U.S. joins U.K. and France in Pall Mall Process standards for spyware tools

The United States signed on this week to international industry standards for commercial offensive cyber tools under the U.K.- and France-led Pall Mall Process, according to reporting by CyberScoop.

CyberScoop reported that the standards emerged from this week’s meetings and reached final form Wednesday, marking the second step in an initiative that followed a code for nations released last year. The voluntary industry guidelines cover commercial cyber intrusion capabilities such as spyware.

The guidelines rest on four pillars: following regulations and norms, conducting due diligence, managing risk and monitoring compliance. They suggest complying with export controls and creating a risk assessment process. The framework also calls for encryption and other technical controls to limit access, along with ongoing monitoring of who can access the capabilities.

The U.K. and French foreign ministries said the guidelines seek to reduce irresponsible activity across the commercial cyber intrusion capabilities market. They also said the framework aims to improve transparency among regulators, vendors and customers, and to give clarity to businesses inside and on the edges of the industry.

CyberScoop reported that human rights groups and other advocates wish the standards had been stronger, calling the final guidelines a compromise that did not go far enough. Natalia Krapiva of Access Now said the guidelines reflect disagreement among governments, companies, researchers, hackers and nonprofit groups.

Access Now backed mandatory technical kill switches, greater transparency and stronger due diligence requirements. The group said it will keep working with the Pall Mall Process to curb the spread and abuse of cyber intrusion tools such as spyware.

Gayatri Khandhadai of the Business and Human Rights Centre said the Pall Mall Process could best govern commercial spyware through cooperation between nations. She said the outcome does not go far enough to hold the industry to account. Khandhadai said little evidence shows spyware companies meet minimum duties under human rights law and under the U.N. Guiding Principles on Business and Human Rights.

She said states must set clear limits on use and attach binding conditions to public procurement. She said states should extend scrutiny across the supply chain, guarantee victim notification and remedy, and move from voluntary guidance to enforceable law.

Allison Pytlak of the Stimson Center said the final guidelines balance human rights more than national security and proliferation arguments after negotiations. She said the guidelines reflect the scale of the problem and the need to act. Pytlak said they carry good momentum and open a clear space to examine the problem.

She said the guidelines must show results soon to maintain support and momentum. She said countries act at a national level without a clear and coherent way to track what they do, and that national actions lack a genuine feedback or reporting mechanism. She said the code and guidelines should become more concrete.

A key discussion topic at the meetings was how artificial intelligence could affect the Pall Mall Process. The next agenda item concerns implementing the state code and industry guidelines. No response came from the State Department to a comment request.