In the past decade, state use of private military companies (PMCs) has greatly expanded, sparked in large part by U.S. reliance on contractors in the wars in Afghanistan and Iraq. But several of the most horrific human rights abuses of the wars exposed the absence of a regulatory regime governing the conduct of PMCs, prompting an international movement to establish some kind of legal framework to promote accountability. After years of diplomatic negotiations, this resulted in 2010 in the creation of the International Code of Conduct for Private Security Service Providers (ICoC), which delineates the obligations of private companies.1 The ICoC Association (ICoCA) was subsequently launched in September 2013 to certify that companies are meeting the Code’s standards.

But while the development of a monitoring body is encouraging, ICoCA suffers from a critical shortcoming: it lacks any kind of serious enforcement mechanism. Because most commentary has focused on the Code’s importance in codifying a new area of international law,2 few have recognized that ICoCA’s actual effectiveness hinges on the willingness of states to enact corresponding domestic legislation that can provide a system of enforcement. This Comment highlights this issue and argues that discrete domestic legal reforms modeled on the Foreign Corrupt Practices Act (FCPA) and International Traffic in Arms Regulations (ITAR) would enable the United States to galvanize compliance with the ICoC and ensure that the Association is able to serve its function.

Part I surveys the growth of private military companies and recent international efforts to regulate the industry. Part II argues that the ICoC suffers from the absence of a viable method of enforcement, and ICoCA, as it currently stands, provides an insufficient oversight mechanism. It shows how the alternative methods of enforcement that have been proposed thus far are either infeasible or of limited efficacy. Part III explores how the United States could bolster ICoCA through domestic legislation that draws from the approaches of the FCPA and ITAR. It also discusses how this could, in the long run, trigger changes in behavior on a global level.

I. the need for an international approach to regulation

After years of being maligned as mercenaries, private military contractors reemerged following the end of the Cold War. Weak states with few military capabilities turned to PMCs for help,3 and even the United States hired private firms to supplement its military operations in the 1990s in order to lower costs.4 This trend accelerated dramatically following the U.S. invasion of Afghanistan in 2001. Over the course of the Afghanistan and Iraq wars, the involvement of PMCs ballooned. Their role expanded from support activity to essential military functions, including combat,5 and by the later years of the wars, half of total U.S. personnel deployed in Iraq and Afghanistan were private contractors.6 However, this extensive involvement by private forces gave rise to some of the most heinous human rights abuses of the wars, including the 2007 Nisour Square shooting7 and the Abu Ghraib prison scandal.8 Upon coming to light, these incidents provoked domestic and international outrage and highlighted the legally ambiguous space in which contractors operated.

In response, the United States enacted several reforms to ensure that contractors were held accountable for their actions.9 The Military Extraterritorial Jurisdiction Act (MEJA), originally passed in 2000, was expanded in 2004 to allow contractors supporting Defense Department missions abroad to be prosecuted for crimes that would result in more than one year of imprisonment if they were committed within the United States.10 And in 2007, Congress amended the Uniform Code of Military Justice (UCMJ) to subject private contractors to the system of courts-martial should they engage in misconduct.11 Few individuals have been prosecuted under the new provisions, but the reforms went some way toward bringing U.S. military contractors under U.S. law.12

The issue, however, has grown well beyond the activities of contractors employed by the United States. The U.S. wars have changed the landscape elsewhere by giving rise to massive multinational PMCs and also legitimating their use. This global industry is now estimated to have gross revenue of over $100 billion per year,13 and these companies are not closing shop just because the U.S. wars are ending. Instead, these sophisticated enterprises have shifted their focus to other lucrative regions.14

For this reason, the absence of a clear legal framework to govern the conduct of multinational PMCs is highly problematic.15 Domestic legal reforms, such as those enacted by the United States, have helped to hold private contractors participating in U.S. military operations accountable, but they do little to regulate the global PMC industry for two reasons. First, MEJA and the UCMJ can only be used to prosecute individuals. When companies providing military services act illegally, no clear statutory basis exists to hold the whole company liable.16 Additionally, these laws fail to address the industry’s increasingly global presence. The United States is no longer the only, or even the primary, consumer for private security providers. Consequently, laws that impose liability only for misdeeds occurring alongside Department of Defense missions do not adequately constrain the conduct of PMCs abroad.

