Private Security Companies and Shared Responsibility: The Turn to Multistakeholder Standard-Setting and Monitoring through Self-Regulation-‘Plus’

Abstract

The rapid and increasing outsourcing of security services by states to Private Security Companies (PSCs) in recent years and associated human rights violations have served as one of the catalysts for long overdue regulation of the global PSC industry. As part of an ‘empirical stocktaking’, this article focuses on current multistakeholder self-regulatory developments in relation to PSCs, in particular the International Code of Conduct for Private Security Providers and the PSC1 certification standard, and considers their likely impact on the responsibility of states in this area. What is clear is that the traditional conception of international responsibility is ineffectual when applied to PSCs because of its focus on the ex post facto responsibility of states for internationally wrongful acts. Furthermore, the fact that PSCs operate in high risk and complex environments and the fact that their clients are often non-state actors, means that an alternative prophylactic approach to responsibility for human rights violations by PSCs seems to be necessary. As it stands, however, the ‘self-regulation-plus’ approach adopted is not the definitive solution. While endeavouring to ensure that PSCs respect human rights, this approach may allow states to evade their own obligations to protect human rights.

1 Introduction

The unlawful activities of certain Private Security Companies (PSCs) have been the focus of international scrutiny since the 1990s.¹ More recently, however, the international interventions in Iraq and Afghanistan, in particular, have highlighted the increasing reliance of many states on such companies to provide security and other logistical services to support their military forces, and the corresponding accusations of human rights violations by PSCs. This article examines and assesses the novel international multistakeholder self-regulatory mechanisms that have emerged in response to the harmful human rights outcomes resulting from the conduct of some PSCs and considers their likely impact on the responsibility of states in this area.² It departs substantially in its understanding of shared responsibility as outlined in the conceptual framework of the SHARES project.³ While the SHARES project conceives of shared responsibility as the responsibility for internationally wrongful acts that is shared by multiple actors, in this instance PSCs and a state, this article highlights that developments in this area have taken a different approach. PSCs operate in a complex and multilayered commercial environment and, as will be seen, their activities often involve no direct interactions with states. The emerging regulatory framework seeks to delineate clearly the extent of PSC obligations in relation to human rights and their ultimate responsibility, rather than mere accountability, for breaches of human rights. The Introduction to this symposium recognises that the traditional rules on state responsibility probably cannot be applied to PSCs and acknowledges that ‘strengthening standards and commitments by both non-state actors and states, coupled with supervisory mechanisms’⁴ is a promising alternative.

In the aftermath of the United States (US)-led coalition interventions in both Iraq and Afghanistan, hundreds of new PSCs were set up or their existing activities expanded to take advantage of the emerging and extremely lucrative commercial opportunities in security and reconstruction activities for donor governments.⁵ The mounting reliance on PSCs by states is a direct result of donor state reductions in ‘the size of their armed forces’ to focus on ‘the “core” task of combat fighting’.⁶ In privatising these activities and delegating functions to PSCs, states have ‘deliberately created … an anarchy’, that is, a ‘social arrangement which is not centrally controlled by a government’.⁷ In the current absence of international legal regulation of PSCs there has been a clear move towards using what the United Kingdom (UK) government has termed ‘robust regulation and monitoring’. The so-called ‘Swiss Initiative’, formulated by the Swiss Government and the International Committee of the Red Cross, has offered a starting point for serious international multistakeholder discussions around the role of Private Military and Security Contractors (PMSCs) in armed conflicts and has culminated in the publication of the Montreux Document in 2008.⁸ Stakeholders involved in the drafting of the Montreux Document have continued to meet with the goal of clarifying the obligations and responsibilities of the security companies themselves. This has led to the drafting of the International Code of Conduct for Private Security Providers (ICoC) and the establishment of a multistakeholder oversight body, namely, the International Code of Conduct Association (ICoCA).⁹ While the Montreux Document represents the first intergovernmental statement of existing state legal obligations in relation to PMSCs, the ICoC and ICoCA seek to ensure blanket improvement of PSC industry standards, including respect for and compliance with human rights standards, through the use of a certification or audit process accompanied by institutional oversight and compliance measures.¹⁰

This article has two goals. Firstly, it examines the extent to which these new self-regulatory approaches set out PSC human rights obligations and the ways in which PSCs can be held responsible, if at all, for human rights violations. By focusing on the responsibility of the PSCs themselves, it can be argued that industry self-regulation may allow states potentially to circumvent their responsibility to protect human rights under international law in a very practical way, by shifting responsibility for human rights violations to contractors. Some states, such as the US¹¹ and UK however,¹² take the view that their participation and membership of the ICoC and ICoCA meet their general due diligence obligations under international law to protect human rights, and their particular commitments under the Montreux Document and the Guiding Principles on Business and Human Rights (Guiding Principles),¹³ to ensure that PSCs respect human rights. Given that the scope and extent of state oversight of the ICoC and ICoCA is still unclear and the grievance mechanism is not yet in place, it cannot be determined at present whether participating states are meeting their international obligations. Indeed, it can be argued rather that states are potentially distancing themselves from sharing responsibility with PSCs and may in fact be imposing a higher share of responsibility directly on companies for human rights violations than international law permits. The ‘Protect Respect Remedy’ framework of the Guiding Principles on Business and Human Rights reiterates that the primary obligation to protect human rights rests with states and that business actors have a (non legally binding) obligation to respect human rights, but the way in which the PSC regulatory framework has developed suggests that states are interpreting their responsibility restrictively.¹⁴

