Britain, France set out first guidelines for commercial hacking firms
Fourteen governments have adopted the first global guidelines for commercial hacking businesses as part of the Pall Mall Process diplomatic initiative.
The guidelines, announced Wednesday, target commercial cyber intrusion capabilities (CCICs) that have become widely available to various actors. "Access to certain capabilities once reserved for a handful of specialized government agencies has gradually widened: any actor can now buy 'off the shelf' the ability to silently penetrate a phone," stated the French Foreign Ministry.
Guidelines Details
The non-binding document calls on businesses developing, selling or financing CCICs to implement customer vetting procedures, establish technical safeguards against misuse, and maintain systems for monitoring and reporting abuses. Companies should halt sales when serious misuse is a credible risk.
The point of the industry guidelines is "to disincentivise irresponsible activity across the market for CCICs; improve transparency for regulators, vendors and customers; and provide clarity for businesses operating both within and peripherally to the industry," said the British Foreign Office.
Limited Participation
The guidelines were endorsed at the Pall Mall initiative's third conference, attended by representatives from 43 countries. However, fewer than half signed up to endorse them, with signatories including the United Kingdom, France, United States, Germany, Italy and Japan.
"A voluntary code is not, however, an optional code: one's word, given before one's peers, one's industries and one's citizens, is a commitment," the ministry stated, emphasizing the commitment aspect despite the voluntary nature.
Ongoing Challenges
The Pall Mall Process has faced persistent challenges since its 2024 launch. Last year's conference produced the first code of practice for governments but no agreement on influencing company behavior. Twenty-seven countries signed that code, while 15 did not endorse the new guidelines.
Participants will continue their work as "artificial intelligence, the growing automation of certain functions and the emergence of new business models" raise new questions for governments and companies, according to the ministry.
Related
