Security is generally considered a core public good provided by the state. This is central to Weberian notions of the state as maintaining a monopoly over the legitimate use of force, which ‘creates the bedrock condition for a stable domestic political order’ (Art Reference Art1996; Singer Reference Singer2003: 170; Avant Reference Avant2005: 1–3). Outsourcing military and security tasks erodes this monopoly. If governments perceive control over the use of force as one of the core prerogatives of the state, then we would expect regulation in this area to be stronger than regulation of activities that do not have potentially lethal consequences. Governments would be likely either to show caution in assessing which elements of force they are willing to cede to the private sector, or to regulate the activities of private actors undertaking these formerly ‘state’ functions. Self-regulation, in which private actors ‘design and enforce the rules’ governing their business practices, would seem inadequate to ensure appropriate control over the use of force (Haufler Reference Haufler2001: 8; Schreier and Caparini Reference Schreier and Caparini2005; Spear Reference Spear2006). Private military and security companies (PMSCs) in war zones have recently undertaken multiple tasks around the globe. Anxiety about company employees' conduct has raised concern about whether PMSCs are subject to sufficient controls, and raised interest in the rules governing their activities. Neither caution nor careful regulation is evident in state responses to the emergence of PMSCs, however; instead, the industry's rapid growth has outpaced government efforts to control their activities.Footnote 1
Private security companies have been defined as ‘private companies that sell military services’ (Kinsey Reference Kinsey2005: 270). Current conceptions of the industry include companies that provide services long associated with the military – short, in general, of offensive military services – and those offering security, guarding, and intelligence services. Many terms have been used to describe companies offering military and security services internationally, including ‘the private security industry,’ and ‘the global security industry.’ ‘Private military and security companies’ has become the accepted shorthand by those seeking to develop international standards for companies in this realm (ICRC 2006, Cockayne et al. Reference Cockayne, Speers, Cherneva, Gurin, Oviedo and Yaeger2009), and I use it and ‘private security industry’ here.
There is little certainty about the industry's size, but it is growing globally. The majority of PMSCs working internationally are based in either the US or the UK (Cockayne Reference Cockayne, Speers, Cherneva, Gurin, Oviedo and Yaeger2009). The well-established companies claim a world-wide clientele for services ranging from protection to risk management, maintain offices around the globe, and have worked in both Afghanistan and Iraq. Ninety companies were estimated to be working in Afghanistan in 2007 (Rimli and Schmeidl Reference Rimli and Schmeidl2007), and at least 310 PSCs based in a range of countries had contracted or subcontracted with the US government to provide services in Iraq between 2003 and late 2008 (SIGIR 2008). States have been slow to regulate private security activities.Footnote 2 Indeed, the industry's claims that it can self-regulate have dampened efforts in some states to establish effective regulations, and few international regulations specifically govern the activities of PMSCs.
Self-regulation is one form of sectoral governance, in which private actors design industry guidelines outside the governmental decision-making arena. Its key features are its voluntary nature, and its reliance on constraints that go beyond existing regulation (Ward Reference Ward2003: 1; Prakash Reference Prakash2000). It can take many forms with varying degrees of private autonomy (Baggott Reference Baggott1989: 437–38). There is general agreement that the threat of state intervention, or ‘the shadow of hierarchy’ is an important influence on the willingness of private groups to develop effective self-regulatory mechanisms (Héritier and Lehmkuhl Reference Héritier and Lehmkuhl2008). An alternative hypothesis is that companies or industries adopt self-regulation for reputational reasons. Whether reputational concerns will result in effective self-regulation or merely in aspirational statements is subject to debate, however (Cashore, Auld, and Newsom Reference Cashore, Auld and Newsom2004; Pearson and Seyfang Reference Pearson and Seyfang2001). Effectiveness can be evaluated with regard to the process by which companies do business – are they changing their work habits and procedures? – or with regard to the outcome – is the end result ‘better’ for those affected by their services? – or both. My concern here is with the frameworks of self-regulation, rather than with measuring effectiveness per se.
The failure to develop state-level regulations for the industry by those governments most reliant on private military and security companies makes it especially important to understand the effectiveness of PMSC self-regulation. In particular, what can this case tell us about the importance of the shadow of the regulator in the development of effective self-regulation? This paper addresses two questions. First, have the private security trade associations seeking to self-regulate incorporated the mechanisms necessary to make self-regulation effective? How self-regulatory mechanisms determine compliance and utilize rewards and punishments can dramatically affect the success of self-regulation. To date, PMSC self-regulation has relied primarily on codes of conduct established by industry trade associations.