Secondly, as part of an empirical stocktaking of developments in this area, this article considers whether ‘self-regulation-plus’, of the type envisaged in the ICoC and the ICoCA, and operationalised in the risk-based approach of industry certification standards such as the PSC1 Management System for Quality of Private Security Company Operations, is likely to be an effective tool for ensuring PSC adherence to international human rights standards and the avoidance of adverse human rights impacts.¹⁵ What is being witnessed in this recent PSC standard-setting and the certification processes advocated by states and the PSC industry is a shift towards norm-internalisation or socialisation of human rights as a means of effecting behavioural change within these companies. Koh describes a culture of human rights ‘norm-internalization’¹⁶ as a process of socialisation whereby one moves from ‘grudgingly accepting a rule one time only to habitually obeying it’ as ‘the rule transforms from being some kind of external sanction to becoming an internal imperative’.¹⁷ This requires what Murphy describes as a move towards ‘human rights preparedness’.¹⁸ She notes that

managing the risk of rights is part of managing risk, so there could be a way in here for human rights. And because human rights reach beyond human rights law, managing the risk of rights stretches beyond legal risk—beyond, that is, claims and litigation concerning human rights violations. Rights as risk encompasses, for instance, the potential for human rights activism to disrupt the interests and overall standing of a government or organisation—a potential that may be entirely detached from legal liability.¹⁹

Thus further questions arise as to whether the risk-based certification model affects the responsibility of states. Is this approach shifting responsibility for human rights violations onto PSCs or is governmental involvement in, and supposed oversight of, this new regulatory regime a sufficient means for states to meet their obligations under international law to protect human rights? What is clear is that there are several weaknesses in the self-regulation-plus approach which must be addressed in order to increase the likelihood of effective and credible regulation of PSC human rights compliance.

In light of their proposed governmental and civil society oversight and monitoring elements, these new PSC regulatory mechanisms are labelled here ‘self-regulation-plus’ to differentiate them from more conventional forms of self-regulation. What has been created through the ICoC is novel in some respects and deserves individual consideration, because rather than neatly falling into one acknowledged category of private ordering, the self-regulation-plus approach cuts across the self-regulation ‘spectrum’.²⁰ It has long been recognised that there are different types of private ordering: two decades ago Ogus talked of a ‘multitude of institutional arrangements’, and noted that they are not all the same in terms of nature, structure and efficacy.²¹ Indeed, they may demonstrate ‘different degrees of legislative constraints, outsider participation in relation to rule formulation or enforcement (or both), and external control and accountability’.²² So while the adherence to the ICoC and membership of the ICoCA are on the face of it voluntary in nature and to that extent are similar to other existing self-regulatory mechanisms, particularly among business and human rights initiatives, their approach also resembles other forms of mixed regulation such as co-regulation because states, civil society actors and private actors (in this case PSCs) are regulating jointly and ‘twinning public and private powers’.²³ This can be seen in the state adoption of the certification standards, highlighted previously, and which challenges the notion that the system is entirely voluntary because PSCs may be contractually bound to comply.²⁴

For states embracing this approach, it could be argued that in doing so they are meeting their due diligence obligations in relation to the activities of PSCs operating extraterritorially. Elements of meta-regulation are also present, notably ‘official validation’ of the system by individual governmental contractual arrangements or approval, and via membership of the ICoCA.²⁵ Thus it seems that the ICoC and ICoCA’s self-regulation-plus has the potential to be a positive and sophisticated example of a ‘hybridized system[s] of both market and social regulation’ which may ‘open up further vistas’²⁶ of ‘collaborative governance’.²⁷

2 Regulation of Private Security Companies

Notwithstanding the increasingly large numbers of active PSCs, the industry has been subject to little significant national or international regulation beyond basic company law requirements of home or host states.²⁸ At the same time, it is evident that PSC business models have become progressively more organised, professional and corporate in nature and structure:

PSCs have grown to such a degree that today they are organized along corporate lines (including boards of directors, share-holdings and corporate structures) their work has a clear contractual aim and obligation to their clients.²⁹

This corporatisation and professionalisation of PSCs can be traced to a desire on the part of the PSC industry to distinguish and distance commercial security activities and logistical support from the direct combat activities of mercenaries.³⁰ The former head of the UN Working Group on the use of mercenaries, Gomez del Prado, points out, however, that the line between PSCs [or Private Military and Security Companies (PMSCs)] and mercenaries is often blurred given that the ‘security industry of private companies moves large quantities of weapons and military equipment’ and ‘[i]t provides services for military operations’, as well as recruiting former military personnel ‘to carry out passive or defensive security’ in a civilian capacity.³¹ Direct participants in hostilities or mercenaries are excluded from the scope of this article, which focuses instead on the regulation of providers of lawful commercial security services.

