The idea that generals are always fighting the last war is one of the great military clichés. However, like most clichés, it contains a grain of truth: that in military matters, hindsight is more effective than foresight. The evolution of private military and security companies (PMSCs) and attempts to regulate them demonstrate how hard it can be to respond to quickly changing military and business practices. This article argues that the private military and security industry is agile and innovative, and has responded swiftly to changing market pressures. As a result, regulators at all levels have often been stuck in lengthy negotiating processes while the target of their regulation is rapidly changing form. In other words, attempts to regulate private actors who use force result in regulating the last war, leaving behind a string of inadequate regulatory instruments. In turn, this string of inadequate regulation has encouraged a perception that the problem is too difficult to regulate formally and resulted in various types of voluntary regulations, which is an important step, but insufficient. This argument is made in three stages. First, there is a brief outline and definition of the nature of the private military industry, and the argument that it has had three main waves of development. Second, there is an examination of how in each of these three transformations, states and other actors have ended up ‘regulating the last war’ and some reasons why this happens are suggested. The article concludes by considering the implications for regulatory bodies seeking to deal with PMSCs. The focus is on international regulatory efforts and discussions in the US and UK, the former because of its status as a major employer of private security and the home state for prominent private security companies, and the latter because of its role as home state for both private military companies and private security companies.
The private military and security industry: an overview
Attempts to define and describe the PMSC are legion,Footnote 1 but definitional discussions are not entirely academic exercises. Rather, they reflect one of the particular challenges of private force: it encompasses a great range of activities, from the mundane to the controversial. Many companies specialize in landmine clearance, which is relatively uncontroversial, but also offer close protection, which requires arms. The Blackwater employees that opened fired in a Baghdad market in September 2007 were engaged in close protection. The company Aegis provides both risk analysis services (as do many insurance companies) and security services in combat zones.
While the lines between the types of companies providing domestic security services (such as security guards in commercial buildings) and international services (like combat support) used to be quite clear, in 2008 the company G4S (a US domestic security company) acquired ArmorGroup (an international company), forming an entity that straddles international and domestic services.Footnote 2 Thus, it can be difficult to create a definition that captures the whole industry.
The tendency among academics to argue about definitions has further complicated the situation. While the terms private military company (PMC), private security company (PSC), and private military and security company (PMSC) are in common currency, there is considerable variation about when they are used and their precise content. I argue that one fairly obvious way out of the confusion caused by multiple names is to follow the historical evolution of the industry and to use the terms companies themselves use. In order to explain the definitions I use and to provide a useful snapshot of the history of modern private force, I will turn now to a brief historical explanation before coming back to the question of definitions.
In the mid-1990s, a South African company called Executive Outcomes was hired by the Angolan government to take back oilfields captured by rebels.Footnote 3 Executive Outcomes, which called itself a private military company, was subsequently hired by the government of Sierra Leone to push back the violent rebel group the Rebel United Front (RUF), which had come extremely close to the capital, Freetown. In both cases, Executive Outcomes planned and executed missions in the same way a national army would. A similar company, Sandline, appeared in the late 1990s, also offering combat services, and was hired in Sierra Leone and in Papua New Guinea. As Tim Spicer, then head of Sandline, put it when asked if his company would go on combat operations: ‘of course we will’.Footnote 4
However, ultimately, combat services were simply too controversial and international distaste for the open provision of combat helped push Executive Outcomes and Sandline out of business.Footnote 5 Tim Spicer started a new company, Aegis, which was specifically designed to avoid combat, but would provide other security services.Footnote 6 Aegis and companies like it called themselves PSCs to avoid association with their more controversial forebears.Footnote 7
After the 11 September 2001 attacks and subsequent wars in Iraq and Afghanistan, the nascent PSC industry boomed. Downsizing in the American military, combined with an overall climate in favour of privatization,Footnote 8 led the American government to devolve large numbers of tasks to the private sector, ranging from translation through military interrogation and including armed close protection of individuals and installations. Previously, this protection would have been provided by members of the regular armed services. These companies insisted that they did not provide combat services and would only use force defensively,Footnote 9 making the conscious decision to abandon the planning and execution of military operations in favour of less controversial services. Using the terms PMC and PSC highlights this significant shift in the industry, while the term PMSC covers the industry as a whole and both types of company.
The third phase of the development of the PMSC industry covers the post-Iraq and Afghanistan period. The acquisition of ArmorGroup by G4S was in response to the former's economic problems caused by dwindling contracts in Iraq.Footnote 10 After the large contracts and ‘gold rush’ mentality of Iraq and Afghanistan, companies have had to consider their future and are diversifying into a variety of areas: maritime security, particularly against pirate attack; the protection of humanitarian aid; and in some cases the desire to get into the business of actually delivering humanitarian aid; and the expansion of existing non-military services such as risk analysis. I will discuss these areas further below.