Accordingly, since the mid-2000s, the international community has sought to fill the void by constructing a global regime that can better monitor these companies, ensure compliance with human rights norms and international humanitarian law, and hold violators accountable. The first such effort was led by the Swiss government and the International Committee of the Red Cross, which resulted in the completion of the Montreux Document in 2008.17 The document provides a list of best practices that states should implement to manage PMCs.18 Forty-nine countries have become signatories to date.19 Yet Montreux’s efficacy has been limited both because it does not create any binding commitments and because it is directed at PMC behavior in armed conflicts, which constitutes only a fraction of PMC activities.20

Montreux was followed by a more ambitious multi-stakeholder initiative, which led to the creation of the International Code of Conduct for Private Security Service Providers. The ICoC outlines the obligations of private security companies under international law and specifies rules that ought to govern the use of force and vetting procedures for subcontractors.21 Unlike earlier initiatives, the ICoC has been signed by over 708 companies worldwide and has garnered significant support from states and nongovernmental organizations.22 The creation of the Code is a promising step in the effort to ensure that private military companies respect human rights and comply with international law. Nonetheless, its current effectiveness is limited because it lacks a viable enforcement mechanism.

II. the inadequacy of icoca

If the ICoC is to fulfill its goal of constructing a global governance system to regulate private military companies, it must be meaningfully enforced. The ICoC Association was launched in September 2013 in order to provide an oversight mechanism for the Code. States and human rights organizations lauded the formation of ICoCA as a groundbreaking step in regulating the industry. The State Department even announced that it “anticipates incorporating membership in the ICoC Association as a requirement in the bidding process” for all future diplomatic security contracts.23 Membership is open to all companies, civil society groups, and states that agree to adhere to the Code.

The Association is led by a Board of Directors empowered to monitor and certify the compliance of signatory companies.24 The Board is chosen by the vote of all members and consists of twelve individuals, with four members coming from PMCs, four from civil society organizations, and four from states.25 ICoCA’s charter calls for in-field assessments of company practices and consultation between the Board and companies whose practices are found to violate the Code.26 It also establishes a complaint procedure through which allegations of misconduct can be reported.27 While these are surely positive developments, it is difficult to see how they will be able to engender compliance with the Code’s strict requirements without any punitive mechanisms. The absence of a judicial body or forum where PMCs can be held accountable if they persist in violating norms makes adherence to the Code largely voluntary.

Various options have been proposed as alternative mechanisms to enforce the ICoC. The first of these is the adoption of a binding multilateral treaty that would require signatories to provide for domestic enforcement of the ICoC provisions.28 While such a treaty would likely be the most rigorous method of bolstering the ICoC, it is not a viable option for the near future. The international consensus that is required to achieve such a comprehensive treaty simply does not exist at this point, as demonstrated by the limitations of the Montreux effort.

Another option that has been floated is to leverage profits from government contracting to induce compliance with the Code’s provisions. Because the United States, United Kingdom, and United Nations have all made government contract awards contingent on company membership in ICoCA, some argue that the potential loss of business opportunities will deter companies from disregarding the Code’s obligations.29 While this is a significant incentive, it is insufficient for two reasons. Firstly, because of the shrinking defense budgets in the United States and Western Europe,30 the ability of the United States and its allies to sway the behavior of PMCs is limited. Many of the most lucrative business opportunities are likely to be found elsewhere,31 making the costs of losing U.S. and U.K. agency contracts minimal compared to opportunities available in other regions. Given that many of the countries increasing military spending have checkered histories with respect to human rights,32 this is particularly worrisome. It is unlikely that these states will follow the United States’s lead in requiring ICoCA membership for government contracts, especially if it results in higher prices. Consequently, many companies will simply opt to forgo the constraints of the ICoC. While the United States should continue to use its market power to leverage as much compliance as possible, this approach is therefore at best only a limited means of enforcement.

Secondly, relying solely on the market could allow PMCs to essentially self-regulate while using ICoCA to legitimize their activities, akin to what has previously occurred. Over the past decade, private military companies formed several industry associations to deflect criticism and improve standards.33 These associations put forth codes of conduct and were supposed to accredit member firms based on adherence to the codes. But in practice, their ability to regulate PMC behavior generally fell short of expectations. They maintained close ties to the executives running the companies,34 whose desire to increase profits for their companies conflicted with their ability to serve as effective market monitors.35 In the absence of any independent punitive power, many associations were essentially used to legitimize the industry and allow governments to bypass more rigorous checks, while leaving companies free to police themselves.36

ICoCA is better placed than these industry groups were to serve as an effective overseer, but without a stronger method of holding companies accountable for non-compliance, it risks a similar fate. Companies embraced the ICoC largely because their representatives were intimately involved in the drafting and discussion process.37 While the inclusion of these parties has been key to ICoCA’s success thus far, the dominance of PMCs in the Association risks sacrificing its independence. The overwhelming majority of the Association’s members are companies. Because all members vote to elect the Board of Directors responsible for overseeing the companies,38 the industry can exert significant influence over decisions regarding certification. With no potential for legal accountability, ICoCA could turn into another iteration of earlier industry associations.

