address state-developed spyware and insufficiently clear obligations for states regarding human rights protections. Advocacy groups and legal experts remain cautious that the PMP could lead to a normalization rather than strict regulation of spyware use, underscoring the need for ongoing monitoring and potentially more robust international legal frameworks.