The ICoC and Regulation of Private Maritime
Security Companies
Report on a meeting held in Geneva, 4 July 2014
Contact
Geneva Centre for the Democratic Control of Armed Forces (DCAF)
Nelleke van Amstel
Email: n.vanamstel@dcaf.ch
Tel.: +41(0)227309419
1
Background
Piracy and an increasing need for regulation of private maritime security providers
Over the past several years, there has been a steep increase in the number of piracy attacks
on commercial vessels, especially off the coast of Somalia, in the Indian Ocean, in the Gulf of
Aden; the Gulf of Guinea; and the South China Sea. While 2012 to 2013 saw a decrease in
the number of acts of piracy and armed robbery at sea, such attacks continue to present a
significant risk to the maritime sector.1States have responded in a number of ways, including
conducting naval operations against piracy, offering protection teams for vessels flying their
flags, and engaging in multilateral fora with a view to improving security on the high seas. At
the same time, there has been an upsurge in shipping companies hiring private maritime
security companies (PMSCs) to protect their vessels in high-risk areas.
States have taken a number of different approaches to regulate the provision of private
maritime security services. Some States prohibit any PMSCs on vessels flying their flag;
others have introduced – or are in the process of developing – national legislation setting
out criteria for PMSCs operating on vessels flying their flag or which are registered in their
territory. In order to guide these regulation processes, different international standards have
been developed against which PMSCs can be certified. In addition, several governments,
members of the private security industry and civil society have jointly developed the
‘International Code of Conduct for Private Security Service Providers’, which sets out
principles based on human rights and international humanitarian law as well as management
guidelines for private security service providers.
At this crucial point in the process to develop a sound regulatory system for PMSCs, there is
a clear need for increased information and experience sharing among States. For this reason,
the Swiss Federal Department of Foreign Affairs and DCAF convened the first meeting
between States and relevant international and non-governmental organizations in Geneva
on ‘The ICoC and Regulation of Private Maritime Security Companies’. The main objective of
the meeting was to present different approaches on the regulation of private maritime
security companies, and to share first experiences of States in this process. This report
provides a summary of key points emerging from this meeting.
Different national approaches to regulation of private maritime security companies
In broad terms, three different regulatory approaches were presented at the meeting. The
first approach, which has been adopted by some States including France and Germany,
consists of implementing a national licensing procedure for PMSCs – usually based on
internationally agreed standards – verified by national authorities. The licencing requirement
applies to all PMSCs based on this State’s territory as well as to foreign PMSCs wishing to
1
See International Maritime Organization. “Reports on Acts of Piracy and Armed Robbery at Sea – Annual
Report 2013.” MSC.4/Circ.208, 2013.
2
provide security services on a ship flying the State’s flag. Switzerland takes a different
approach, albeit it also requires all private security companies that are registered in
Switzerland providing private security services abroad to obtain authorization from the Swiss
authorities. However, granting such authorization depends not only on criteria incorporated
in national legislation but, inter alia, on membership of the ICoC Association, meaning that
the private security company conforms to all principles as set out in the International Code
of Conduct for Private Security Service Providers. A third approach is pursued by the United
Kingdom. This approach is based on voluntary certification to standards and membership of
the ICoCA. While the UK does not require companies to obtain authorization from a national
authority in order to provide private maritime security services, the UK promotes accredited
certification of companies under the ISO PAS 28007 standard and ICoC Association
membership as requirements that clients should ask PMSCs to have.
Based on the presentations given at the meeting in Geneva, the main aspects of these
national regulation mechanisms are summarized below.
Switzerland
Remy Friedmann, Swiss Federal Department of Foreign Affairs
Switzerland emphasized that its interest in the subject of regulating private maritime
security companies is primarily of a humanitarian nature. Following a joint initiative by
Switzerland and the ICRC, in 2008 a number of States endorsed the ‘Montreux Document on
pertinent international legal obligations and good practices for States related to operations
of private military and security companies during armed conflict’ (the Montreux Document).