Second, scholars of private regulation suggest that domestic context and national-level institutions can influence efforts to establish standards (Prakash Reference Prakash1999; Mattli and Buthe Reference Mattli and Buthe2003). How have different national approaches to self-regulation influenced the efforts of those trade associations currently advocating private security self-regulation? Two of the best known trade associations affiliated with the private security industry are the US-based International Peace Operations Association (IPOA) and the British Association of Private Security Companies (BAPSC). I evaluate whether their development of self-regulatory mechanisms reflects different national approaches toward regulation and self-regulation, and the implications for effectiveness and international regulation.Footnote 3
Although the IPOA and the BAPSC advocate self-regulation to fill the regulatory gap regarding PMSCs working internationally, neither has established self-regulatory mechanisms that would enable the associations or outsiders to evaluate member companies' compliance with the standards they set. Neither is thus likely to assuage concerns about the paucity of state regulation governing private military and security companies in the short run. Nonetheless, the states in which these efforts have been undertaken have done little to enhance formal PMSC regulation. This reinforces a central dilemma regarding the self-regulation: companies are unlikely to act without the threat of state intervention, as the shadow of hierarchy literature suggests, but even weak self-regulatory efforts may reduce state efforts to establish regulations. This is particularly true in the absence of public pressure for greater controls, which might generate either reputational incentives to self-regulate, or greater government pressure on industry.
The IPOA's efforts to self-regulate, and its interactions with the US government, fit the general American pattern of self-regulation, which tends to be independent of government involvement. The threat of increased state regulation of PMSCs is low, though this may be changing, and there is greater resort in the US context to legal mechanisms to address PMSC oversight and accountability. PMSC self-regulation in the United Kingdom fits less closely with the dominant British self-regulatory model of government-industry cooperation, and private implementation of standards. The BAPSC's self-regulatory efforts have been slow and uncertain, and the British government, having delayed action on PMSC regulation for several years, now appears to envision weaker linkages between the industry and the state than seen in many self-regulatory mechanisms in the United Kingdom. This may be explained by cost factors, or minimal public attention to the industry.
Given the industry's dominance by American and British firms, the IPOA and the BAPSC are well-positioned to influence emerging efforts to develop international standards to govern private military and security company activities globally. However, neither appears likely to lead international regulatory efforts because in each case stakeholders in the home state have not agreed on a common approach that might give them greater leverage in international negotiations.
I. What Makes Industry Self-regulation Work?
Industry self-regulation has been defined as ‘a regulatory process whereby an industry-level (as opposed to government or firm-level) organization sets rules and standards (codes of practice) relating to the conduct of firms in the industry’ (Gunningham and Rees Reference Gunningham and Rees1997: 364–365). Industries self-regulate for both defensive and reputational reasons (Haufler Reference Haufler2001: 27–28). Defensively, industries seek to preempt further government regulation – the ‘shadow of hierarchy’ argument – or to gain ‘first mover’ advantage by shaping and possibly minimizing new regulations (Héritier and Eckert Reference Héritier and Eckert2008; Mattli and Buthe Reference Mattli and Buthe2003; Prakash Reference Prakash1999). Reputationally, they seek to preserve a positive image, or to restore public trust (Mattli and Buthe Reference Mattli and Buthe2003). Industry self-regulation also can be intended to counter regulatory pressures from ‘multi-stakeholder’ rule-making processes at both the national and international level (Cashore, Auld, and Newsom Reference Cashore, Auld and Newsom2004: 95–101; OECD 2001).
The success of self-regulatory frameworks in changing corporate behavior and assuaging public concerns is determined by the ways these frameworks utilize five elements: standards, reporting, monitoring, sanctions, and rewards.
First, once it has determined ‘beyond compliance’ standards, the industry group must inform the public and the government that it has established standards to address concerns that would otherwise require government regulation to ameliorate. This matters because a core goal of self-regulation is to quell pressure for more formal regulation. Public communication of industry standards also assists independent efforts to evaluate industry performance.
Second, standards require some means to determine that industry members respect them. This is central to claims that self-regulation obviates the need for increased government regulation (Prakash Reference Prakash1999: 323; Cashore Auld and Newsom Reference Cashore, Auld and Newsom2004: 27). Associations may ensure compliance by requiring that members meet reporting requirements detailing their compliance with industry standards. Alternately, they may require monitoring via inspection or audits. Who to entrust with such verification functions is a critical, and often contentious, issue. These functions sometimes remain internal to the industry; in other cases, monitoring is carried out by government agencies or by independent monitoring organizations. This depends on the degree of government oversight, but it can also reflect industry concerns about competition and secrecy, or participation by other stakeholders unwilling to accept industry claims without external verification. Many industry associations are quite opaque, and share compliance records only with their own monitoring bodies. But the existence of monitoring that could be used for internal or external shaming or sanction strengthens the effectiveness of trade association standards. Nonetheless, the absence of third-party reporting may fuel the conviction that self-regulation is merely window-dressing (Prakash Reference Prakash1999: 329 n. 10).
Both carrots and sticks are also critical to self-regulation. Sanctions for non-compliance with industry norms and standards, the fourth element noted earlier, are essential. Formal and informal sanctions can each play a role, but the problem of adverse selection makes formal sanctions critical (Lenox and Nash Reference Lenox and Nash2003). Absent explicit sanctions for noncompliance, companies whose performance does not meet an industry's standards may join the association to improve their reputation without modifying their behavior. This makes it harder to distinguish companies performing well from those performing badly. Sanctions can range from fines, to mandatory monitoring paid for by the sanctioned company, to expulsion from the self-regulatory association.