In under twenty years, the private military and security industry has had three quite different incarnations, and the international community, as well as individual states, have made many attempts to regulate it. However, states have been trying to regulate a moving target, and to make matters worse, regulation has sometimes been inherently poor. In the next section, I will examine the attempts made to regulate the various manifestations of private force, and point out that in each case, by the time regulation became operable (and occasionally, before it did so), it was out of date.
Regulating the last war: the evolution of private security regulation
Regulation of private force has been a game of catch-up, led by the necessity to respond to problems in the industry, rather than seeking to regulate the direction of the industry's growth. The idea that regulators of private force have been regulating the last war is clearly visible throughout the three stages of the industry's evolution. In all three cases, regulators have been responding to scandals or crises caused by the industry, and have then often found themselves in lengthy regulatory processes during which the industry transforms. The result has been that often as soon as it has been created, the regulation is, at worst, obsolete or, at best, inapplicable to new manifestations of private force. This section traces each stage of the industry's evolution and demonstrates that a combination of a preoccupation with solving pressing problems and a tendency to assume that the latest manifestation of private force is like the previous one, combined with the slow pace of the regulatory process, has led to backward- rather than forward-looking regulation. When PMCs emerged, regulators still attempted to deal with them using tools designed for mercenaries, regardless of their applicability; when PSCs replaced PMCs, regulators were slow off the mark because their focus was still on dealing with the problems caused by PMCs; and while the international community has focused on dealing with PSCs via the Montreux ProcessFootnote 11 and the International Code of Conduct for Private Security Providers (ICoC),Footnote 12 the industry has evolved again in such a way that these processes may be largely ineffective. Moreover, both Montreux and the ICoC remain voluntary agreements, and represent a shift towards self-regulation that has occurred partly because of the inability of relevant parties to devise formal regulation.
From mercenaries to PMCs
When Executive Outcomes came to international attention in the late 1990s, international law governing mercenaries was widely recognised to be inherently inadequate and, at any rate, inapplicable to companies like Executive Outcomes and Sandline. During the 1960s and 1970s, the common use of mercenaries in Africa created significant international efforts for regulation, but that resulted in ineffective law. Both Additional Protocol I to the Geneva ConventionsFootnote 13 and the International Convention against the Recruitment, Use, Financing and Training of MercenariesFootnote 14 set out a definition of mercenaries that renders the law so weak that is has become commonplace to note that ‘any mercenary who cannot exclude himself from this definition deserves to be shot – and his lawyer with him!’Footnote 15
To make matters worse, the UN Convention was created extremely slowly, with discussions beginning in 1980 and ending with the adoption of the Convention in 1989. It did not come into force until 2001, by which time the world of private force had changed completely. The UN Convention had been designed to eliminate the practice of individual mercenaries organised into groups in order to attempt coups or otherwise undermine states. By 2001, this type of mercenary was no longer common, and PMCs like Executive Outcomes and Sandline provided a different challenge.
One unintended consequence of the lengthy gestation of the UN Convention was that private force evolved with an eye to international law. The reason the international legal definition of mercenaries is so problematic is that it contains a number of loopholes that allow the lawful use of private force. In turn, this reflects the idea that states were trying to control a particular type of mercenary: a foreign individual fighting for financial gainFootnote 16 and attempting to destabilize the state. The law deliberately excludes private fighters enrolled in the armed forces of the hiring state, and both Executive Outcomes and Sandline utilised this loophole. As a result, there was widespread agreement that PMCs were not subject to either Article 47 of Additional Protocol I, or the UN Convention.Footnote 17 Indeed, by the time the Convention came into force, one of its signatories (Angola) had hired Executive Outcomes.
The appearance of PMCs on the international stage prompted new international and domestic regulatory discussions, some of which took place in familiar venues. The United Nations response was to continue working on the issue through the existing office of the Special Rapporteur for mercenaries,Footnote 18 Enrique Bernales Ballesteros. Ballesteros was the UN's longest continuously serving Special Rapporteur until he was replaced in 2004.Footnote 19 Ballesteros provides perhaps the sine qua non example of a regulator obsessed with the last war: he insisted that there was absolutely no difference between mercenaries of the type operating in Africa during decolonization, PMCs like Executive Outcomes and Sandline, and PSCs.
Ballesteros's main concern was that private force (in whatever manifestation) threatened democracy and self-determination, which indeed they had throughout the period of decolonization. Mercenaries involved in the wars surrounding decolonization in Africa beginning in the 1960s were mainly individuals or loosely organised groups of individuals hired to destabilize newly independent states (as in the Congo). Mercenaries also sought their fortunes by deposing governments (as in Benin, the Seychelles, and the Comoros Islands) or assisting national liberation groups (as in Angola and Nigeria/Biafra).Footnote 20 In these cases, mercenaries, who were nearly always white, were unquestionably subverting or attempting to subvert national self-determination in newly decolonised states.