PSCs, like all other private business actors, fall outside of the reach of international law and they are not bound by international human rights law in particular.³² So while well-known allegations of human rights abuses by the employees of PSCs such as ‘Blackwater’, ‘Titan’ and others in relation to their activities in conflict, post-conflict and fragile regions have proliferated throughout the past decade or so and have attracted much international attention, these abuses have not resulted in legal accountability or responsibility under international law.³³ There are two key reasons for this in international law, a third reason which relates to the nature of PSC clients, and a fourth reason relating to the lack of national legislation.

Firstly, for the purposes of attribution of conduct under international law, PSCs do not meet the strict criteria for attribution for they do not exercise governmental authority, nor does the contractual relationship with governments sufficiently infer that they are acting under the direction and control of a state.³⁴ Secondly, PSCs do not possess the requisite legal personality necessary for the application of international legal responsibility. The prevailing paradigm within which international law operates, has traditionally adhered to a subject-object dichotomy in relation to international legal personality.³⁵ Accordingly, this means that states are subjects of international law because only they, on this analysis, exercise sovereign power and business actors are merely objects of international law for the purposes of applying and enforcing international human rights law.³⁶ Higgins rightly describes this situation as ‘an intellectual prison of our own choosing’ that is then ‘declared … to be an unalterable constraint’, while Pellet criticises the ‘clearly “ideological” reasons’ which are operating to ‘avoid facing the consequences of questioning the monopoly of States over international law’.³⁷ Nonetheless, the effect of this position is that PSCs may not be properly regarded as current subjects of international law and, as such, are not bound by international human rights law.

It is this international legal lacuna that has led to the turn to standard-setting for PSCs as one alternative to the application of state responsibility principles. To that end, the international community is developing and adopting self-regulation-plus in the form of multistakeholder soft law mechanisms which incorporate government, civil society and industry oversight, as well as certification and monitoring processes which are intended to address, among other things, the harmful human rights outcomes of some PSC’s activities.

A third problem is that international human rights law was never intended to apply horizontally. As Shelton remarks, human rights law was ‘designed to restrain abuses by powerful States and State agents, not to regulate the conduct of non-State actors’.³⁸ Thus human rights apply vertically between individuals and states rather than horizontally between affected individuals or groups and PSCs. When considering the question of legal accountability and responsibility in relation to PSCs, it is therefore crucial to note that such companies operate frequently outside conflict zones, albeit in what are often referred to as complex, challenging or high-risk environments, and that they are regularly contracted by non-state clients. So when trying to apply traditional state-oriented principles of international legal responsibility for wrongful acts, depending on the type of client, the rules of attribution may be simply irrelevant if no state actors are involved. The question of whether the home state of the PSC has performed adequate due diligence of course remains, but as will be seen it is not yet clear whether the emerging PSC regulatory regime satisfies its requirements. A significant proportion of PSC contracts relate to the provision of security services for a variety of non-state actors including non-governmental organisations (NGOs) and other commercial entities.³⁹ For example, they may provide mobile security for humanitarian workers in natural disaster zones, transportation for election monitors from intergovernmental organisations in unstable regions, or static guarding of oil and gas facilities for natural resource companies in high risk environments. Due to client sensitivities around this topic, of both commercial and NGO clients, as well as commercial confidentiality issues, it is difficult to ascertain the extent to which non-state actors utilise PSCs.⁴⁰ Determining the extent of their use by the NGO sector is particularly problematic (as for a variety of reasons many NGOs oppose the use of PSCs)⁴¹ but in 2006, Singer noted that:

Industry representatives estimate that approximately 25 % of the ‘high-end’ firms that provide security services, and over 50 % of firms that provide military support or logistics functions, such as military air transport, have worked for humanitarian clients.⁴²

PSC operations in these contexts have tended to attract less global attention than those in places, particularly conflict zones, where states are the predominant, but not the only, clients. More importantly, any human rights violations by PSCs contracted to non-state clients are likely to operate in a legal vacuum unless it can be established that a state has failed to meet the requirements of the general principle of due diligence. So, for example, while the UK government has indicated that it will ‘urge’ non-state clients to ‘commit to contracting only with PSCs that are pursuing certification against recognised standards by accredited certifying bodies’ this undemanding approach may not satisfy the due diligence requirement.⁴³

Fourthly, regulatory developments at the national level are very limited. A recent sample study undertaken by the author makes clear that the majority of states do not have specific regulatory mechanisms addressed to PSCs. Of 78 states examined in the initial study, only a limited number have implemented or drafted legislation, or introduced policy measures directed towards PSCs, and a meagre handful make explicit reference to applicable human rights standards.⁴⁴ A further problem is that existing national regulatory mechanisms focus on state-clients. The French delegation at the second session of the UN inter-governmental working group on PMSCs observed that when enacting domestic legislation in this area it is ‘important’ to include other clients such as ‘international organizations and companies’.⁴⁵

