On 3-4 April, the second conference of the Pall Mall Process took place in Paris. The Pall Mall Process is a multistakeholder initiative launched by the UK and French governments to address the risks of commercial cyber intrusion capabilities (CCICs).
Following the launch of the Pall Mall Process with a declaration at Lancaster House in London in February 2024, and a follow-up event as part of the Paris Peace Forum in November 2024, this conference represented a significant milestone for the process. The November conference had concluded a three-month consultation with civil society and industry and launched a series of negotiations on a Code of Practice between interested states. At the April conference, 21 states committed to support the finalized Code of Practice, which had been drafted in alternating rounds of state negotiation and multistaker input throughout the preceding weeks.
On the second day of the conference, Virtual Routes Co-Director Dr James Shires chaired a panel on “Navigating the Grey Zone: Mapping the Availability of Cyber Intrusion Tools and Services”. Four expert panelists approached the question of availability from varying perspectives: first, the geographical location and shifting identities of the corporate entities producing and investing in such capabilities; second, the ability and limitations of state control over transnational transfers through export control; third, the career trajectories of individual security and vulnerability researchers; and fourth, patterns of infection developed from detection of such capabilities on target devices.
These interventions stimulated a wide-ranging discussion, including practical recommendations to improve device-based detection of CCICs, avoid unintended negative consequences of regulation on individual researchers and internal state resources; and greater transparency on the market overall. Over the coming months, as the participating states of the Pall Mall Process hopefully implement the Code of Practice, and new states join in, these recommendations can help the process to develop the international collaboration and new governance mechanisms urgently required in this area.