While PMCs and their mercenary forebears shared some characteristics, in that they were mainly white foreigners involved in wars in the developing world, they were not identical and treating them as mercenaries was both inaccurate and problematic.
Executive Outcomes and Sandline were employed by states that often saw them as the last alternative to end dangerous rebel movements. In Sierra Leone, the government hired Executive Outcomes because the RUF, infamous for its amputation of arms and legs of those in their path, had advanced to within twenty kilometres from Freetown. Sierra Leonean officials felt abandoned by the international community and that they had no choice but to employ a PMC in order to survive.Footnote 21 It is hard to see how a state hiring private force to defend itself against rebel movements constitutes a violation of the right to self-determination, even if it is otherwise problematic.
PMCs posed a set of regulatory issues that were specific to the context in which they were operating and different from those caused by mercenaries. Both Executive Outcomes and Sandline worked for small states with limited military capacity, meaning that in theory it would have been possible for them to dramatically undermine the state in which they were working. However, in Sierra Leone the armed forces were notoriously corrupt and many soldiers were also rebels, leading to the coining of the term ‘sobel’.Footnote 22 It is hard to see how PMCs were not an improvement on regular troops.
This is not to assert that PMCs were uncontroversial actors. Indeed, Sandline found itself involved in two major scandals: in Sierra Leone, Sandline was accused of violating the arms embargo placed on the country, possibly in collusion with the British Foreign and Commonwealth Office,Footnote 23 and in Papua New Guinea, the company's contract was cancelled after the Papua New Guinea armed forces threatened a mutiny rather than work alongside it.Footnote 24 In addition, there have been a number of accusations in relation to the compensation paid to both Executive Outcomes and Sandline. In Angola and Sierra Leone, Executive Outcomes was paid in long-term natural resource concessions, a move that critics argued mortgaged the future of both states for what amounted to short-term security solutions.Footnote 25 There were also concerns that as a result, PMCs only really provided security in natural resource areas, rather than broadly throughout society.Footnote 26 Executive Outcomes was also accused of committing abuses in Angola.Footnote 27 These allegations, however, do not prove that PMCs are similar to mercenaries, but that they are problematic actors. The scandals in which PMCs were involved pushed the regulatory conversation in specific directions that reflected the particular issues PMCs caused, or were perceived to cause.
The Ballesteros reports from the late 1990s are preoccupied with the idea that PMCs are mercenaries, and that mercenaries are wholly illegal under international law. Ballesteros argued that ‘even though existing international law may be … full of gaps … it would be wrong to invoke the existing rules … in such a way as to justify mercenary acts’,Footnote 28 and that the use of mercenaries in any form (whether in private companies or not) undermined self-determination.Footnote 29 However, it is difficult to see how, when they were hired by the state to defend itself, PMCs challenged national self-determination, especially when the state in question was facing significant existential threats.
Ballesteros was preoccupied with the previous challenges caused by mercenaries, so his reports do very little to deal with the problems actually posed by the use of PMCs. Regulators ought to have been concerned with a series of important questions instead: how to protect weak states from the potential problems caused by a well-equipped and well-trained private military partner; whether or not payment in natural resources was a sound idea; and how home states might authorize these controversial activities abroad. The blanket view that even though the law did not apply to these actors, it should have done so, may have prevented the creation of new regulation to deal with a new problem.
Outside the UN, states were also grappling on an individual basis with how best to deal with new private military actors. The drive for regulation in the UK was created by response to the Sandline arms to Africa affair, which forced a government inquiry. As Foreign and Commonwealth Office (FCO) practices were called into question,Footnote 30 the FCO became the lead government agency dealing with private force, continuing in this role throughout the Iraq period to today. The inquiry led, in 1998, to the Legg Report, which concluded that while the FCO itself had never directly sanctioned the transfer of arms to the Kabbah government, but individual FCO personnel were implicated, including the British High Commissioner to Sierra Leone.Footnote 31 The Legg Report also called for a Green Paper on PMCs, and in turn this was to lead to a White Paper and subsequent legislation.Footnote 32 The Green Paper was released in February 2002 and will be discussed in greater depth below.
The Legg Report began an inadvertently long regulatory discussion in the UK. This process was delayed by three factors: first, the high turnover of foreign ministers in the Labour government and the different priorities they placed on the issue; second, the concentration of important and complicated foreign policy issues after 11 September 2001; and, third, the sense that the issue was a political hot potato that no government department particularly wanted to handle.Footnote 33 The long regulatory process meant that the UK was still grappling with companies like Sandline when the war in Iraq began, the implications of which will be discussed below.
