Britain, France set out first guidelines for commercial hacking firms

The point of the industry guidelines is “to disincentivise irresponsible activity across the market for CCICs; improve transparency for regulators, vendors and customers; and provide clarity for businesses operating both within and peripherally to the industry,” said the British Foreign Office.

The guidelines were endorsed at the Pall Mall initiative’s third conference, attended by representatives from 43 countries. Fewer than half signed up to endorse them, with signatories including the United Kingdom and France, alongside the United States, Germany, Italy and Japan.

The guidelines “are voluntary in nature,” the ministry said. “They do not create new international legal obligations and do not call into question uses that states consider legitimate in the fields of national security, defense, the fight against organized crime or cybersecurity.

“A voluntary code is not, however, an optional code: one’s word, given before one’s peers, one’s industries and one’s citizens, is a commitment.”

The Pall Mall Process has faced persistent challenges since its launch in London in 2024. While that event drew large technology and cybersecurity firms, it did not feature the controversial businesses whose products had been linked to abuses.

A year later, participants raised concerns that the initiative lacks the ability to actually change how these tools are traded and used. Some noted that Britain and France were seeking to restrict other states’ access to these tools while championing their own spyware industries.

Last year’s conference produced the first code of practice for governments, but no agreement on how to influence company behavior. Twenty-seven countries have since signed the code. It is not clear why the remaining 15 did not endorse the new code on Wednesday.

The ministry said participants would continue their work as “artificial intelligence, the growing automation of certain functions and the emergence of new business models” raise new questions for governments and companies.