Informal sanctions also matter. Peer pressure and shaming can often push companies to adhere to normative standards, particularly when combined with the threat of formal regulation (Prakash Reference Prakash2000: 331). The US Institute of Nuclear Power Operators (INPO), a private organization that sets and monitors nuclear industry safety standards, not only ranks member firms on their performance, but it can threaten to share information regarding serious safety problems with the Nuclear Regulatory Commission, the government's nuclear regulatory body (Rees Reference Rees1994, King and Lenox Reference King and Lenox2000). INPO members attest to the effect of informal sanctions, which have been called ‘management by embarrassment;’ they stress that, particularly among competitive CEOs, ‘none of us want to be viewed as a poor performer among our peers’ (Quoted in Rees Reference Rees1994:104–105).
Fifth, industry associations seek to shape rewards to prevent free riding. They try to provide ‘club’ benefits to companies participating in self-regulation, and to make the benefits excludable, so that only participating companies complying with standards can gain the carrots to be had. (King and Lenox Reference King and Lenox2000: 700; Prakash Reference Prakash2000; Ogus Reference Ogus1995). Moreover, the benefits must outweigh the costs of implementing new policies.Footnote 4
Notably, adhering to standards can be costly, and monitoring costs associated with self-regulation are generally covered by industry members. Companies are only likely to pay these costs if there is significant market payoff. Indeed, market incentives sometimes matter more than regulatory threats (Héritier and Eckert Reference Héritier and Eckert2008). Particularly in very competitive industries, companies want the benefit of being perceived by customers as responsible. But if consumer interest is low, then certification may not provide sufficient reputational benefits. It is no accident, therefore, that many self-regulatory mechanisms focus on ‘social’ issues that attract consumer interest – and potential consumer boycotts or protests – such as environmental impact, worker rights, and human rights (Gunningham and Rees Reference Gunningham and Rees1997: 364).
II. The National Context
The nature of private military and security companies and their activities complicates regulation because it requires formulating rules that apply outside companies' home states. Many private standards with international reach originated in standards developed at the state level, so understanding the emergence of state-level mechanisms is important.
Self-regulation has developed differently in the United States and Europe, and these differences reflect different capacities to punish or reward industry behavior (Newman and Bach Reference Newman and Bach2004). In the US system, self-regulation has largely been defensive, induced by government threats of greater regulation or litigation. In Europe, self-regulation has tended to develop through partnerships between corporations and public sector regulators, in a ‘co-ordinated self-regulation’ model that relies on rewards rather than punishment (Newman and Bach Reference Newman and Bach2004: 288).
The US public sector can more easily sanction companies than it can offer ‘carrots’ for cooperative industry behavior. This is due to its divided governance system, both federally and between the federal and state levels. The history of corporate development has limited cooperation between government and industry, because efforts to constrain monopolies engendered an adversarial business-government relationship. The US regulatory system can credibly threaten regulation and legal sanctions; this has stimulated a form of ‘legalistic self-regulation’ (Newman and Bach Reference Newman and Bach2004: 288). Indeed, many recent discussions of PMSC regulation in the United States stress the potential contribution of contract law (Dickinson Reference Dickinson2006). US anti-trust legislation inhibits private efforts to punish poor performance through formal sanctions, however, and leaves trade associations leery of implementing sanctions other than expulsion for fear of lawsuits (King and Lenox Reference King and Lenox2000; Lenox and Nash Reference Lenox and Nash2003; Prakash Reference Prakash1999: 330).
Self-regulation has a long history in the United Kingdom, and like the European Union, it has often relied on carrots rather than sticks. Although the political economy literature on ‘varieties of capitalism’ finds market similarities between the United States and Britain, which contrast with the ‘co-ordinated’ market economic model associated with continental Europe, in self-regulation and standards development, the United Kingdom aligns more with other European countries than with the United States (Thelen Reference Thelen, Katznelson and Milner2002: 383; Prakash Reference Prakash1999: 330–331; Mattli and Buthe Reference Mattli and Buthe2003: 27).
During much of the twentieth century, Britain had what has been termed a ‘club government,’ in which government and private sector elites established and oversaw regulations cooperatively (Levi-Faur and Gilad Reference Levi-Faur and Gilad2004: 107). British institutions, including self-regulation, reflect Victorian-era policies, when rules and standards were set by regulators and the regulated working together, and were overseen by private organizations or quasi-government agencies (Levi-Faur and Gilad Reference Levi-Faur and Gilad2004).