Neither the UN nor states were able to respond to the use of PMCs in a particularly timely fashion. As a result, market pressure arguably had the largest impact on altering PMC behaviour. PMCs were deeply engaged in every aspect of combat operations, from the strategic to the tactical. As a result, they had the potential to greatly influence local politics, and because they were willing to fight the wars, their personal lethal effect was high. International discomfort with the idea of combat provision led to its disappearance from the private military industry: there was no market for the private provision of offensive force. The market did not exist partly because few states could afford to pay PMCs without natural resource concessions. Other potential clients were deterred by specific PMC scandals. PMCs themselves recognised that the provision of security services stopping short of combat was less controversial and that powerful states were more reliable clients than the developing states that had once employed Executive Outcomes and Sandline. These powerful states were not interested in privatizing combat, but rather in privatizing support and other less central functions.Footnote 34
PMCs to PSCs: changing direction in the middle of a war
The start of the war in Iraq in 2003 fundamentally altered the private security industry. New companies, like Tim Spicer's, which had been set up to avoid combat, had not yet found major contracts. The decision of the US to hire large numbers of contractors created a gold rush mentality and explosive growth in the industry.Footnote 35 These companies again posed a series of new issues: what legal mechanisms exist to control contractors who commit crimes on the battlefield? Do PMCs have a significant impact on counterinsurgency, which requires the delicate application of force? However, regulators did no immediately consider these questions. In the UK, the government was still caught up with the Green Paper, which was released in February 2002 and was neglected during the run-up to the Iraq War. The Green Paper proposed a series of solutions to deal with PMCs and the problems they caused, but did not really consider the use of private companies during large-scale wars when employed by strong states that retained strategic command and control.
The actions of contractors on the ground quickly revealed that neither states nor the international legal community had sufficient regulatory mechanisms to deal with an industry trading in lethal force. PSC employees were complicit in the Abu Ghraib prison scandal in 2004, and in 2007, employees of the American company Blackwater opened fire in a Baghdad market, killing seventeen civilians. These episodes were the most high profile of a series of problems, including issues caused by uncertainties about the role of contractors in the existing chain of commandFootnote 36 and their use to support complex counterinsurgency operations.Footnote 37 Problems caused by contractors on the battlefield revealed that there were no legal mechanisms that could be used to bring them to justice.
The UK response to the war in Iraq
The UK and US responded differently to events in Iraq. In the UK, the war in Iraq partly rendered the Green Paper process obsolete through simple bad timing. Not only did the war in Iraq begin just over a year after the Paper was released, it had a lengthy run-up that understandably took priority in the relevant government departments. The Green Paper process stalled after Iraq. Reports that regulation was forthcoming emerged,Footnote 38 but none eventuated. It is likely that the FCO, as the lead agency involved in regulation, continued to be preoccupied by the complex nature of UK foreign policy during this period, especially because of the unexpectedly prolonged commitments in Iraq and Afghanistan. The industry body, the British Association of Private Security Companies (BAPSC), suggested that the ‘hot potato’ problem was again an issue, with an absence of enthusiasm for an unpopular but headline-grabbing issue.Footnote 39 Finally, when pressed by the House of Commons Foreign Affairs Select Committee about the reasons for the delay in producing legislation, Lord Malloch Brown, the FCO minister, argued that the complexity of the business was responsible for the lengthy period of negotiation.Footnote 40 Unlike the US, events did not force the UK into more serious regulatory discussions. Many UK-based companies were working in Iraq, but they were primarily employed by the US, which threw the regulatory ball into the American court.
The US response to the war in Iraq
In the United States, the regulatory story was not necessarily one of regulating the last war, but of regulating existing business practices with little eye to their evolution. The Americans were famously underprepared for almost every aspect of the war in Iraq,Footnote 41 and were perhaps even less prepared for the potential issues caused by PSCs in Iraq.
The American government had used PSCs with minimal issues since at least the early 1990s, and US had a relatively long history of privatizing other support roles going back at least as far as the 1980s.Footnote 42 American-based PSCs such as Dyncorp and MPRI had provided extensive military training, approved by the US government, to various actors abroad. While these contracts had not been without incident,Footnote 43 they were largely unproblematic and were useful role for the US government, allowing intervention in places like Croatia where official American assistance would have been diplomatically challenging.
