Global Push for Responsible Use of Commercial Hacking Tools: The Pall Mall Code Under Scrutiny

As the digital arms race intensifies, nations are being urged to act more responsibly in their use of commercial hacking tools—technology often associated with privacy invasions, surveillance abuse, and targeted attacks on vulnerable communities. In response, 21 countries have now signed a voluntary agreement, known as the Pall Mall Code, aiming to establish ethical boundaries for state use of cyber intrusion tools. While the code represents a symbolic shift in how governments are expected to engage with offensive cyber capabilities, it has left cybersecurity experts, civil society organizations, and analysts divided on its true potential and effectiveness.

Breaking Down the New Code: A 30-Line Recap

A new voluntary code, led by France and the U.K. under the Pall Mall Process, has been signed by 21 countries.
This code focuses on establishing norms around the use of commercial cyber intrusion tools, such as spyware and exploit services.
It is seen as a response to rising concerns about the misuse of commercial spyware, particularly tools like Pegasus developed by NSO Group.
The initiative aims to prevent the abuse of these tools for suppressing dissent, targeting journalists, or violating human rights.
Cyber experts involved in discussions generally welcome the framework but express lukewarm enthusiasm.
Elina Castillo Jimenéz of Amnesty Tech acknowledges that the code addresses key concerns but criticizes its lack of strong victim support measures.
Natalia Krapiva of Access Now notes that while civil society is skeptical of a voluntary code, it’s currently the only multilateral effort tackling this issue.
A next step involves developing guidance for the private sector, especially companies creating or distributing these tools.
Former NSA operator Evan Dornbush supports the inclusion of the private sector, emphasizing that strategic offensive cyber actions require public-private cooperation.
He also highlights the need for reassurance that governments signing the code won’t misuse tools against activists or journalists.
NSO Group, one of the world’s most controversial spyware vendors, also contributed to the code’s development through recommendations.
The company’s spokesperson claimed their practices were reflected in the final draft, showing some level of industry integration.
Jen Ellis, founder of NextJenSecurity, welcomed the process but raised concerns over the lack of enforcement and real-world impact.
She fears the code might simply create a distinction between “good” and “bad” actors without altering behaviors.
Romania has recently joined the list of signatories, expanding its reach beyond the initial group.
However, notable countries remain absent—most critically, the United States has yet to endorse the code.
Katharina Sommer of NCC Group praised the effort as a significant milestone but stressed the need to bring in more “middle ground” states.
She also pointed out the geopolitical implications of the U.S. absence, signaling a retreat from multilateral cooperation.

– At a workshop,

His comments sparked confusion and concern, with at least one participant interpreting it literally.
Neither the U.S. National Security Council nor Work has clarified the statement or explained the decision to stay out of the agreement.
This ambiguity further fuels doubts about the coherence of global cyber diplomacy.
Overall, the code represents a cautious step toward accountability but lacks binding mechanisms.
Civil society groups remain wary of a framework with no legal consequences or guaranteed enforcement.
Its voluntary nature makes its adoption and implementation uneven at best.
Nevertheless, it opens the door for ongoing dialogue and future policy evolution.
Stakeholders agree that broader participation and transparency will be crucial for the code’s credibility.
With elections looming in several key nations, the code’s future momentum remains uncertain.
Whether this voluntary framework becomes a stepping stone to binding regulation or a symbolic gesture is yet to be seen.

What Undercode Say:

The Pall Mall Code stands as a paradoxical achievement in global cyber governance: a milestone that reflects growing awareness, yet also reveals the limits of multilateral diplomacy in the digital era. On one hand, the 21-country agreement is a visible sign that world powers recognize the ethical and political dangers posed by unchecked use of commercial hacking tools. On the other, its voluntary structure and vague enforcement provisions render it vulnerable to becoming mere performative policy.

Analytically speaking, the

However, civil society voices have rightfully raised concerns. Human rights advocates argue that without real safeguards for victims, the code may do little more than polish a country’s global image. Humanitarian values appear to be underemphasized in the final draft, and key stakeholders, including victims of surveillance abuse, remain marginalized in the process.

Another major limitation is the exclusion of key players—especially the United States. Washington’s non-participation sends a dissonant signal. On the one hand, U