The prospect of regulatory capture makes relying on the market insufficient to truly enforce the Code. For governments that have little interest in seriously regulating PMCs, which includes many of the countries increasing military spending discussed earlier, mandating ICoCA certification could allow them to claim compliance with international standards while forgoing meaningful checks on company behavior. And even for governments that have shown a genuine desire to prevent PMC misconduct, such as the United States and the United Kingdom, regulatory capture makes using market mechanisms illusory. If ICoCA membership is no longer a clear proxy for full adherence to the Code’s rigorous provisions, governments will still be forced to conduct individualized assessments before making contracting decisions. These kinds of case-by-case comparisons can suffer from inconsistency and inattention, and obviate the advantages of an institution such as ICoCA. Thus, relying on the market, while appealing, is inadequate to enforce the ICoC.

III. domestic enforcement to spur compliance with the icoc

This Comment therefore proposes a third approach, which aims to be more rigorous than market mechanisms of limited efficacy but more feasible than concluding a multilateral treaty. By strengthening the domestic legal framework governing the conduct of private military companies, the United States can assist international enforcement efforts and bolster the credibility of ICoCA. More specifically, legislation modeled after the Foreign Corrupt Practices Act (FCPA) and International Traffic in Arms Regulations (ITAR) can be used, respectively, to directly regulate U.S.-based PMCs hired by foreign governments and to indirectly regulate many foreign PMCs. While some foreign companies would still be able to avoid U.S. laws, establishing such a framework would both force many of the industry’s biggest companies to comply with the international norms and human rights standards outlined by the ICoC and lay the groundwork for the development of a more effective global regime.39

In the coming years, many PMCs based in the United States are likely to be hired by foreign governments.40 In order to hold them accountable for their actions on behalf of these governments, U.S. laws mandating adherence to ICoC standards41 must clearly apply to their conduct abroad. The FCPA demonstrates how this can be accomplished through an effective extraterritoriality provision—one that reaches all U.S. citizens, nationals, and residents, all U.S. companies, and all foreign companies that trade securities in the United States, regardless of the location of the illegal act.42 The FCPA criminalizes bribery of foreign officials and requires companies to keep detailed records of their transactions.43 It is rigorously enforced by the Department of Justice and Securities and Exchange Commission; violations of the law can trigger penalties of up to $5 million and twenty years’ imprisonment for individuals and $25 million for corporations.44 In recent years, the DOJ and SEC have also forced companies to disgorge profits earned through illegal transactions. This has resulted in record-setting penalties, including fines directed at Siemens for $800 million and Halliburton for $579 million.45 The DOJ and SEC have been able to impose these penalties because both U.S. companies and foreign companies that trade securities in the United States have assets in the United States that can be readily fined.

A similar approach could be used to hold U.S.-based PMCs liable for misconduct abroad. Authority could be given to the DOJ to pursue civil and criminal actions against companies that depart from ICoC standards and commit an offense. Litigation would be conducted under the purview of Article III judges, who would be responsible for determining whether a transgression had occurred. By making any legislation clearly applicable to both foreign and domestic activities of U.S. companies, lawmakers could counter the presumption against extraterritoriality.46 Because many of these companies have assets in the United States, coupling this extraterritorial scope with significant penalties for violations, as the FCPA did, would enable robust enforcement. This would ensure that companies that violate the Code are not only rebuked by ICoCA, but also held legally accountable. U.S. companies contracting with foreign governments would thereby be compelled to adhere to ICoC standards.