The use of PSCs prior to Iraq was governed by the same procedures that the US used for the control of arms sales abroad, which required Congressional approval for sales totalling more than US$50,000. However, contracts were routinely segmented into amounts just short of that amount, thereby circumventing the regulations. In the late 1990s, the contract oversight administrators faced considerable cuts,Footnote 44 meaning that despite employing more contractors in more problematic areas, there was no way to oversee them.Footnote 45
To make matters worse, the American military in Iraq relied on a legal instrument that had made sense in previous conflicts: a status of forces agreement (SOFA) that immunised accompanying personnel, such as contractors, from local prosecution. SOFA agreements with this provision had been used without incident in previous conflicts and served to protect captured personnel from unfair local trials. However, the US had never used contractors on the scale they did in Iraq, and the SOFA with the Iraqis meant that contractors could not be tried for any abuses in Iraq. Unlike the provisions for American military personnel, there were no provisions that could be used to try contractors in the US.Footnote 46
Events forced the US to drastically alter its regulation of PSCs, but, as one academic noted, this was very much a case of closing the barn door after the horse had already bolted.Footnote 47 The Americans found themselves in this position in part because of complacency: the issues involving PMCs had not had much impact in the US, and the country's relative success with using PSCs through the 1990s meant that the US was, in effect, considering that the past would be the same as the future and that contracting out services on a large scale during a war in which the US was itself involved would be the same as small-scale contracting during peacetime.
In different ways, the US and the UK, preoccupied with existing uses of private force, failed to anticipate how the industry might evolve. In the UK, this meant sitting on a regulatory process that then took some years to complete and will be discussed in greater depth below. In the US, a failure to anticipate how the increased use of contractors would greatly challenge a system that was designed to deal with other phenomena led to significant abuses by contractors and a system that could not punish them. No state or military organisation has a crystal ball, and the speed at which the industry evolved and the length of the war in Iraq were certainly surprising. States cannot be faulted for failing to anticipate all eventualities.
However, the use of private force in both states proceeded unencumbered by any kind of policy discussion about its use. While devising regulation in advance is problematic, policy discussions about what sorts of services the state ought to privatize in the first place never occurred. Many military commanders had, for example, significant reservations about privatizing military interrogation,Footnote 48 and military interrogation at Abu Ghraib was the first serious PSC scandal.
The UN approach to the private security sector most egregiously attempted to regulate the previous incarnation of private military companies. Ballesteros, the UN Special Rapporteur on Mercenaries, was still in office at the start of the 2003 Iraq War. He repeatedly insisted that PSCs (like the PMCs that preceded them) were simply a new incarnation of mercenaries, and considered that both PMCs and PSCs were intricately connected to the mercenaries that preceded them, in that private companies might themselves be considered to be recruiting and hiring mercenaries.Footnote 49 His backward-looking insistence, which failed to recognize any difference between PSCs employed by the United States in Iraq and a ragtag band of mercenaries attempting coups in small African states, meant that the regulatory process was focused on the wrong set of issues, especially as the type of issues posed by both actors were so different. The UN position alienated PSCs themselves, who were and remain staunch advocates of regulation, even if they are far from perfect actors. The result has been that PSCs have actively pursued other avenues of regulation, including the more pragmatic Montreux Document and the ICoC, and sidelined both the UN's and the UK's delayed regulatory processes. This article now turns to examining these attempts at regulation.
The Montreux Process, the ICoC, and the future of PMCs
The International Committee of the Red Cross (ICRC) and the Swiss government were among the first actors to begin advocating for the further regulation of private security companies after the Iraq War began in 2003. While the ICRC maintained (and still maintains) that PMSCs are required to abide by the rules of international humanitarian law (IHL) in the same manner as all other actors on the battlefield, the ICRC nonetheless took note of the under-regulation of the industry and advocated for greater controls.
The Montreux Document seeks to increase control over PSCs on the battlefield and is directed primarily at states. It provides a reminder of the existing relevant international legal obligations under IHL and suggests good practices for states employing PSCs, as well as indicating that relevant criminal law provisions may apply to abuses, both to individuals and to states – home states (where companies are based), territorial states (where companies are operating), and contracting states (which hire companies). States and companies were involved in the negotiations, which began in 2005 and were completed in 2008. The Montreux Document does not constitute formal international law, but is a restatement of existing binding international law. Montreux took a neutral approach to PSCs, treating them as regular actors on the battlefield, an approach that facilitated negotiation and agreement. The Montreux Process has had several notable successes. Efforts to develop regulation via the UN were stymied by Ballesteros's view that PSCs were mercenaries. Even after the Special Rapporteur role was taken over by the UN Working Group on Mercenaries, the term ‘mercenary’ remains problematic for PSCs, and companies themselves quickly sought to distance themselves from the Working Group.Footnote 50 When the non-judgmental Montreux Process began, PSCs and associated industry bodies, such as the International Peace Operations Association (IPOA) and the British Association of Private Security Companies (BAPSC), placed their support and interest behind it. Montreux Document was able to achieve clarity on a complicated issue by asserting the basic rules and principles that PSCs and their employers ought to follow.