Given the lack of, and limitations in, national and international regulation, several factors have combined to further drive the shift towards norm-setting and compliance initiatives. Recent allegations about the adverse human rights impacts of certain PSC activities have resulted in increasing scrutiny of, for example, ‘G4S’ in South Africa, ‘G4S Australia’ at Manus Island Detention Centre in Papua New Guinea, and ‘Saracen International’ in Somalia.⁴⁶ In addition, the perceived failure of industry-based self-regulatory codes of conduct, as well as national legal systems, to hold PSCs to account for human rights violations, have also served to galvanise the international community into action to address the absence of regulation, responsibility and accountability.⁴⁷ It was in particular the inability of one of the PSC industry’s most prominent trade associations, the International Peace Operators Association (IPOA) (now the International Stability Operations Association) to hold the infamous ‘Blackwater USA’ to account for the massacre in Nisour Square in Iraq, that highlighted the failings of solely industry-based self-regulation. Blackwater was a member of IPOA and voluntarily subject to that organisation’s internal code of conduct. On being informed of an IPOA investigation into events at Nisour Square, Blackwater left the organisation, changed its name to ‘Xe Services’ and today continues to win US government contracts to operate in Iraq as ‘Academi’.⁴⁸ Such deficiencies in voluntary self-regulation intensified pressure from civil society, and in an increasingly competitive market place has led to many in the PSC industry becoming increasingly sensitive to reputational damage, while states which are home to significant numbers of PSCs (such as the UK and US) have realised that regulatory inaction was no longer an option.

Consequently, two different but interlinked, multistakeholder projects emerged to address the regulatory gaps and to create standards and implement monitoring and compliance procedures for PSCs, namely the Montreux Document and the ICoC together with the Articles of Association of the newly constituted ICoCA.⁴⁹

3 Emerging Standards: The Montreux Document, ICoC and the PSC1 Quality Management Standard

While the Montreux Document itself does not fall within the category of self-regulation-plus mechanisms, it is an important starting point for understanding the development of both the ICoC and ICoCA. The Montreux Document is essentially a non-binding restatement of the existing international legal obligations of states which are home to, host to, or contract with PMSCs. It seeks to ‘promote compliance’ with international humanitarian law and international human rights law during armed conflict only.⁵⁰ No new international obligations are created for states.⁵¹ It also sets out ‘good practices’ which may be ‘instructive’ for PMSCs but does not create legal obligations for them.⁵² In contrast, the ICoC is addressed directly to PSCs, and signatory companies undertake to ‘commit to the responsible provision of Security Services so as to support the rule of law, respect the human rights of all persons, and protect the interests of their clients’.⁵³

Proponents of these initiatives highlight their multistakeholder approach and attempts to ensure oversight and monitoring and argue that this renders these initiatives a more ‘robust’ form of self-regulation, in other words an approach which attempts to be more effective in ensuring accountability than traditional forms of self-regulation, i.e. it is self-regulation-plus.⁵⁴ Most notably this is to be achieved through the use of certification procedures or auditing and this is examined in more detail below.

Both the Montreux Document and the ICoC are products of so-called multistakeholder processes which involve the participation of states, the PSC industry, as well as civil society actors, and which demonstrate an emerging shift from traditional forms of international law-making towards something akin to ‘top-down-bottom-up’ regulation. So rather than international law always being imposed on non-state actors by states from above, top-down–bottom-up approaches are hybrid in nature and combine legislative ‘top-down’ approaches with softer ‘bottom-up’ non-legislative mechanisms. Such an analysis links clearly with Slaughter’s ‘liberal theory’ of international law, where she describes these types of regulatory developments as ‘multiple bodies of rules, norms and processes that contribute to international order’ which encompass everything from ‘voluntary codes of conduct adopted by individual and corporate actors operating in transnational society’ to ‘transnational and transgovernmental law’ and ‘traditional public international law’.⁵⁵ In the case of the ICoC and ICoCA the process involves different stakeholders, in this case governments, civil society and industry, working together to create a mutually agreed regulatory standard but without the legislative element. What remains unclear, however, is the extent to which states are fulfilling their international human rights obligations by choosing the softer option of self-regulation-plus and omitting legislative options.