The British regulatory system has changed in recent decades. The regulatory system was challenged in the 1980s, due to its non-democratic nature and the lack of accountability. This created a ‘crisis of self-regulation,’ which led to greater regulatory formalization and institutionalization, and the emergence of a ‘regulatory state’ in the United Kingdom by the end of the 1990s (Moran Reference Moran2002; Levi-Faur and Gilad Reference Levi-Faur and Gilad2004). This formalization relied heavily on auditing of multiple industries, as a way to ensure trust (Power Reference Power1997). Private forms of authority, including self-regulation, nonetheless remain prevalent in the United Kingdom (Flinders Reference Flinders2004).
Like the United States, the legal framework that appears most relevant to ensure PMSC accountability in Britain is civil or contract law. Although laws exist banning individual participation in foreign military activities outside the United Kingdom, and some new restrictions have emerged in anti-terrorism laws passed after 2001, no prosecutions have been conducted under these laws since their inception over one hundred years ago. This reflects the ineffectiveness of criminal law in this area (Walker and Whyte Reference Walker and Whyte2005; Percy Reference Percy2006: 33–35).
These different national models matter both domestically and in the development of international standards, one form of self-regulation. Internationally active businesses tend to prefer global standards, because they allow for greater efficiency. Different companies or trade associations compete to ensure that their standards are adopted internationally, because this gives them ‘first mover’ advantage (Prakash Reference Prakash1999). But how industry groups interact with each other and with government regulators affects their ability to advocate their preferred standards. In particular, domestic systems in which trade associations accept some hierarchy and strong co-ordination with the government are better able to promote their standards in the international arena than are associations from states with decentralized, competitive relations among corporations, business associations, and government. European states, including the United Kingdom, have more successfully built national consensus behind preferred standards and promoted these internationally than has the United States, with its fragmented and highly competitive system of establishing business standards (Mattli and Buthe Reference Mattli and Buthe2003: 23–25).
The United States' and Britain's different approaches to self-regulation lead us to expect the IPOA and the BAPSC to develop differently. First, absent US government efforts to create new regulations or enforce existing ones, industry members in the United States would be unlikely to co-operate closely, and to support intrusive self-regulatory mechanisms (Gunningham and Rees Reference Gunningham and Rees1997: 390). Second, we would expect greater emphasis on legal mechanisms, as opposed to self-regulation in the US context. Third, we would expect the British government to rely more heavily on PMSC self-regulation, and that the government would co-operate with the industry to develop rules and guidelines. Finally, we might also expect the British government to push for some oversight mechanism for PMSCs.
III. Private Security Trade Associations, Regulation, and Self Regulation
Two trade associations have promoted self-regulation as a central and legitimate part of the regulatory framework governing the private security industry: the IPOA, and the BAPSC. The IPOA allows international membership, while the BAPSC accepts only private military and security companies based in the United Kingdom and working internationally. First, are the associations establishing mechanisms for effective self-regulation? Second, how do these associations' efforts correspond to prevailing national self-regulatory practices?
The International Peace Operations Association
The IPOA has a mixed record in implementing PMSC self-regulation. The IPOA is probably the best known trade association associated with the private security industry. It represents what it characterizes as the ‘peace and stability operations industry’ that provides support to humanitarian missions and peace operations; private military and security companies are a sub-set of this industry, and account for 20 per cent of the IPOA's membership (Cockayne Reference Cockayne, Speers, Cherneva, Gurin, Oviedo and Yaeger2009: 135). The IPOA was founded not by industry members, but by Doug Brooks, its president, in 2001 after consultations with academics, NGOs, and industry members (Interview with Doug Brooks, 16 July 2007). Sustaining ethical goals is one of Brooks' key aims; this will help legitimize the industry so it can play a larger role in peace-keeping and post conflict reconstruction activities (Brooks Reference Brooks2000). The Association's stated goals are 1) to promote high operational and ethical industry standards, 2) to expand awareness about the ‘growing and positive contributions’ its members can make to international peace and stability, 3) to provide members networking and business opportunities, and 4) ‘to inform the concerned public about the activities and role of the industry’ (IPOA 2009b). Observers have characterized the IPOA's central mission as lobbying, and Brooks is an active industry advocate (Singer Reference Singer2003: xi). The IPOA is based in Washington, and currently has 61 members. The IPOA maintains a website, and holds networking receptions, conferences, and an annual industry summit meeting. It also publishes the Journal of International Peace Operations, which focuses on contracting and topics related to member companies' interests. The IPOA's expenses in 2006–7 were $429,000, with member dues the largest source of funds (IPOA 2009c; Cockayne Reference Cockayne, Speers, Cherneva, Gurin, Oviedo and Yaeger2009:143).
The IPOA's self-regulatory framework utilizes both information and rewards, but not in ways that ensure member compliance. First, the IPOA has effectively publicized its standards through congressional testimony, media appearances, and newspaper articles (Brooks Reference Brooks2000; Brooks Reference Brooks2006; Brooks Reference Brooks2007). The IPOA's code of conduct was established in 2001, and is updated on occasion, most recently in February 2009.Footnote 5 It lays out appropriate activities and behavior for members in areas ranging from respecting human rights to insurance and personnel policies, with reference to specific documents and treaties regarding the conduct of war. The code also obliges companies to work only for reputable clients, and to conduct only defensive missions ‘unless mandated by a legitimate authority in accordance with international law,’ presumably to allow leeway for participation in peacekeeping or peace enforcement operations (IPOA 2009a).
