Why states are failing to rein in the spyware market

More than a decade ago, states first attempted to collectively govern the spyware market. Yet vendors have for years continued to sell commercial spyware with little restraint, regardless of negative externalities for security, human rights, and democratic freedoms. Why are states failing to rein in the spyware market? Unpacking their interests as regulators as well as market hosts and spyware clients, the article highlights the role states play in driving commercial spyware proliferation. Namely, it demonstrates how -on a balance of these interests- states remain hesitant to tie their own hands with regard to spyware use and trade. Accordingly, past efforts to constrain the spyware market have been, and emerging ones risk remaining, highly permissive of commercial spyware proliferation by design. This enables market and regulatory behaviours by states on the national and regional plane that incentivise vendors to proliferate their tools widely, including to governments deploying them for digital repression and espionage. Ultimately, the article concludes that -unless they recalibrate the calculus underpinning their governance decisions- states will keep failing to rein in the spyware market.