The Montreux Document also represents perhaps the only possible international agreement at this stage. The abject failure of anti-mercenary law has led to a lack of confidence in international control efforts. Powerful states, such as the UK and the US, have an interest in continuing to use PSCs and, in the case of the latter, rely on them to the extent that war without contractors is probably impossible. Accordingly, creating a wider regulatory discussion might limit the flexibility of states to use PSCs, and so the Montreux Process proved desirable. Because the Montreux Document restates existing law, it is a very low-cost solution for states. They are not required to agree to anything that they have not previously agreed to; they are just required to consider it in a new context. The Montreux Document creates no new binding obligations for states.
The ICoC seeks to set out a clear code of conduct directed at companies rather than states. Shortly after the Montreux Document was completed, PMSCs themselves began the process of creating a parallel international code of conduct that would make the appropriate behaviour of PMSCs clear. After a series of multi-stakeholder meetings, the ICoC was signed in November 2010. Like the Montreux Document, it reminds companies of their obligations under IHL, as well as indicating best practices. In many ways it resembles the UN Global Compact, which encourages corporations to adopt minimum standards of behaviour in relation to a range of human rights issues.Footnote 51 The ICoC seeks to provide consequences for those companies failing to adopt the code or uphold standards. The idea is that an industry-led body will only allow membership to those who have adopted the code and will withdraw membership from those who violate it. States will then only employ those PMSCs who are members of the industry body and signatories to the code.
The ICoC, like the Montreux Document, is a significant accomplishment given the very slow pace of regulation, particularly in the UK, and the problems of creating international regulation. Its attempts to provide consequences for a failure to sign the code or for violating it are laudable. The ICoC reflects the fact that PMSCs themselves are often the strongest drivers of regulation because it makes good business sense for them to have clear rules of operation and, as argued above, to weed out companies bringing the industry into disrepute. Accordingly, the ICoC takes what some might consider a surprisingly tough line on human rights questions; for example, the standards required of companies in relation to human rights exceed the basic standards of IHL.
Informal agreements and voluntary codes are certainly better than nothing, but neither is robust enough to stand as the only means of regulating the PMSC industry. Informal agreements can be understood as lowest-common-denominator legislation, or the bare minimum on which a variety of actors can agree. Whether or not the bare minimum is sufficient to regulate an industry that has significant lethal potential is questionable. While the ICoC's human rights provisions are tougher than the basic IHL provisions, they are also a lowest common denominator in that they reflect the interests of companies.
The danger of voluntary codes of conduct may have little impact on actual behaviour. The UN Global Compact has had undeniable successes, particularly in highlighting potential problems caused by corporations, but may not have much impact on behaviour in part because it has no real way to investigate or sanction-violating companies and thus it struggles to ensure accountability.Footnote 52 While the use of membership in an industry-led body as a carrot and a stick for good behaviour improves on the Global Compact, questions still remain. No other industries are allowed to regulate themselves entirely, and ‘the incentive structures run against a trade group acting as a strict enforcement and punishment agent for members of its own industry’.Footnote 53 While the industry currently has an interest in strong regulation, it may not always do so, and it may respond differently to new developments than would states or formal regulators. Again, it is questionable whether or not an industry concerned with the provision of potentially lethal force should be the first allowed to experiment with self-regulation.
There are further problems with both the Montreux Document and the ICoC. First, neither seeks to control conventional ‘mercenaries’ of the type involved in the 2004 coup attempt in Equatorial Guinea. The UN Working Group remains engaged in this process,Footnote 54 but its importance has been sidelined by the higher profile efforts to deal with PSCs. Second, the Montreux Document has, for the most part, let state governments off the tricky hook of domestically regulating the private security industry. The US has been forced by scandals to tighten its domestic rules about how and when PSCs can be deployed, as well as close the loopholes that prevented the prosecution of contractors in Iraq. However, the congressional approval system in the US is still problematic and geared mainly towards accepting contracts in other states, rather than taking contracts from other private actors.
In the UK, the Montreux Process has allowed the government to shelve the difficult question of how to regulate private security companies entirely. The Green Paper identified a number of potential routes for regulation, of which a system of licensing was deemed the most likely to be effective. British regulation did not proceed until 2009, when the new Labour foreign minister, David Miliband, announced that the UK government would require companies to sign up to a code of conduct as a requirement of joining an industry body. The government would then only contract with those companies that were members of the industry organisation, and members could be removed if they violated the code of conduct.Footnote 55
Tougher regulation would also be expensive to implement, and in the current fiscal climate this is probably impossible. Voluntary processes may well prove to be insufficient for the UK, which has been very lucky to avoid problems like those affecting the US thus far. But because the Montreux Document and the ICoC have cast backward and untied a complex regulatory knot related to PSC activity in international armed conflict, states are satisfied.