The IPOA's self-regulatory code has several flaws: it lacks regular reporting requirements, it is reactive rather than proactive in evaluating members' behavior and it has no provisions for internal or external monitoring of corporate behavior.
The IPOA's self-regulatory framework lacks reporting requirements that would make members explain to the IPOA whether their business practices comply with its code. Nor does the code include monitoring mechanisms, either internal or external to the association. The association thus cannot evaluate whether its members comply with the IPOA's standards, and it cannot proactively address noncompliance. Instead, the association relies on external observers to bring violations to its attention.
The IPOA did establish a complaints process on its website, and complaints against member companies are accepted from both individuals and other entities. If complaints are deemed valid, the IPOA's standards committee can sanction the company by prescribing policy changes, placing the company on probation, or expelling it from the association (IPOA 2006a). Only four complaints were lodged in the first year or so after the compliance mechanism was established, with one additional complaint by 2009; none of these were from third parties in Iraq (Interview with Brooks, 16 July 2007; Cockayne Reference Cockayne, Speers, Cherneva, Gurin, Oviedo and Yaeger2009: 141).
The reactive nature of the complaints and sanctions process is problematic, however. It is generally accepted that different forms of monitoring are appropriate in different circumstances. The IPOA's complaints mechanism resembles the ‘fire alarm’ model of government oversight, which relies not on regularized reporting or oversight (‘police patrols’) but on enabling citizens or interest groups to raise concerns about agency performance (McCubbins and Schwartz Reference McCubbins and Schwartz1984: 166). But relying on others to ‘catch’ bad behavior is unrealistic when much PMSC business takes place in war zones, where few independent observers can monitor their actions or bring complaints. Moreover, not only civilians and NGOs but also the US military have had difficulty determining which companies different contractors work for in Afghanistan and Iraq (Schmitt Reference Schmitt2004: 530, n. 77; Gillard Reference Gillard2006: 535).
The IPOA's 2009 code notes that members ‘should report’ serious breaches of international humanitarian law and human rights law by its employees to the appropriate authorities (IPOA 2009a). But it is notable that this reporting requirement was added to the code after the killing of seventeen Iraqi civilians by a Blackwater security detail guarding State Department employees in September 2007 (it is not in the 2006 version), and ‘cover ups’ are not addressed in the IPOA's guidelines (IPOA 2006b). Companies have often removed employees suspected of crimes from the country where incidents occurred (Fainaru Reference Fainaru2008: 19). Some simply fire employees suspected of committing crimes – as well as those who report suspected crimes to authorities. In January 2007, for example, two PMSC employees filed reports alleging that one of their colleagues had fired on Iraqi civilians without provocation. All three employees were fired for the delay in reporting the incident. The suspected shooter returned to the United States (Matthews Reference Matthews2007; Fainaru Reference Fainaru2008). To be sure, employees of private military and security companies operating in Iraq were granted immunity from Iraqi law from 2004 to 2009, which means that their legal accountability was unclear. Beginning in January 2009, the new Status of Forces Agreement between the United States and the Iraqi government mandated PMSCs' accountability under Iraqi law (Williams Reference Williams2009).Footnote 6
Finally, there is little evidence that the IPOA's enforcement mechanism has been used, or that any companies have been expelled from the association for poor behavior. Moreover, cooperation with the standards committee is voluntary (Cockayne Reference Cockayne, Speers, Cherneva, Gurin, Oviedo and Yaeger2009: 139). According to Brooks, no companies had been expelled from the IPOA as of mid 2007. This raises questions about the IPOA's seriousness as a regulatory association. Trade association monitoring and sanctions processes are often confidential; but if they are not utilized, it is difficult to believe that members take the codes seriously.Footnote 7 The IPOA did initiate an investigation of Blackwater's actions after the September 2007 Nisoor Square incident. It took several weeks for the IPOA to act, however, and some observers suggest that this investigation was opened reluctantly (IPOA 2007; Discussion with PMSC representative, 12 March 2009). Blackwater withdrew from the association two days after the investigation was announced, rather than accept it.