Certainly the government and industry drafters of the ICoC want it to be regarded as an example of best practice in the business and human rights sphere. This can only be achieved if the weaknesses identified above and below can be addressed. Such soft law approaches to the regulation of PSCs are not universally welcomed and it is worth noting that two separate UN working groups, on mercenaries and PMSCs, have explored or are exploring the possibilities for creating binding regulation for the industry through international conventions.⁵⁶ At the second session of the inter-governmental working group on PMSCs in July 2014, some states and civil society actors expressed concern about the limitations of an audit-based self-regulation scheme, despite the element of oversight incorporated into the ICoCA in paragraph 12.1 of its Articles of Association.⁵⁷ Furthermore, at the 2014 Human Rights Council, states voted in favour of elaborating a multilateral convention to ensure direct legal responsibility of all business actors for human rights abuses, not just the PSC sector.⁵⁸

Nevertheless, in the context of PSC-specific regulatory approaches, the relationship with international law and in particular the responsibility of the state for extraterritorial activities of its corporate nationals remains explicitly traditional, at least in terms of the principles articulated. As highlighted above, the Montreux Document is declaratory in nature and aims to ‘recall certain existing international legal obligations of States regarding private military and security contractors’.⁵⁹ It applies only to the activities of PMSCs in situations of armed conflict but it is addressed specifically to states. Furthermore, it notes throughout that the existing obligations of states under international law remain unaffected. Paragraph 1 of part A of the Montreux Document is unequivocal and provides that: ‘Contracting States retain their obligations under international law, even if they contract PMSCs to perform certain activities’. A distinction is made between contracting states (clients),⁶⁰ territorial states (the place of the PSC operation or project)⁶¹ and home states (the state of incorporation of the PSC).⁶² While it is unclear how the responsibilities of these different states transect, nevertheless the Montreux Document is focused on state responsibility rather than that of PSCs.

In contrast to the Montreux Document, the ICoC and ICoCA address PSCs directly and attempt in general terms to set out the extent of their human rights obligations. Notwithstanding this focus, paragraph 2 of the ICoC Preamble records that ‘well-established rules of international law apply to States in their relationships with private security providers’ which would include states retaining the responsibility to protect human rights. The state’s international legal obligations do not transfer to PSCs through the contractual relationship. Moreover, paragraph 14 provides that the ICoC does not limit or alter the applicable international law, nor does it establish any legal obligations or liabilities for PSCs. Companies are, however, required to affirm their responsibility to respect human rights and to establish fair and accessible grievance procedures that offer effective remedies for human rights violations. One of the key strengths of the ICoC is that by focusing on the obligations of the PSCs as opposed to states, there is the potential for human rights norm-internalisation, as will be demonstrated in the following section.

The ICoCA was launched in September 2013 and its key function is to set out the basic requirements for certification of PSCs⁶³ and to monitor and assess PSC compliance with the ICoC.⁶⁴ Traditionally, effective self-regulation depends upon the degree of ‘external control and supervision’ exercised by government.⁶⁵ Thus the issue of governmental ‘oversight’ and its definition becomes of crucial importance in this instance, as can be seen below.

As of August 2014, there are 708 signatory companies to the ICoC from 70 countries.⁶⁶ Presently there are 135 PSC members of ICoCA, 13 civil society organisations (CSOs) and 6 states.⁶⁷ Each of these three ‘pillars’ is now represented within the ICoCA, which is tasked with ensuring compliance with the ICoC.⁶⁸ Article 11.1 of the ICoCA Articles of Association provides that:

The Association shall be responsible for certifying under the Code that a company’s systems and policies meet the Code’s principles and the standards derived from the Code and that a company is undergoing monitoring, auditing, and verification, including in the field.⁶⁹

No specific certification standard is specified in the Articles of Association and the ICoCA ‘shall define the certification requirements’ on the basis of ‘national or international standards and processes’ which comply with the International Code of Conduct.⁷⁰ Allied to company certification is internal and external oversight as well as a mechanism for addressing Code violations:

The Association shall be responsible for exercising oversight of Member companies’ performance under the Code, including through external monitoring, reporting and a process to address alleged violations of the code.⁷¹

At present it is unclear what form the oversight, monitoring, reporting and grievance arrangements will take, but the ICoCA Articles of Association make clear that it is the organisation that will exercise oversight not the member states. This again raises the question of whether states will be able to claim to be fully meeting their international legal obligations through this mechanism. Their active and dynamic participation will be essential, otherwise states will be vulnerable to claims that they have failed to meet their obligations in relation to their responsibility to protect human rights. Work is ongoing to determine the nature and substance of these processes, so it is too soon to draw any conclusions about the effectiveness of the ICoCA, but its multistakeholder three-pillar approach has much to commend it. The credibility of the ICoCA will depend greatly on the robustness of the Board of Directors. It will also depend on the merits of the mechanism chosen to deal with alleged violations of the ICoC and how the Board tackles individual cases. In particular, the Board is obliged to ensure that ‘effective remedies’ are provided by certified PSCs, but how this is to be achieved remains to be seen. At the July 2014 meeting of the UN inter-governmental working group on PMSCs many states voiced concern about the effectiveness of the ICoC approach and ICoCA oversight, but it is simply too early to draw conclusions about their efficacy at this stage.

