NEWS Hackers’ Code: The World on the Brink of a Historic Agreement

[Doni]

Paris becomes the center of cybersecurity ethics negotiations
​

This week, Paris has become the stage for complex diplomatic talks focused on combating the uncontrolled spread and use of commercial hacking tools. France and the United Kingdom have launched a joint initiative called the Pall Mall Process, aiming to develop new rules for regulating the trade and use of Commercial Cyber Intrusion Capabilities (CCICs).
Despite its ambitious goals, the process has faced challenges. Many participating countries are reluctant to abandon established practices, and not everyone is convinced of the effectiveness of the proposed measures. Nonetheless, a draft agreement has been prepared at the final stage and is now being circulated to governments, international organizations, the academic community, and tech companies. The document outlines a series of voluntary commitments.
Among the proposed measures:

• Regulation of the development and export of hacking tools;
• Creation of internal control mechanisms for their use;
• Implementation of vulnerability assessment systems;
• Refusal to purchase from companies involved in illegal activities;
• Imposing sanctions on those who profit from the irresponsible use of CCICs.

The urgency of the issue is highlighted by instances where such technologies have been used against journalists, human rights defenders, opposition figures, and even foreign officials. Moreover, the unchecked proliferation of CCICs undermines the cybersecurity economy, encouraging the hoarding of vulnerabilities for later exploitation.
However, approval of the agreement is complicated by the absence of major CCIC-exporting countries from the negotiations, including Israel, India, Austria, Egypt, and North Macedonia. Israel’s absence is particularly notable, as 2 out of 4 companies sanctioned by the U.S. for selling digital repression tools are based there.
Nevertheless, signs of progress are emerging. Sources report the informal involvement of Israel and the NSO Group in the process — though still at an early stage and without expectations of signing the document at this point.
The draft is built around a voluntary Code of Practice, inspired by the Montreux Document and the Code of Conduct for Private Security Companies. The goal is to create an international ethical standard for the hacking industry, with a strong emphasis on compliance with international humanitarian and human rights law.