While the Montreux Document was primarily developed to address the use of private
military security companies in armed conflict situations, it also emphasizes States’ human
rights obligations with respect to the regulation of private security companies. Human rights
law applies both during and outside of armed conflicts. Thus, international human rights law
and many of the good practices included in the Montreux Document can be of guidance for
the process of regulating private maritime security companies.
Building on the Montreux Document, Switzerland also supported a multi-stakeholder
process through which States, private security companies and civil society organizations
adopted the International Code of Conduct for Private Security Service Providers (ICoC). The
ICoC contains human rights and international humanitarian law principles as well as good
management practices for private security companies when providing security services in
complex environments. In 2013, the ICoC Association was established as a governance and
oversight mechanism for the Code. Switzerland emphasized that it considers the human
rights and IHL principles as contained in the ICoC relevant for the provision of private
maritime security services, and that piracy affected areas qualify as ‘complex environments’
to which the ICoC applies.
3
Switzerland expressed its hope that States that signed the Montreux Document will also join
the ICoC Association, or participate in an advisory forum that will be established pursuant to
article 10 of the ICoC Association’s ‘Articles of Association’. Requiring membership to the
ICoCA for PMSCs headquartered in or operating on their territory can help support States’
effective regulation of these companies. At the same time, it is important to reach out to the
shipping industry in order to communicate that the ICoC is relevant to private maritime
security services and to highlight the advantages of requiring ICoCA membership when hiring
such services.
Switzerland recently adopted the ‘Federal Act on Private Security Services Provided Abroad’,
which should come into force by mid 2015. 2 Under the Federal Act, private security
companies that are incorporated in Switzerland and provide private security services abroad
are obliged to adhere to the ICoC, meaning that companies are required to become
members of the ICoC Association. Under the Federal Act, Swiss companies that envisage
providing private maritime security services outside Switzerland have to announce this to
the competent Swiss authorities. Within 14 days, the competent authority will inform the
company on whether the company is permitted to proceed or whether the competent
authority sees the need for a more detailed examination of the company’s request. Reasons
for such examinations could be the provision of security services in complex environments.
The competent authority may prohibit the provision of private security services by Swiss
companies if, inter alia, companies do not respect the principles set out in the ICoC. Thus,
Switzerland uses the internationally agreed principles of the ICoC and the governance and
oversight mechanism as established by the ICoC Association as part of its regulation process
for private security companies. Similarly, if Swiss Federal authorities hire private security
companies for protection services abroad, these companies must adhere to the ICoC.
France
Captain (Navy) Erwan Roche, defence attaché of the permanent representation of France to
the UN
France explained that traditionally it has considered the provision of security services
outside its territory a State privilege. Initially, in order to protect vessels against pirate
attacks, France pursued a two-pronged approach. Firstly, France’s marine forces participate
in different anti-piracy operations in high-risk areas. Secondly, France has offered protection
to vessels passing through high risks areas by teams consisting of members of the French
armed forces. The provision of such teams has, however, proven difficult in practice due to
both the high demand as well as diplomatic difficulties when deploying members of the
armed forces in other States’ territories. Thus, in light of the factual need for the provision of
private security services on vessels flying the French flag, France has reconsidered the issue
2
The text of the ‘Federal Act on Private Security Services Provided Abroad’ is available here:
http://www.admin.ch/opc/de/federal-gazette/2013/7353.pdf
4
and recently adopted legislation regarding private protection activities on vessels.3 This law
both permits and regulates the provision of private maritime security services on board
vessels flying the French flag. The law does not affect the provision of private security
services on land outside French territory, which remains prohibited.
The recent French law on the protection activities on vessels permits the provision of private
security services against any external threats on board vessels flying the French flag when
navigating outside the territorial waters of another State. Thus, it does not affect other
state’s authority to regulate private security services on vessels in their territorial waters.
Under the French law, private security services are only permitted in specific high-risk areas
and only on certain vessels. In order to provide maritime security services on French vessels,
companies need to obtain authorization by public authorities. Requirements for obtaining
this authorization will be set out in a decree, which will also contain requirements for
certification according to existing standards. Generally, under the French law, and in
accordance with international law, the captain remains responsible for security on board the
vessel. The use of force by private security personnel is strictly regulated and only permitted
in self-defence. Similarly, the authorization for carrying and using arms is strictly regulated.