In addition to sanctions, the IPOA wants companies to be rewarded for joining the association with more business opportunities. It argues that IPOA membership should be a tacit certification of standards, and argues that the key to its effectiveness is for those hiring private military and security companies to reward and reinforce standards. Brooks has proposed that clients should ‘include adherence to the standards set by the IPOA codes in their Requests for Proposals’ (Brooks Reference Brooks2006: 4; see also Brooks Reference Brooks2007). It is difficult to determine if clients accept the IPOA's claim, however. Moreover, the IPOA's members include some companies with dubious ethical reputations. DynCorp, for example, has a history of questionable employee behavior and contracting procedures.Footnote 8
Is the IPOA's self-regulatory mechanism likely to be effective, and to gain broad acceptance? Earlier, I proposed that American trade associations would not develop effective self-regulatory mechanisms unless government regulation appeared likely, and that legal mechanisms might have greater currency domestically. These propositions are borne out in the IPOA's case. Both the change in control in the US House of Representatives in 2006, and the 2007 Nisoor Square incident spurred efforts to expand oversight at the Federal level, and prompted increased government reporting about its reliance on PSCs (Elsea, Schwartz and Nakamura Reference Elsea, Schwartz and Nakamura2008; SIGIR 2008; SIGIR 2009). But pressure on the industry remained low. The US government sought to clarify the legal framework covering PMSC employees in Iraq and Afghanistan, and several criminal and civil cases are now pending in various jurisdictions that will test this framework (Eckholm Reference Eckholm2005; Roelofs Reference Roelofs2007; Thompson and Risen Reference Thompson and Risen2008; Sizemore Reference Sizemore2009). This supports the proposition that legal mechanisms may take precedence in the US regulatory system.
In 2009, changes in Congress's makeup led to increased interest in PMSC regulation. The IPOA introduced a revised version of its code of conduct in February 2009, but the code's verification and monitoring capacity did not change. Instead, the association apparently worked with Congress on legislation recommending a feasibility study of a third-party or government verification mechanism for the industry (Cole Reference Cole2009), not the establishment of an independent monitor, so this did not imply more regulation. But it is notable that the IPOA lobbied Congress to shape legislation, rather than cooperating with the executive branch to develop industry standards.
Although the IPOA has publicized its standards well, the association's code has major inadequacies; it lacks stringent reporting and monitoring requirements, and its sanctions mechanisms remain unproven. The association is asking clients either to accept ethical claims without corroboration, or to police company behavior on their own. This suggests that the IPOA's code may be effective public relations, but it is ineffective self-regulation.
The British Association of Private Security Companies
British private security companies' prominence in the industry has focused attention on the BAPSC. The BAPSC's progress in developing an effective self-regulatory framework has been slow, however, and its ability to contribute to PMSC regulation remains unproven. The BAPSC was established in February 2006 in response to concern among some UK-based private military and security companies and the association's founder and director, Andrew Bearpark, a former British civil servant who served in the Coalition Provisional Authority in Iraq and the Overseas Development Agency, about the lack of accountability they saw in places like Iraq (Cockayne Reference Cockayne, Speers, Cherneva, Gurin, Oviedo and Yaeger2009: 160). Impetus for the association appears to have come from outside the industry, with Bearpark encouraging its formation. The goal was to establish and maintain industry standards, and to develop relations with the relevant British agencies. The BAPSC is based in London, and has five members and nine provisional members. It maintains a website and hosts quarterly meetings and an annual conference.
The BAPSC differs from the IPOA in three ways. It only accepts PMSCs based in the United Kingdom as members. Additionally, membership is restricted to private military and security companies; BAPSC staff argue that this makes it easier to formulate relevant policy guidelines. Finally, the BAPSC aspires only to be a self-regulatory association, with no lobbying functions (BAPSC 2006).Footnote 9
The BAPSC presents a contradictory picture. Its aim is to establish a credible self-regulatory mechanism. Staff have stressed that self-regulation is more appropriate for this industry than other forms of regulation because it can change company behavior that state laws cannot effectively reach, due to PMSCs' international activities (Interview with Andrew Bearpark, 11 March 2009; Pfanner Reference Pfanner2006). BAPSC staff also argue that self-regulation is a ‘normative institution,’ and it will make member companies more responsive to social values, so this will drive up industry standards. Finally, they suggest that self-regulation may be most effective for this industry because the private security industry ‘understands itself better’ than does the government, so it can do a better job in applying targeted sanctions (Bearpark and Schulz Reference Bearpark, Schulz, Chesterman and Lehnardt2007).
The BAPSC plans to utilize a range of self-regulatory tools. Standards mechanisms include a charter, created in 2006, spelling out the guidelines and principles for members (BAPSC 2006). There is no guarantee that members will adhere to principles, but they have made a public commitment to do so by joining the association.
Formal industry standards are a second element that the BAPSC intends to establish. A draft code of conduct has been written but not published, because the BAPSC believes the code will gain greater value and legitimacy if it is vetted through a multi-stakeholder process (Interview with Bearpark, 11 March 2009). The association wants the British government involved from the outset. This reflects the expectation of collaboration common to self-regulation in the United Kingdom.