Regulating foreign PMCs with no financial presence in the United States poses greater difficulty.47 The FCPA model is not useful where entirely foreign PMCs contract with foreign governments. Because these companies are unlikely to hold assets in the United States, enforcing penalties for misconduct becomes challenging.48 Given this, a more effective approach is to indirectly regulate foreign PMCs, by using their reliance on the expertise of former U.S. military officers to induce them to abide by U.S. laws. ITAR offers a helpful framework for how to do so. The regulations implement the Arms Export Control Act49 and govern the import and export of defense-related products and services, including sensitive technology and munitions; violating the regulations can trigger hefty fines and imprisonment.50 One of ITAR’s key provisions prohibits Americans from training foreign militaries without State Department approval. Most PMC services, including non-combat and advisory functions, qualify as training foreign military forces and require State Department authorization.51 Yet this restriction on the activities of U.S. citizens is rarely enforced, because the Directorate of Defense Trade Controls, which is responsible for monitoring, is understaffed and overwhelmed with managing arms exports.52

The United States could shape the overseas conduct of some foreign PMCs by making State Department approval of U.S. citizens’ participation in PMC activity contingent on company compliance with ICoC standards. This could essentially be accomplished through agency action if greater resources were devoted to enforcement. U.S. persons seeking to provide defense services abroad already must obtain a State Department license to do so.53 The Department could establish a policy of only granting licenses to U.S. citizens who are working for PMCs that adhere to the ICoC and are accredited by ICoCA. To ease the administrative burden of this approval system, the State Department could maintain a list of compliant companies, which citizens could then rely upon in making employment decisions. Coupling this licensing system with the possibility of civil and criminal prosecution if individuals are caught evading restrictions could effectively prevent Americans from offering their military know-how to foreign companies that fail to meet international standards.54

Of course, this approach would not force foreign PMCs contracting with foreign governments to obey U.S. laws or hold them liable for failure to do so. Nonetheless, many foreign companies are heavily reliant on the unparalleled expertise of American former military officers.55 In fact, for most companies, their employment of highly trained former U.S. officers is their most compelling sales pitch for obtaining business.56 Consequently, while it is possible that some PMCs would choose to circumvent any restrictions by limiting their reliance on American personnel, this is unlikely to be the case across the industry. Many of the companies would likely opt to comply with ICoC standards in order to be able to continue hiring critical U.S. personnel.

Passing legislation modeled after the FCPA and ITAR would likely lead to changed practices in other countries as well. The FCPA helped bring about a dramatic change in attitudes toward corruption. Bribery has gone from being accepted as the cost of doing business in certain countries to being treated almost universally as unethical, illegitimate, and counterproductive for economic growth.57 This evolution in norms resulted in the passage of the OECD Anti-Bribery Convention in 1999, which has since been ratified by forty countries.58 The Convention requires signatories to enact domestic legislation criminalizing bribery of foreign officials and monitors each country’s subsequent execution. Furthermore, the FCPA has prompted U.S. companies to pressure other countries to pass analogous legislation so as to level the playing field for their own businesses.59 Together, these two developments have prompted widespread reforms abroad.60

While there are important differences between building a global anti-corruption regime and a PMC regulatory regime, the progress the FCPA has made illustrates how rigorous U.S. enforcement of ICoC standards could eventually galvanize greater enforcement abroad. By engendering greater compliance with the Code’s provisions, domestic legislation could solidify norms of behavior among PMCs. And by penalizing U.S.-based PMCs for violations, it could create a profit incentive for these companies to urge other countries to pass similar reforms. In conjunction, these changes could help bring about more effective global regulation of PMCs.

Although ITAR has had a more limited impact on the development of international norms because the regulations only apply to U.S. exporters, they have changed the behavior of many defense-related companies in a way that has had ripple effects throughout the industry. Because the regulations impose a duty on companies to come forward and disclose breaches of ITAR to the government,61 and impose significant penalties for failing to do so, many munitions manufacturers have implemented internal checks to more rigorously monitor compliance.62 Greater scrutiny of the activities of companies that train foreign militaries would likely spur similar norms of internal corporate policing among PMCs as well.

By using the FCPA and ITAR as models, the United States could provide for the first truly meaningful enforcement of the ICoC, and thereby hold PMCs accountable for a much wider range of activities than those covered by MEJA and the UCMJ. While current congressional gridlock makes passing this kind of legislation difficult, there are reasons to be optimistic that this proposal can nonetheless be implemented in large part. The FCPA was similarly ambitious and encountered significant opposition, but still managed to pass.63 And the alterations to ITAR could be enacted through executive orders instead of legislation, thereby circumventing the need for congressional involvement. In conjunction, these changes could in the long term trigger substantial changes in behavior globally.

Conclusion

The establishment of ICoCA is an important development in building a legal framework to govern the global conduct of PMCs. Yet it suffers from the same weakness that has hampered earlier efforts to regulate PMCs on a multinational scale: the absence of a viable enforcement mechanism. Through stronger domestic legislation that borrows from the approaches of the FCPA and ITAR, the United States could ensure greater compliance with the Code and bolster the credibility of ICoCA as it seeks to establish a global governance regime for PMCs.

reema shah*