Third time’s the charm for Pall Mall in Paris?

As springtime bloomed in Paris in the first week of April 2025, 21 states (later joined by Romania and the United States) signed a non-binding code of practice to tackle the proliferation and irresponsible use of commercial cyber intrusion capabilities (CCICs) during the third instalment of the Pall Mall Process. Yet several unresolved questions remain, the answers to which are fundamental to the code’s success.

Problematic CCIC Industry

For years, civil society has documented the risks that the commercial proliferation and misuse of CCICs can pose to national and international security, respect for human rights, and democratic institutions. For example, both autocratic and several democratic states have deployed commercial spyware to conduct espionage and perpetrate digital repression against scores of politicians, dissidents, journalists, and others worldwide.

Concern about the negative externalities of the CCIC industry extends well beyond the spyware market. It relates to a complex and interconnected ecosystem of, inter alia, vendors, researchers, brokers, and investors, through which a broad array of tools and services becomes commercially available to ‘irresponsible’ state and nonstate actors. 

The industry for CCICs – which are generally understood to procure access to a targeted device, system, or network without the permission of its user, operator, or owner – has boomed over the past decades. Now, states are struggling to rein it in.

The Pall Mall Process

Faced with reports of growing commercial cyber intrusion capability misuse and an expanding and diversifying marketplace, the United Kingdom and France jointly launched the Pall Mall Process in 2024. The process is a multi-stakeholder initiative that brings together states, international organisations, private industry, academia, and civil society to establish guiding principles and discuss policy options for governing CCICs. 

Following the inaugural Pall Mall Declaration in February 2024, and a state-only meeting in November of that year, Pall Mall participants convened on 3 and 4 April 2025 to discuss a voluntary code of practice for states. The code builds on a multi-stakeholder consultation conducted by the United Kingdom and France, which compiled good practices from 73 respondents to combat the proliferation and irresponsible use of CCICs. 

Setting out good practices for states regarding the development, facilitation, purchase, transfer and use of CCICs, the code is structured around the process’s four core pillars: accountability, precision, oversight, and transparency. 

They say that all good things come in threes, but will the outcome of the third Pall Mall meeting be ‘the charm’ for governing CCICs? As it stands, the code leaves several questions unanswered. Three areas of concern stand out.

‘Responsible’ use conundrum

To paraphrase one Paris participant, who drew on a quote often attributed to Tolstoy: the best stories – or, in this case, the most complicated problems – do not concern good versus bad but rather pit good against good. While commercial cyber intrusion capabilities can jeopardise national and international security, undermine respect for human rights, and put democratic institutions at risk, they can also contribute to crime prevention, counterterrorism, and other purposes that protect these very interests.

Accordingly, the code faces the challenging task of differentiating desirable from reprehensible state uses of CCICs. In its attempt to do so, it introduces several standards, including ‘responsible’, ‘lawful’, ’legal’, and ‘legitimate’. However, these terms are open to interpretation and are not necessarily synonymous. 

For example, use that is ‘legal’, complying with domestic law, might nevertheless be considered ‘irresponsible’ or ‘illegitimate’. Is ‘legitimate’ CCIC use necessarily ‘responsible’? While the code implicitly defines ‘responsible’ use, it is largely silent on its relationship to, and the meaning of, the other terms.

The potential variation in and incoherence between these standards invites disparity in states’ understanding of what the code condemns versus what it encourages them to do. This will likely aggravate divergence in national implementation, which is already a risk due to the code’s voluntary nature. To give the Pall Mall Process a real chance at reining in the CCIC industry, the ‘responsible’ use conundrum must be addressed.

Question of accountability

Although accountability is a core pillar of the process, the code contains little to ensure that states are held to their commitments. Instead, it largely focuses on ensuring the accountability of private industry. While this is an essential part of governing CCICs, the code’s commitments pertain solely to, and are entirely dependent on, states for their implementation.

In parts, the silence on enforcement goes hand-in-hand with the code’s voluntary nature. Yet its non-binding character does not preclude the inclusion of measures to demonstrate and evaluate states’ compliance, as well as to condemn non-compliance. In Paris, nonstate stakeholders discussed options to bolster accountability, such as self-reporting by participating states and the creation of positive incentives to reward compliant parties.

Several code signatories, including Greece and Italy, have faced allegations of misusing CCICs or enabling their commercial proliferation to ‘irresponsible’ end-users. Hungary, meanwhile, has been criticised for systematically subverting the rule of law in the CCIC context and beyond. Should further states join the code, for example during future iterations of the Pall Mall Process, questions of accountability will likely persist. Follow-up discussions on measures to assess and incentivise state compliance will thus be essential for maintaining the credibility of the process.

Risk of divergence

Finally, the code raises questions about divergence in states’ willingness to commit to CCIC governance and the potential for the resulting disparities in governance approaches to fragment markets. To date, only 23 states worldwide are code signatories. 

The tendency of vendors to hop between jurisdictions seeking the most favourable regulatory environment underlines the importance of collective governance efforts. Otherwise, the implementation of stricter regulatory measures by some states might simply prompt an exodus of private industry to more lenient ones.

Ultimately, the emergence of parallel, less regulated markets may be inevitable. This does not mean that success for Pall Mall is out of reach. Creating a unified marketplace that is sufficiently attractive to sway a large part of the industry to adhere to more stringent rules would already go a long way to mitigating the negative externalities of the current CCIC marketplace.

This requires harmonious implementation of the code as well as its support by states with the political capital and market power to lead others in reconfiguring market incentives. The decision to join by the United States, which had not done so initially despite taking significant actions to rein in the CCIC industry under its previous administration, is reason for cautious optimism. However, it is worrying that several states previously expressing their interest in participating in the Pall Mall Process, such as Five Eyes members New Zealand and Australia, have not signed up.

All in all, as is the nature of international political commitments, the success of the Pall Mall code of practice depends on what states make of it. As a multilateral, multi-stakeholder effort, the process creates a unique regulatory opportunity, providing a forum for collective international action and giving impetus to states’ development and implementation of national policies to counter the negative externalities of the commercial cyber intrusion industry. One thing is clear: to make the best of the opportunity at hand and to set the Pall Mall Process up for future success, states will need to answer the questions that the code of practice leaves unresolved before these pull it apart at the seams.