It is not clear whether the BAPSC plans to require member reporting because of the difficulty of balancing reporting against maintaining client confidentiality. It recognizes the importance of investigating complaints, but Bearpark sees two fundamental problems for the association in doing so: investigation is expensive, particularly if suspected violations occur in war zones, and industry efforts to investigate itself may not be accepted by outsiders as credible. To address this, BAPSC has proposed establishing an ombudsman to investigate complaints, a reactive but independent form of investigation (Bearpark and Schulz Reference Bearpark, Schulz, Chesterman and Lehnardt2007: 248). The BAPSC notes that effective self-regulation also requires membership criteria and guidelines and vetting of prospective members. If companies must meet standards to join the association, this helps mitigate – but does not remove – the problem posed by a lack of reporting mechanisms. By late 2007 the association had agreed on formal membership criteria. These draw heavily on guidelines developed by the British Security Industry Association, a quasi-government organization that oversees the domestic private security industry, with minor changes to reflect the nature of PMSC activities. Five companies have since been accepted as full BAPSC members.
The initial aim was to make the BAPSC's code recognized by the British Standards Institute (BSI). This would make it the official standard for all UK-based private military and security companies, and would enhance the BAPSC's legitimacy and authority as the industry's regulatory body (Bearpark and Schulz Reference Bearpark, Schulz, Chesterman and Lehnardt2007). This would give companies greater incentive to join the BAPSC.
Like the IPOA's president, BAPSC Director Bearpark has also argued that clients of PMSCs must vet companies for ethical behavior if this matters to them. Norm-based self-regulation will only matter if there is an economic ‘reward’ for maintaining standards, and thus it is up to consumers to hire the ‘good,’ respectable corporations who comply with self-regulation (Bearpark and Schulz Reference Bearpark, Schulz, Chesterman and Lehnardt2007). Both the IPOA and BAPSC have proposed that clients seeking to hire PMSCs but knowing little about the industry should approach a trade association to ensure that they hire reputable firms (Security and Defence Agenda 2006). This would also enhance the BAPSC's ability to reward member companies.
The BAPSC also expects to rely on sanctions to penalize poorly performing members. Bearpark states that the BAPSC plans to handle sanctioning internally. The range of sanctions may include fines, retraining requirements, and audits to ensure compliance, with expulsion from the BAPSC as the ultimate sanction. Both Bearpark and outside observers note the dilemma that expulsion presents, however, if members are the main source of revenue for the association. As of March 2009, no sanctions had been imposed by the BAPSC on its members, in part because the BAPSC's legal authority to sanction provisional members is unclear.
The BAPSC hopes to act as an ‘interface’ between the British government and the private security industry (Bearpark and Schulz Reference Bearpark, Schulz, Chesterman and Lehnardt2007: 247). However, the British government has been indecisive about whether and how it wanted to regulate private military and security companies. The government published a ‘Green Paper’ detailing six regulatory alternatives in February 2002 (Foreign and Commonwealth Office 2002). This was driven in part by the ‘Arms to Africa’ scandal, which resulted when Tim Spicer, then president of Sandline International, was found to have imported weapons into Sierra Leone in violation of a UN arms embargo in 1998, but claimed that he was doing so with the knowledge and support of the British government. The incident led to investigations into the government's ties to PMSCs (Avant Reference Avant2005: 171–2; Pelton Reference Pelton2006: 270–272).
There was little follow-up to the Green Paper until April 2009, when the British government announced a consultation period for a new regulatory scheme for the private security industry. This scheme would include development of a code of conduct agreed by the government and industry, and monitored by the BAPSC as the industry's trade association; reliance on a potential international code of conduct governing PMSCs' behavior globally; and government preference in contracting for companies agreeing to uphold these standards. The government rejected calls to license PMSCs as unworkable because global monitoring would be difficult. The government also argued that the British industry's generally favorable reputation meant that it did not require licensing; ‘it is important that a legitimate and important industry is not over burdened’ (Foreign & Commonwealth Office 2009: 6). Support for an international code was intended to build on the Montreux Document (2008), a Swiss-backed initiative, which lays out state responsibilities under international law regarding the conduct of private military and security companies.
Observers suggest that the UK policy option was driven by self-regulation being regarded as the cheapest alternative and it remains unclear whether the government intends to fund any industry monitoring mechanisms. The BAPSC has argued that self-regulation would be far cheaper than other possible regulatory options, but that even self-regulation would have notable costs, if it is to have adequate investigative capacity. The decision to adopt loose self-regulation may also reflect the absence of public pressure on the government to act. Once the scandals of the 1990s died down, PMSC activities attracted little attention in the UK, even as the industry began to expand rapidly following the Iraq invasion in 2003.Footnote 10
It is too early to tell if the BAPSC will establish an effective framework for self-regulation, but its slow progress raises some doubts. At least one founding member left the association in 2009, prior to the government's consultation announcement (Erinys 2009). Should the government move forward with reliance on self-regulation, the BAPSC may attain the ‘gatekeeper’ status that would enable it to confer greater legitimacy on its members, and enhance its own clout.