4 Towards Norm Internalisation?

So what do these developments mean for state responsibility for human rights violations in the PSC context? Steven Ratner argued in 2001 that there has been an ‘erosion of the domain reservé’ which presents ‘a challenge to the traditional prerogative of States to regulate companies within their jurisdiction’.⁷² Ratner claimed that ‘[t]he question is not whether non-State actors have rights and duties but what those rights and duties are’.⁷³ At that time he concluded that states remained ambivalent about ‘accepting corporate duties’ especially in relation to human rights duties.⁷⁴ Nevertheless, he took the view that such ‘duties of a company’ were ‘a direct function of its capacity to harm human dignity’.⁷⁵ He noted that

Proposing international norms of corporate responsibility for violations of human dignity continues the trajectory that the law has taken, but it also represents new challenges for the enterprise. It challenges the state’s exclusive prerogative (what some might call sovereignty) to regulate business enterprises by making them a subject of international scrutiny; it makes them entities that have their own duties to respect human rights.⁷⁶

Given the way in which the self-regulation-plus regime has developed in relation to PSCs, it is difficult to see how the state’s prerogative to regulate business actors is being challenged. Furthermore, the regulatory mechanisms are clear that state obligations and responsibility remain unaffected. It is possible, however, that the way in which the third party audit and certification process operates could, through the push towards internalisation of human rights norms in particular, result in a situation where more responsibility is being placed on PSCs for human rights violations and states are, if not quite shedding elements of responsibility, at least distancing themselves from sharing responsibility. This is related directly to the construction of the regulatory arrangements.

The PSC regulatory regime developed is complex and involves many different layers of actors beyond states, civil society and industry. PSCs will be required to demonstrate to auditors that they are complying with the human rights set out in the ICoC, that they are conducting Human Rights Risk Assessments and Analysis, and that they have instituted third party grievance mechanisms. States are removed from the various processes. As highlighted above, the ICoCA retains responsibility for oversight, monitoring and remedies, but at the level below, national accreditation bodies are required to certify certification bodies which in turn carry out the audits of PSCs. It is this complexity which could lead to states not meeting their international legal responsibilities. In this system, participant states must provide effective oversight of the ICoC itself, as well as their own national accreditation and certification bodies, because a failure to do so will result in this fragile regulatory house of cards falling apart. It is not enough that states become members of the ICoCA, as the success and credibility of the regulatory regime is dependent upon states upholding consistently the effectiveness of the international and national elements of the certification process. It is only by doing this that states can truly claim to be meeting their international human rights obligations. To acquire an understanding of the extent to which states may be distancing themselves from their responsibility to protect human rights, it is necessary to examine the mechanisms established. So what does the certification process look like and how should it work?

4.1 PSC1 and the Shift towards Norm Internalisation

As outlined previously, the ICoC sets out a requirement for signatory companies to undertake certification or an audit to measure the extent of its compliance with the Code.⁷⁷ To that end, the American National Standards Institute (ANSI) and ASIS International developed a quality management system standard that includes specific requirements for audited PSCs to demonstrate that they have considered human rights risks and adverse human rights impacts as part of their management system, as well as providing remedy mechanisms for third parties affected by harmful outcomes of PSC activities.⁷⁸ PSC1, as it is known, has been endorsed and adopted by the UK government as the ‘applicable standard for UK-based PSCs working in complex environments on land overseas’, and since May 2012 all contracts undertaken by the US Department of Defence require conformity to the standard.⁷⁹ The PSC1 standard has been piloted in the UK.⁸⁰ It also forms the basis of a proposed international standard at the International Organization for Standardization (ISO).⁸¹

PSC1 is a Quality Management System (QMS) developed with the aim of improving standards across the PSC industry and human rights standards in particular.⁸² Emphasis is therefore placed on ensuring high standards of management throughout the organisation of the company. A company’s conformance with the PSC1 standard will generally be measured, but not always, by independent third party Certification Bodies or auditors during a two-stage audit which takes place at both the PSC’s headquarters (stage 1) and on-site (stage 2). The company pays for the audit. A PSC1 audit is not specifically focused on human rights, its remit is much broader, but human rights language runs throughout the entire standard and the improved protection of human rights was very much a driving force behind the creation of the standard. In addition to the ICoC, it is clear that PSC1 draws heavily upon the Protect, Respect, Remedy approach of the UN Guiding Principles on Business and Human Rights, especially in relation to its due diligence and grievance procedure requirements.⁸³

In particular, PSCs are required to demonstrate that they have taken into account any potential adverse human rights impacts on external stakeholders. It is therefore necessary for a PSC to identify any external stakeholders likely to be affected by its activities, e.g. local communities. Moreover, while PSC1 does not specifically require that PSCs undertake a Human Rights Risk and Impact Analysis (HRRIA), it is clear that some form of human rights risk assessment is expected. The informative Commentary annexed to PSC1 does make a specific reference to HRRIAs but the standard itself does not use that language. This is something which companies have identified as confusing, and consequently they are unclear about their specific obligations in regard to HRRIAs.