In order to ensure compliance, the French law foresees administrative controls ashore and
on vessels, and requires that any use of force is reported to the competent authorities.
Violations of the law can lead to administrative fines or prosecution under French criminal
law. France aims to operationalize this regulation system by the end of 2014.
Germany
Claudia Topp, Federal Office of Economics and Export Control
Since 2008, German armed forces have been involved in multilateral anti-piracy operations.
Due to the high number of piracy attacks on vessels and the fact that under the German
Constitution German soldiers are not allowed to provide security services on German vessels,
Germany decided to permit, in accordance with new regulation, the provision of private
security services on vessels flying a German flag.4 Germany’s approach to regulation of
private maritime security services was primarily driven by security concerns and by the
demand of ship owners for professional and reliable security services on their vessels.
In developing its regulation system with input from multi-stakeholder fora, Germany took
international standards into account but decided to go beyond industry self-regulation and
to base its system on a State-led licensing procedure combined with verification tools and
sanctions for possible breaches. In order to provide private security services on board of a
German vessel, or to provide private maritime security services from Germany, PMSCs have
3
The text of the ‘Loi relative aux activités privées de protection des navires’ is available here:
http://www.cnaps-securite.fr/wp-content/uploads/2014/07/Loi-n%C2%B0-2014-742-1-juillet-2014-APPN.pdf
4
The text of the ‘Ordinance on the licensing of security companies on ocean-going vessels’ is available here:
http://www.bafa.de/bafa/en/other_tasks/pmsc/publications/seeschiffbewvo_en.pdf
5
to obtain a licence. Companies can apply for this licence with the competent federal
authority, who in cooperation with the federal police evaluates the application. Obtaining a
licence depends on a number of requirements, including on sound policies on the
procurement, transport, loading, storage of equipment, vetting and training for personnel,
and knowledge of and the ability to comply with German laws, including on the use of force
which is limited to the right of self-defence in order to maintain the State’s monopoly on the
use of force. A licence to provide private maritime security services is normally granted for
two years, and fees depend on the complexity of the application and the required
administrative effort. First experiences have shown the necessity of the State-led regulation
as companies tend to exaggerate their expertise.
Licensed companies must notify German authorities of all deployments on vessels, any use
of weapons, important changes in company management and policies, and all loss and
replacement of weapons or ammunition. Companies are required to keep all relevant
records for three years. Violations of their duties can lead to administrative fines, to the
revocation of the license, and to prosecution under German penal law.
United Kingdom
Mark Bennun, United Kingdom Foreign and Commonwealth Office
Over the past several years, the United Kingdom has experienced an increasing demand for
and supply of private maritime security services. In line with its approach to implementing
the UN Guiding Principles on Business and Human Rights, the United Kingdom has decided
to pursue an approach of voluntary regulation of PMSCs. Under this approach, the United
Kingdom recommends that clients of private maritime security providers only contract those
PSCs that have accredited certification under the ISO PAS 28007 standard and that are
members of the ICoC Association. The aim of this approach is to make it a commercial
imperative for private maritime security companies to have accredited certification to a
recognised industry standard and to become ICoC Association members, thereby submitting
to monitoring by an independent mechanism at the international level. In addition to this
voluntary regulation of private maritime security companies, the UK has strict licensing
requirements for exporting arms and controlled goods and for carrying firearms.
The UK sees several advantages to this approach. The ISO PAS 28007 and the ICoC
Association are international instruments that are widely recognized. The ICoC was
developed in a multi-stakeholder forum, and the ICoCA is governed by a multi-stakeholder
Board of Directors. The UK’s independent national accreditation service has accredited four
professional certification bodies which can now audit and certify companies in accordance
with the ISO PAS 28007 standard. These certification bodies will verify that companies meet
all the requirements set out in this standard. In addition, the UK supports the ICoC
Association, which will provide continuous human rights oversight on private security
company’s activities. In the view of the UK, the human rights principles set out in the ICoC
6
clearly apply at sea. The UK aims to combine the auditing and certification expertise of the
certification bodies with the human rights and monitoring expertise of the ICoC Association.