Implications and future problems
There are three main implications of the tendency among regulators dealing with the private security industry to ‘regulate the last war’. First, there is necessarily a lack of forecasting future problems, leaving two likely uses of PSCs unconsidered by current frameworks: the use of PSCs to defend ships against piracy and to perform humanitarian functions. Second, the combination of a fast-moving industry and slow-moving regulation has created the impetus for self-regulation, which is currently insufficient in this area. Third, shifting attention to informal international processes allows states to avoid difficult but essential domestic conversations about the role of private force.
The ICoC, the Montreux Document, and domestic approaches in the US and UK focus on the type of involvement common in Iraq and Afghanistan, and it is unlikely we will see an Iraq- or Afghanistan-style engagement in the short- to medium-term. As early as 2006, PSCs were considering the implications of the post-Iraq ‘bubble’,Footnote 56 and have actively sought new business. PSCs are considering, among other options, two main routes: growing their commercial business with contracts with private companies, particularly in the maritime security realm, and the protection and potential provision of humanitarian aid. The Montreux Document is silent on both these issues, and the guidelines set out in the ICoC do not really address these particular situations. The American regulation system would likely not apply as contracts will be under the threshold for congressional approval, and the UK has effectively opted out of regulating these areas by relying on the Montreux Document and the ICoC.
PSCs have been keen exponents of the need to protect shipping from Somali piracy in the Gulf of Aden and wider Indian Ocean. An oft-quoted statistic in the maritime shipping community is that no ship with a private security detachment on board has been attacked by pirates. While this may be true, there is a first time for everything and given that pirates have attempted to take naval vessels hostage (albeit usually by mistake) it may be by luck rather than design. Pirates do not seem to be deterred in all cases by superior firepower. Furthermore, the rules regarding the use of force at sea by private actors are murky in the extreme, and require carefully calibrated judgment. Unlawful shooting incidents in Iraq suggest that this judgment may be in short supply. Finally, a major issue confronting international navies in the region is the problem of mistaken identity, where navies have fired upon fishing vessels and killed innocent people. Again, this is a serious problem requiring careful consideration, and the decidedly chequered history of companies shooting aggressively does not bode well for how it might be solved.
PSCs also see a major market developing in the protection of humanitarian aid and workers in dangerous places. Non-governmental organisations (NGOs) have been increasingly willing to commit resources to very dangerous parts of the world, and the use of PSCs to facilitate this has resulted in considerable debate and controversy.Footnote 57 Some argue that the neutrality of NGOs has already been greatly compromised by the use of private security, while others see it as a necessary evil in order to deliver essential aid.Footnote 58 However, it is only a short step from protecting aid to arguing that companies have the capacity to deliver aid, which poses obvious challenges to norms of humanitarian aid. Whether or not a commercial company can deliver aid in a purely humanitarian fashion, untainted by commercial motivation or financial incentive, is highly debatable. Aid that is not purely humanitarian may mean that a private company is not protected by the relevant provisions of IHL that refer to humanitarian aid.Footnote 59 It appears as though some companies are considering just this direction.Footnote 60
In neither case is it clear which international rules apply and under what circumstances, and in both cases the use of force has the potential to cause considerable damage. The story of the evolution of private force and the efforts to control it strongly suggest that states and other regulators will remain complacent and convinced that they have the regulatory answers until a problem occurs, in which case they will have to begin again. The slow nature of regulation and the fast pace of changes in war means that by the time states have solved these new problems, further challenges will have appeared on the horizon. The fast pace of change in the PSC business, combined with pressure for regulation, has resulted in the growth of self-regulation and voluntary agreements.
We cannot expect states or other regulators to have a crystal ball and attempt to devise regulation that will cover all potential future manifestations of private force. However, what we can expect is that states that host PSCs consider seriously how to draw the lines around private force: what things are acceptable? And unacceptable? Answering these questions will go some way to providing guidance for future activities.
States have failed to consider that businesses have powerful incentives to evolve and find new markets when old ones disappear or are closed down. Regulators play catch-up in many different industries. The challenge of playing catch-up in the private security industry is that the main product, force, has more harmful potential than the main product of perhaps any other industry. Complacent reliance on international humanitarian law or voluntary agreements is both insufficient and worrying.
Conclusion
The tendency to regulate the last manifestation of private force will no doubt continue because of the nature of the problem. Two central issues have combined to make regulating the private security industry complicated. First, creating regulation, either at the domestic or the international level, is rarely a swift process even where there is considerable will and agreement about the need for, and type of, regulation. Second, PMSCs are agile businesses that swiftly evolve in response to market pressures.
Forecasting military change is never easy, and successful PSCs, like any successful business, swiftly respond to market incentives. The private military and security industry has shut down some aspects of business and explored others in response to changes in the market and the closing of some avenues, such as large-scale expeditionary wars in Iraq and Afghanistan, and the opening of others, such as the potential to offer maritime security services. PMSCs have demonstrated their ability to evolve, and to do so quickly, several times since the early 1990s. We should not expect that they will continue to remain static.