PSC1 also includes an upstream and downstream due diligence requirement so that companies must carry out due diligence in relation to both their clients and their contractors and supply chains. This approach is in line with the UN Guiding Principles on Business and Human Rights. It seems likely that due diligence in relation to contractors and the supply chain will be easier to undertake than in relation to clients. There appears to be some reluctance on the part of PSCs to demand human rights due diligence of their clients, probably as a result of a highly competitive market. It is perceived by some PSCs that this could exclude them from certain contracts, but of course if the clients are educated and aware of their ‘baseline’ responsibility to respect human rights, then in theory this should become less problematic particularly as the Guiding Principles undergo wider dissemination and implementation.

PSC1 also requires conforming companies to have in place incident monitoring and reporting mechanisms. In addition, there must be accessible grievance and whistle-blower policies, and procedures which must be communicated to both internal and external stakeholders. Where a complaint is made, the PSC must document the corrective actions taken and any ‘compensation and redress given to the affected parties’.⁸⁴ Ongoing monitoring and continual improvement of the company’s procedures and processes is a crucial aspect of the PSC1 standard.

4.2 UK PSC1 Pilot Scheme

A pilot scheme commenced in August 2013 in the UK to ‘road-test’ PSC1 as part of the UK government’s self-described commitment to industry self-regulation. The UK has been actively involved in the drafting of the ICoC and development of the ICoCA and its participation follows many years of regulatory inaction in this area.⁸⁵ In doing so, the UK government considers itself to be meeting its obligations to ensure human rights protection through its support for ‘robust regulation’.⁸⁶ Specifically, it regards its adoption of the PSC1 certification standard⁸⁷ with eventual ICoCA oversight as helping the UK to fulfil its ‘commitments’ under the UN Guiding Principles on Business and Human Rights as set out in the UK National Action Plan.⁸⁸ The pilot scheme was supported and closely followed by the UK Foreign and Commonwealth Office. In addition, the UK Accreditation Service, which was to certify approved Certification Bodies to carry out PSC1 audits, was actively involved in monitoring the auditing process both in the UK and at audited project sites.

The scope of PSC1 is broad and applies to PSCs offering services and operating in complex environments. It therefore extends beyond conflict zones. As mentioned previously, there is no specific guidance on how a PSC should consider and address ‘adverse human rights impacts’ within its operations, e.g. through the use of HRRIAs. Nevertheless, there appears to be no hierarchy of risks and it seems to be the case that human rights risks are to be regarded as a risk in the same way as health and safety or environmental risks. The question is, to what extent will defining human rights as a risk and assessing potential adverse human rights impacts be an effective way to ensure compliance with human rights standards, and ultimately prevent the occurrence of human rights violations? Murphy notes that the move towards a risk-based approach is becoming increasingly common in a variety of spheres:

Rights as risk—emphasises a now dominant feature of governance: namely, the assessment and management of risk. Today, governments and organisations alike are expected to identify and handle the risks (financial, legal, political, reputational and so on) to which they are exposed.⁸⁹

By requiring PSCs seeking certification to assess human rights as a potential risk and to implement an HRIA, PSC1 has the capacity to help ‘internalise’ human rights norms within a company’s culture and to raise awareness of human rights impacts.

Reputational damage is of particular concern to those in the PSC sector. They have become susceptible to ‘brand tarnishing’ and ‘reputational disaster’ in the same way that the natural resource sector did in the 1990s.⁹⁰ The market for security services is extremely competitive and the highly publicised actions of a few companies in recent years have rendered the industry very sensitive to reputational risk and the potential impact that allegations of human rights abuses might have on their ability to win future contracts. This of course does not apply to rogue PSCs which choose to remain outside regulatory frameworks and which will continue to violate international human rights standards regardless.

5 Conclusion

It is clear that the traditional conception of international responsibility is ineffectual when applied to PSCs because of its focus on the ex post facto responsibility of states for internationally wrongful acts. No state has been found responsible in international law for the unlawful activities of its PSC contractors. In light of this, and the fact that PSCs operate in high risk and complex environments and that their clients are often non-state actors, an alternative prophylactic approach to responsibility for human rights violations seems to be necessary. The emerging multilayered regulatory framework in the form of the Montreux Document, the ICoC, the ICoCA, PSC1 and the draft ISO standard represents current progress. As it stands, however, this self-regulation-plus approach is not the definitive solution. It lets states off the hook in terms of ensuring that PSCs abide by their obligations, but in doing so this allows states to evade their own obligations to protect human rights.

What is clear is that the extent to which self-regulation-plus reflects any shared responsibility between states and PSCs, and the likely effectiveness of the ICoC and ICoCA human rights risk model as applied though a standard such as PSC1, depend on a variety of factors:

• 1. State involvement and support.

• 2. Ability to deal with non-certified and rogue PSCs.

• 3. Scope of the certification.

• 4. Auditor competence.

• 5. Human Rights Impact Assessments.

• 6. Client awareness, education and training.

