Companies which make spyware will have to apply for permission to export the software once new EU regulations come into effect in late December.

Officially referred to as “intrusion software”, the software will now be included on the EU’s list of “dual use” items, defined as “goods, software and technology normally used for civilian purposes but which might have military applications or contribute to the proliferation of weapons of mass destruction.”

The restriction means that companies will have to apply for a licence to export spyware, although it doesn’t affect the sale of the software within the UK. Inclusion on the dual-use list places the technology alongside nuclear reactors, ultra-high-resolution cameras, and rocket fuel.

While the regulation is implemented by the European commission, the British government supports the restriction of spyware. “The UK has made it clear over the last two years that we believe that while these kind of technologies do have legitimate uses, they also pose threats to national security and to human rights and should be subject to export controls,” said a spokesperson for the Department for Business, Innovation and Skills.

“As these technologies are available from a number of supplier states it was important that we addressed the issue on an international basis. We have therefore worked hard with international partners to achieve these new controls.”

Unlike many goods on the dual-use list, however, it is hard to prevent the unauthorised export of spyware. “Is the aim just to keep British technology or European technology out of the hands of people deemed unsuitable to own it, or is it really to deny those people access to such technology,” asks Trend Micro’s Rik Ferguson.

“If it’s the latter, then it’s pretty much doomed to failure. Because all you have to do is look at the criminal underworld, and look at the tools and capabilities that are used by those people. In many cases they’re no different at all to the sort of commercial spyware that this legislation refers to.”

One firm which would have been affected, had the regulations been in place earlier, is FinFisher, a German firm that used to be part of UK-based Gamma International. The company’s FinSpy software was offered for sale to Egyptian security services in June 2010, according to documents seen by the Guardian in 2011, and activists from Bahrain and Ethiopia claim to have been targeted by it.

The spyware can infect PCs and Macs as well as almost every mobile operating system, and break into victims’ email accounts, as well as monitor Skype conversations. In 2012, facing pressure from protest groups, the government moved to block the sale of FinFisher software by virtue of the cryptographic tools it contained, which are also included in the dual-use list.

The updated dual use list also adds new controls on certain chemicals, such as plant pathogens, and limits other telecommunication and internet surveillance equipment besides spyware.