In fact, there is good reason to think that they will continue to evolve and seek greater opportunities. One of the consequences of the creation of a large number of PSCs during the Iraq era is that these companies now exist and will actively seek new work to avoid going out of business. Continued military downsizing will mean that further opportunities will emerge. In the UK, significant military cuts announced in 2011 were accompanied by an announcement that further support could come from the private sector.Footnote 61
Second, the regulatory process is, by nature, slow. Relevant parties must agree that there is a need for regulation, and agree on how to embark on regulation. In the case of PMSCs, there are a large number of relevant actors: states, NGOs, businesses that require security, international organisations, and the PMSCs themselves. Like many other industries that operate predominantly offshore, PMSCs will require both domestic and international regulation. A good analogy comes from civil aviation, which requires domestic and international legislation to ensure safety. However, the existence of two levels of potential regulation means that there are two processes that may respond too slowly or not at all to growing issues. States themselves are keen to ensure that they will be able to use PMSCs effectively, and have to design regulation that is ‘just right’ – neither too tight nor too loose – which is a further constraint on speedy regulation. Finally, other actors in the system, particularly NGOs and international organisations, have a troubled relationship with PSCs. Although PSCs are becoming increasingly essential for some operations, these actors retain concern about the notion of private security and issues PSCs might pose.Footnote 62 This complicated relationship has made regulation slower because of a need to demonstrate disapproval or concern and at the same time facilitate regulation that allows continued use of PSCs in the industry.
PMSCs themselves both help and hinder regulation. From the beginning, both PMCs and PSCs have been enthusiastic advocates of regulation, participating in nearly all significant regulatory efforts. This enthusiasm is laudable, but it must not be regarded as selfless. Both PMCs and PSCs have sought states as their main clients and regulation suits them well. It provides legitimacy, and can drive out competitors unable to meet regulatory demands. UK- and US-based PSCs often have particularly well-connected leaders, either in day-to-day operations or on boards, including retired generals and other senior military figures. These connections, combined with the fact that regulators are increasingly reliant on PSCs, makes arms-length regulation more difficult than it might need to be.
It is not surprising, given the definite need for regulation and its slow speed, that voluntary self-regulation has been the most successful avenue. The Montreux Process and the ICoC have proceeded more quickly and convincingly than more formal options. This is not surprising, given that in many other issue areas, states and other actors prefer non-binding informal agreements because they happen more swiftly and allow continued freedom to manoeuvre. The industry also has a stake in advocating this type of regulation because it provides legitimacy without undue constraint. However, while the Montreux Document and the ICoC are undoubted achievements, questions remain as to whether or not they will be sufficient. The Montreux Document does not clearly apply to the use of PSCs by private companies, such as those guarding shipping from piracy. Self-regulation via voluntary codes of conduct is probably not strict enough for an industry that deals in lethal force. Complete self-regulation, without any legislative teeth, is extremely rare: everything from medical associations and legal associations within states to transnational industries operating between states, either has self-regulation enabled by legislation or formal international regulation, often assisted by permanent supervisory bodies, as in the case of civil aviation. It is hard to imagine that this particular industry does not require at least as much oversight as transnational shipping. To conclude with a different cliché from the one with which this paper began: self-regulation can too easily be putting enthusiastic foxes in charge of the chicken coop, and cannot on its own do enough.
Given that it is quite likely that regulators will continue to regulate the last manifestation of private force, what can be done to ensure that there is some sort of regulation that at least has a chance of keeping pace with the dynamic private security industry? Effective forecasting of military change is very difficult, as the vagaries of state military planning often demonstrate. However, one simple feature has been missing from nearly all domestic discussions about private force and many international ones: the question of how much private force is a good idea, and what sorts of jobs we can envisage PSCs undertaking. This type of conversation can be too easily dismissed as academic, or difficult, but it is essential. If the main host states of PSCs, particularly the UK, seriously considered what they would like the future shape of the industry to be, then to an extent the industry could actually dictate the direction of that evolution, rather than being forced to respond to developments as they happen. In the US, regulators were forced to consider some of these questions in response to scandals caused by PSCs, and tightened up their regulation as a result; however, a similar and clearly articulated vision of the role states wish these companies to play would direct the opportunities available.
It is true that the private security genie is out of the bottle. At the moment, however, states are largely letting the genie do what it wants and then disciplining it for going too far, rather than setting the parameters for action from the beginning. A discussion about the appropriate role of private force might be difficult, and it might need to begin domestically, but it is perhaps the best chance of regulating an industry that is always likely to change faster than regulators can respond to it. States and other interested parties must work hard to avoid complacency and assuming that existing regulation is up to the job: the industry will evolve, and regulation must either set the parameters of that evolution or be prepared to be left behind as evolution occurs.
