In short
- Commercial spyware provides governments with powerful and invasive espionage tools. Yet, its abuse has enabled rights violations, political scandals, and threats to international security.
- The international ‘Pall Mall Process’ seeks to curb these harms by setting global norms for the development, sale, and use of commercial cyber intrusion tools.
- While industry rules matter, they are not sufficient. Curbing the proliferation of commercial spyware starts at addressing states, as they procure, authorise, deploy, and must be held accountable for abusive use.
- Pall Mall addresses state responsibility, but the Process’ impact is limited by gaps in representation, implementation, and enforcement.
- Bridging these gaps requires action by governments, regional bodies such as the EU, and the Pall Mall Process.
The proliferation of commercial spyware has given governments powerful, sophisticated, and highly invasive espionage tools to access messages, locations, cameras, and microphones without the target’s knowledge. Although marketed to intelligence and law enforcement agencies as a tool to protect national security, its illegitimate deployment has repeatedly driven political scandals, abuse, and human rights violations across the globe.
In response, the UK and France established the international multistakeholder “Pall Mall Process” to curtail the harmful use of commercially available cyber intrusion capabilities, including commercial spyware. The Process is currently developing guidelines for industry, and it has consulted governments, industry stakeholders, and civil society organisations – including the Clingendael Institute.
Against this background, this policy brief argues that regulating the commercial spyware market is necessary but not sufficient, since states remain the actors responsible for authorising, overseeing, and remedying its use. While the Pall Mall Process addresses responsible practices for states as ‘demanders’ in this market, the Process’ overall impact is limited by representation, implementation, and enforcement challenges.
This brief calls for a layered response to strengthen ‘demand-side’ governance to curb the proliferation of commercial spyware: (1) stronger domestic safeguards and clarity on national security definitions; (2) more assertive use of rule-of-law and foreign policy instruments by the EU, and (3) a more inclusive Pall Mall Process that advances international knowledge diffusion and clarity on the application of international law.