The Indo-Pacific Could Shape Control of the Growing Spyware Market

The process brings together governments, industry and civil society to address a cross-cutting problem. Unlike limited export controls regimes or overly broad UN processes, the Pall Mall Process creates a focal point for CCIC governance across security and human rights concerns.

But the code’s limitations are equally clear. It’s non-binding, with no formal enforcement or monitoring mechanisms. Much of the scrutiny of implementation is carried out by civil-society organizations on an ad hoc basis. The code also relies heavily on responsible use – an expectation that developers, providers and users follow ethical rules, safety standards and applicable legal regimes. While the code references international human-rights law, interpretations of what constitutes legitimate use of CCICs vary significantly across jurisdictions in ways that could affect digital rights.

Participation is another challenge. Many countries in South and Southeast Asia, where demand is growing, aren’t yet part of the process. Reasons vary, but a countervailing factor is that the issue hasn’t been fully contextualized regionally.

There are early signs of progress. Discussions are reportedly underway to establish working groups focused on implementation, threat research and impact assessment. The next phase of the process is turning to industry and developing guidelines on due diligence, vendor vetting and redress mechanisms, expected to culminate in a set of industry guidelines in 2026.

Whether these efforts succeed will depend on how they engage with the realities of the Indo-Pacific, given the geopolitical significance of the region and growing CCIC demand.

First, policy should engage directly with market dynamics. This includes understanding newer vendors, informal supply chains and emerging production hubs that sit outside traditional regulatory centres. Governance efforts should take non-state proliferation seriously. This means strengthening end-use monitoring, integrating spyware controls into counter-cybercrime strategies and recognizing that the boundary between state and criminal use is increasingly porous.

Second, capacity-building should move beyond high-level commitments. Governments need practical tools such as procurement standards, licensing frameworks and technical expertise to assess and manage risk. Independent oversight bodies should also monitor CCIC use.

Third, spyware governance needs regional ownership. External frameworks will have limited traction unless they are championed by local actors who can translate global principles into regional priorities and domestic practice. Identifying and supporting such partners should be a priority.

As a demand center, production hub and regulatory frontier, outcomes in the Indo-Pacific will determine whether global efforts can constrain spyware proliferation. Without stronger, locally grounded approaches, the spread of CCICs will continue to accelerate.

Allison Pytlak is the senior fellow and director of the Cyber Program at the Stimson Center. Gatra Priyandita is a senior analyst at ASPI. This article is published courtesy of the Australian Strategic Policy Institute (ASPI).