This system will raise standards in the private security industry, and provide clear indicators
for clients on which companies provide reliable and responsible security services. If clients
support this system, there will be a compelling business incentive for companies to comply
with the ICoC and ISO PAS 28007. Some major PMSC clients have agreed to become
observers to the ICoC Association and support the UK’s regulatory approach and the UK will
continue to engage with clients to explain the benefits of this approach. In addition, the UK
urges all States to consider joining the ICoC Association and to recognise accredited
certification to industry standards and ICoC Association membership when contracting any
private security company.
Private Maritime Security Industry
Andrew Nicholson, Drum Cussac
From a company point of view, when considering regulation of private maritime security
companies by States, it should not be forgotten that PMSCs are commercial actors whose
primary concern is their commercial success. Hence, decisions by PMSCs are commercially
driven. While companies recognize the need for raising industry standards, the feasibility of
their meeting these requirements is also important. As certification under a national or
international standard requires a significant amount of resources (i.e. fees for obtaining the
certification, costs for auditors, costs for personnel implementing the standard in company
policies, and costs for personnel accompanying the certification process), most companies
cannot afford to be certified under several different standards. Thus, companies will seek
certification that is required by their clients and needed for their business activities. In this
respect, an important success factor for the regulation of PMSCs through legally non-binding
standards is client buy-in: if clients require certification to certain international standards,
this certification becomes a commercial imperative for PMSCs.
Currently, the market for PMSCs is difficult. The shipping industry tries to cut costs, and one
way of doing this is by saving money on security, for example by hiring companies that do
not adhere to important industry standards. If States make a particular certification
mandatory for security services provided on vessels flying their flags, vessel owners may
decide to change flags in order to be allowed to hire non-certified security companies. When
States require PMSCs to obtain certification under a unique national standard, this means
that companies have to undergo multiple certification processes in different States if they
want to provide security services on vessels flying different flags. This has significant
financial implications for companies. In this respect, requiring national certification can
restrict market access of private companies. If States require different national standards to
which companies need to be certified to operate in a specific market, this can even lower
industry standards as shipping and security companies move to States without strict
7
regulations. However, international standards and regulation mechanisms like the ICoC and
its Association are viable tools to raise standards globally in a way that it is feasible for
companies to comply with these standards. In order for these regulatory approaches to be
successful, not only State regulation but also the support of PMSC clients is vital.
Conclusion
The participation of numerous States as well as international and non-governmental
organizations in the meeting on ‘The ICoC and Regulation of Private Maritime Security
Companies’ underlines States’ interest in information exchange on the regulation of private
maritime security companies. As reiterated during the meeting, given the practical
challenges in providing security services to all vessels through States’ security personnel, the
use of private maritime security personnel has proven effective in protecting vessels from
piracy and armed robbery at sea.5 At the same time, States recognize the need to ensure
that PMSCs provide services in accordance with clear regulations, either defined nationally
or based on internationally agreed standards. Three different approaches to regulate PMSCs
were presented: a national licence based on national standards as well as international
standards incorporated into national law (France, Germany); a national authorization system
requiring private security companies to obtain authorization based on internationally agreed
standards, namely the ICoC (Switzerland), and a system favouring voluntary certification
under the ISO PAS 28007 standard and ICoC Association membership (United Kingdom).
The need for further exchange on the regulation of private maritime security companies has
also been emphasized in recent meetings among Montreux Document participants, who
decided to set up a committee on maritime security as part of the soon-to-be launched
‘Montreux Document Forum’. Switzerland and DCAF remain committed to focus on this
important security governance challenge, and to enhance information sharing among all
actors in order to contribute to an effective international regulation of private maritime
security services.
5
As one participant stressed, there has been no successful attack on a vessel that was protected by private
maritime security providers.
8