Wassenaar Arrangement
The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies (est. 1996, Wassenaar, Netherlands; secretariat in Vienna) is the principal multilateral export-control regime for conventional arms and dual-use technology — the post-Cold-War successor to COCOM. 42 participating states coordinate national export-control lists; the regime is consensus-based and non-binding: implementation and enforcement remain entirely national. (Fact / High.)
Relevance to the intrusion-software problem
- The 2013 amendments added “intrusion software” and IP network surveillance systems to the dual-use control lists — the first multilateral attempt to bring commercial spyware under export control. Implementation proved contentious: the 2015 US BIS draft rule was withdrawn after security-research community objections, and a narrowed exemption for vulnerability research was negotiated in 2017. (Fact / High.)
- Key non-members include Israel — the dominant commercial-spyware licensor, which aligns parts of its national control list with Wassenaar but allocates exports under its own Defense Export Control Act (2007) as an instrument of foreign policy. The regime therefore does not bind the jurisdiction at the center of the NSO Group / Pegasus proliferation problem. (Fact / High.)
- Structural limitation: the Arrangement is built around identifiable vendors of specific, listable tools. Capability delivered as a service, embedded in ordinary commercial frameworks, or generated autonomously at machine scale falls categorically outside its control architecture — the central finding of Commercial Spyware Proliferation — The Pegasus Template. (Assessment / Medium.)
Key Connections
- Commercial Spyware Proliferation — The Pegasus Template — the regime under structural strain
- NSO Group · Pegasus Spyware — the proliferation case the regime failed to contain
- Mass Surveillance — downstream doctrinal frame
- Israel — non-member licensor state at the center of the market
Sources
- Wassenaar Arrangement Secretariat — founding documents, control lists (wassenaar.org). [primary] (High)
- U.S. BIS — 2015 proposed intrusion-software rule and 2017 renegotiation record. [primary] (High)
- Citizen Lab / Access Now commentary on the 2013 intrusion-software amendments. [secondary, technical research/advocacy] (Medium-High)
Stub created at Revisão (D-018 gate run, 2026-06-11) to resolve a load-bearing dead wikilink; expand with member-state list dynamics and the 2019 cyber-surveillance amendments on next pass.