The typical pattern of self-regulation in the United Kingdom would lead us to expect the British government to work cooperatively with PMSC groups to establish self-regulatory guidelines, and that it might support an oversight or audit mechanism. The British government's current proposal appears to envision a form of self-regulation ‘lite’, however, with a weak bond between government and the BAPSC (Mattli and Buthe Reference Mattli and Buthe2003: 25). While the government plans to work with industry to develop a code, it has not indicated that it intends to establish oversight mechanisms to back this up. The BAPSC and British industry representatives are participating in an initiative sponsored by the Swiss government to explore the possibility of developing an international code of conduct to govern PMSC behavior globally. The multi-stakeholder nature of this process may limit their influence on the final product, however, while at the same time according the process greater legitimacy in the long run.
IV. Conclusion
Both the IPOA and the BAPSC advocate reliance on self-regulation to fill the regulatory gap that exists with regard to private military and security companies working internationally. Neither has established a framework for self-regulation that would enable the associations or outsiders to evaluate member companies' compliance with the standards they set. Neither framework is thus likely to assuage concerns about the paucity of regulation governing the private security industry. However, these efforts appear to have achieved a key self-regulatory aim: to forestall increased state regulation. This is particularly true in the United Kingdom. The IPOA and the BAPSC cannot claim full credit for the absence of regulation, however, since governments have faced little public pressure to regulate.
The differences in approach toward regulation and self-regulation in the United States and the United Kingdom are only partially reflected in PMSC self-regulatory activities. The IPOA's independent self-regulatory efforts fit with the general hands-off approach common between industry and government in the United States, and the general suspicion about regulation. The BAPSC's slow progress toward self-regulation can be partly explained by the British government's inaction. The government's current weak self-regulatory proposal diverges from Britain's general alignment with European countries in self-regulatory practices. In defense policy, however, Britain has adhered more closely to US practices, with the expectation of greater defense co-operation with the United States (Walker and Whyte Reference Walker and Whyte2005).
Private military and security companies present a quandary for the state, and for conceptions of the government's monopoly over force. The erosion of state authority over violence is generally viewed with alarm, but the emergence of private actors in the state's employ also allows states broader freedom of action. Some scholars have argued that, rather than representing a devolution of state power, outsourcing force enhances the state's abilities by enabling it to use intermediaries to do things the government would rather not acknowledge publically (Walker and Whyte Reference Walker and Whyte2005; Leander Reference Leander2005). The recent revelation that the CIA contracted with Blackwater to assassinate Al Qaeda operatives in 2004 illustrates this point (Mazzetti Reference Mazzetti2009). This may give contracting states less incentive to ensure effective controls over, and accountability of, PMSCs. Indeed, only after significant abuses in Iraq and change in the political control of Congress did the US government begin to require reporting of the government's own reliance on PMSCs in Iraq and Afghanistan (Elsea, Schwartz, and Nakamura Reference Elsea, Schwartz and Nakamura2008). Reliance on self-regulation may support government efforts to avoid transparency regarding its use of PMSCs, fuelling suspicions of government intentions, while adding to perceptions that self-regulation is merely window-dressing. It is important to note, however, that PMSCs present a difficult regulatory challenge, because the activities to be regulated occur overseas.
The relative ineffectiveness of these self-regulatory efforts confirms previous findings: effective self-regulatory schemes are more likely to emerge in the shadow of hierarchy, or when companies can be punished directly by consumers, which generates reputational incentives to self-regulate. This is more likely when constituents have recourse to demand changes, either by insisting on stronger government oversight or regulations, or by boycotting companies that flout self-regulatory guidelines. Self-regulation can work transnationally as well as domestically if citizens are sufficiently engaged, which explains why voluntary regulations have tended to focus on issues that resonate widely, such as environmental issues. But where the activities to be regulated have less popular resonance, and occur overseas in grey areas with little publicity, neither governments nor companies have much incentive to pay the costs associated with effective and verifiable self-regulation. This suggests that reliance on self-regulation may simply be inappropriate for certain types of international business practices, like PMSCs.
Efforts by the private security industry to self-regulate also illustrate a fundamental chicken-and-egg dilemma confronting self-regulation: it is intended to quell pressure for formal regulation, but without the threat of state action industries have little incentive to design effective self-regulatory mechanisms. Absent the shadow of hierarchy, industry members have little reason to co-operate on regulating their behavior since they are in competition with each other. At the same time, government inaction is partly explained by the lack of public pressure to regulate PMSCs. Given the demands on the state, new regulations are unlikely if there is little sustained demand for action.
Multiple levels of regulation are needed to govern the private security industry, due to its international nature and the dearth of state regulations. Efforts to develop voluntary international standards for private military and security companies, for example, have been stimulated by the difficulties of developing state regulation. This implies that, even if limited in its effectiveness, self-regulation may be better than nothing; at a minimum, it can provide public standards against which third parties can judge corporate behavior. But as currently planned and practiced by PMSCs, self-regulation is not a sufficient substitute for state regulation of this industry. While governments may complain about the difficulties of regulating a global industry, states remain the locus at which enforcement of laws and standards is most likely. The private security industry's global reach and potential for resort to force make it particularly important to establish an appropriate balance between government and private authority with regard to the private security firms that they employ.
