IC Technology & Cyber — 2026-11-15

US Endorses International Pall Mall Process Guidelines for Commercial Spyware

BLUFWithout binding enforcement or a reporting mechanism, the Pall Mall guidelines will function as diplomatic signaling rather than an operational constraint on the commercial spyware market.

Fourteen governments, including the United States, endorsed the Pall Mall Process Guidelines for Industry at the initiative's third conference in Paris on Wednesday, according to CyberScoop 1 and Bytes Europe 2. MLQ.ai lists the endorsers as Austria, the Bahamas, Costa Rica, France, Germany, Italy, Japan, Luxembourg, the Netherlands, Poland, Slovakia, Switzerland, the UK and the US 3. Representatives of 43 countries attended, and Bytes Europe reported it is unclear why 15 of the 27 signatories to the 2025 states' code did not endorse the text 2. The voluntary guidelines carry no penalties and ask firms to vet customers, build safeguards, monitor abuse, halt sales when serious misuse is credible, and "consider" remedies for victims 24. Access Now and the Business and Human Rights Centre told CyberScoop the text falls short, citing the absence of mandatory kill switches and binding rules 1; the State Department did not respond to CyberScoop's request for comment 1.

Analysis
The US endorsement adds a major spyware buyer and exporter, but the guidelines bind no vendor, so any effect depends on Washington and the other 13 endorsers writing them into procurement and export licensing. Fewer than half of the 43 attending states signed, and 15 of the 27 signatories to the 2025 states' code stayed out for reasons no outlet explains. Access Now and the Business and Human Rights Centre say the text lacks kill switches and enforceable rules, and it asks firms only to "consider" victim remedies. Governments that champion their own spyware industries may be endorsing mainly for diplomatic positioning, with little intent to restrict purchases or exports. Participants describe no mechanism for reporting national actions, so tracking implementation is the next test. Confidence is low: the four outlets largely rework the same ministry statements and one Record account, no primary text is available, and the State Department has not commented on US plans.

4 sources