Fourteen governments adopt first guidelines for commercial spyware vendors

On Wednesday, fourteen governments in the Pall Mall Process endorsed the first written guidelines for firms that develop, sell, or finance commercial cyber intrusion capabilities — tools sold to silently penetrate a phone. Britain and France lead the effort. Signatories include the United Kingdom, France, the United States, Germany, Italy, and Japan. The French Foreign Ministry called the text the first global standard of responsible conduct. The guidelines are voluntary, create no new legal obligations, and carry no penalties.

The text asks firms to vet customers, build technical safeguards against misuse, and keep systems for monitoring and reporting abuses. They should halt sales and support when serious misuse is a "credible risk," and are asked only to "consider" remedies for human-rights victims. The British Foreign Office said the aim is to disincentivize irresponsible sales and improve transparency; pressure is expected from buyer governments and export licensers, not a new enforcement body. Forty-three countries attended; fewer than half signed. A prior government code of practice has 27 signatures. Why the rest withheld endorsement is not stated.

Document trail and ministry line diverge. Paris said tools once limited to a few agencies are now sold off the shelf, used for intelligence and organized crime, and tied to surveillance of journalists, officials, activists, and businesses, with no vendor named. The text leaves untouched any use a state calls legitimate for security, defense, crime, or cybersecurity. The split is a code for sellers, not a cap on the governments that buy. Britain and France face charges of narrowing others' access while protecting their own industries. Fourteen signatures and no penalties label the gray market; they do not close it.

The French ministry said talks continue as artificial intelligence, automation of intrusion functions, and new business models raise further questions. The test is not another signature count. It is whether export-licensing states — Britain, France, and the other buyers in the room — actually suspend licenses and contracts when misuse is documented. Watch the next Pall Mall meeting for whether non-signatories among the 43 join, and whether any named vendor loses a government deal under this language. If procurement records do not move, the code remains a press line. The market will keep selling what states keep buying.