First, in terms of state responsibility, civil society organisations and some states continue to express some general concerns that the adoption of any human rights risk certification scheme will result in states not complying with their international obligations.⁹¹ Despite the fact that the Montreux Document and the ICoC make clear that states cannot transfer their international legal obligations to PSCs through the contractual relationship, nevertheless, the distance created by the very nature of the QMS process (state—accreditation body—certification body—PSC) lends credence to the concern. The PSC could be kept very much at arm’s length from state oversight both at the international and national level. What is clear is that if the ICoCA oversight mechanism and other elements are perceived as weak and lacking in credibility, states will be unable to rely on these mechanisms as evidence that international human rights obligations are being met. Therefore, in addition to general oversight of the operation of the ICoCA, development of a consistent and robust oversight culture by the participant states of their accreditation bodies and certification bodies, as well as the PSCs themselves, is crucial to the credibility and effectiveness of the certification scheme, and of course to ensure that states meet their own international obligations. Active state involvement and support for the ICoC and any certification process undertaken by PSCs is crucial. For example, there are reports of certain non-ICoCA host state authorities refusing auditors on-site access to monitor PSC conformance with PSC1.⁹² The reasons for such refusals are unclear but it may be for security reasons, or more likely it may be due to a simple lack of knowledge on the part of the host state about the, as yet, immature PSC1 process. Such behaviour undermines the whole process so it is essential that ICoCA member-states in particular disseminate information, both at home and in host states, throughout government agencies about the certification process, especially to those likely to encounter auditors in order to encourage support for, and the embedding of, the new standards. By ensuring robust oversight at all stages ICoCA member states will help to reinforce the credibility of the system and perhaps reassure some of the more skeptical states and members of civil society about its effectiveness.

Second, are the ICoC mechanisms capable of dealing with rogue PSCs, which after all are the reason for the implementation of the standards in the first place? What about non-certified companies? What happens if there is non-conformance with the certified standard? The emphasis of this emerging regulatory regime is clearly focused on the responsibility of PSCs themselves as opposed to state clients. It seems that states are determined to keep their responsibility at arm’s length which may well be a function of the different clients that contract with PSCs. The continued existence of non-certified rogue PSCs which do not engage with the ICoCA processes present perhaps the greatest challenge for states and for state responsibility. It is, therefore, in the interest of home states to ensure that all PSCs engage with the ICoCA. The US and the UK have gone some way to encouraging this by adopting the PSC1 standard but other states are waiting for the ISO standard to be finalised. States should also be encouraging, if not requiring outright, other PSC clients in the commercial and NGO sectors to contract only with ICoC compliant PSCs.

Third, there are some concerns about the potentially limited scope of the PSC1 standard. It should be noted that the decision to apply for PSC1 certification is voluntary, as is adherence to the ICoC Code of Conduct. Indeed a PSC may self-certify that its operations are in conformance with PSC1. Furthermore, the PSC itself chooses the geographical scope of the certification. Thus a PSC may have operations in several different countries, but the certification might only apply to one project in one country. So, for example, a PSC may be contracted to operate in a conflict zone such as Afghanistan or Iraq, but it chooses to apply for PSC1 certification for a security operation in a non-conflict (but potentially high risk) country. It is therefore extremely important that the clients of PSCs (states, other companies and NGOs) are made aware of the possible limitations of the certification and are educated on how to determine the extent of the advertised PSC1 certification.

Fourth, it is essential that the third party auditors used to certify PSCs are competent in human rights. In the UK Pilot Scheme, the certification bodies adopted different approaches. It was envisaged by some that the ‘[c]ertification teams will include significant human rights expertise—though paid for by the PMSC being certified’, but this was certainly not the case for all of the pilot certifications undertaken.⁹³ Some certification bodies have adopted this approach and have appointed Human Rights Subject Matter Experts (SMEs) to assess the human rights elements of the PSC1 standard. Others have bought in training for their auditors. There must be discussion about the merits of the different approaches as there is some concern that the certification bodies utilising SMEs are holding PSCs to a higher human rights standards than others. It is anticipated that the UK Accreditation Service will be issuing draft guidance on the matter for consultation but there must be a wider debate on this issue. Failing that, the lack of consistency will potentially impact on the credibility of the PSC1 certification process.

Fifth, credible strategic and operational HRRIAs must be defined in the standards and undertaken by PSCs. At present it is unclear how a PSC should assess human rights risk and impacts and which tools it should use. The extent to which there is engagement with human rights expertise by the industry is also unclear. It is important that human rights risks and adverse impacts are being identified and assessed at both the management and operational levels and that companies are not engaging in a mere tick-box exercise.

Finally, the effectiveness of the PSC1 certification standard will be dependent upon the extent to which all clients, governmental, commercial and civil society, understand the certification process. In particular, it is important that they understand the potentially limited scope of certification and the importance of auditor human rights competence.

Given these significant concerns it is crucial that states actively support the development of the emerging certification process to ensure that the system matures effectively and becomes more widely recognised and adopted. Ultimately it is in the interest of states to do so if they expect the international community to accept that their due diligence obligations under international law to protect human rights are being met. Anything else will be perceived as unsatisfactorily shifting all responsibility for human rights violations onto PSCs.