Due Diligence Obligations of Conduct: Developing a Responsibility Regime for PMSCs

Abstract As non-state actors, PMSCs are not embraced by traditional state-dominated doctrines of international law. However, international law has itself failed to keep pace with the evolution of states and state-based actors, to which strong Westphalian notions of sovereignty are no longer applicable. It is argued that these structural inadequacies stand in the way of international regulation of PMSCs, rather than defects in international human rights and humanitarian law per se. By analyzing understandings of legal responsibility, where such structural issues come to the fore, it is argued that, rather than attempting to resolve the essentially ideological dispute about the inherent functions of a state, regulatory regimes should focus on the positive obligations of states and PMSCs, and the interactions between them. Applying the results of this analysis, current and proposed regulatory regimes are evaluated and their shortcomings revealed.


Introduction
This article puts forward an analysis of two main international legal approaches that are emerging as part of an effort to regulate the activit ies of private military and security companies (PMSCs). PMSCs are nonstate actors that have an increasing role and impact on conflict and post-conflict zones around the globe. One approach, the Montreux Process, is based on non-binding (soft law) international instruments: 1 the Montreux Document of 2008 applicable to participating states, 2 and the International Code of Conduct of 2010 applicable to PMSCs. 3 The second approach is based on the development of a hard (binding) law regime that would, if in force, be applicable to states and international organizations. This type of hard law is exemplified in the UN Working Group on Mercenaries' Draft Convention put before the Human Rights Council in 2010. 4 These regulatory initiatives are considered through the lens of the law of responsibility, an area of international law concerned with the ''incidence and consequences of illegal acts, and particularly the payment of compensation'' and other remedies for loss caused. 5 Traditionally, international law has been concerned with legal responsibility for the internationally wrongful acts or omissions of states*the traditional actors in international relations. This article examines the responsibility of states, for example when they contract with PMSCs, but it also covers institutional as well as corporate responsibility for acts or omissions that violate international law. By covering these three actors*both state and non-state*the article investigates whether the Montreux Process (within which is included the International Code of Conduct) and the Draft Convention can work together in a complementary way as regards issues of responsibility and accountability. In so doing, it considers the law of state and institutional responsibility as developed by the UN's International Law Commission (ILC), which, though not formulated in treaty form, is customary binding law or has the potential to become such. The article also considers the soft (non-binding) law of corporate social responsibility (CSR), particularly as developed by John Ruggie, former Special Representative of the U.N. Secretary-General on the issue of human rights and transnational corporations and other business enterprises. 6 Although customary and treaty law binds international legal persons*states and intergovernmental organizations*norms of CSR operate at the level of non-binding soft law directed at entities such as PMSCs that do not have international legal personality.
A note of caution: this article does not try to find unity where there is none. The author is well aware of the divisions that exist between those supporters of the Montreux Process and those of the Draft Convention, 7 but this does not necessarily mean that the outcomes of these two processes should automatically be in conflict with one another. 8 The focus of the analysis will not be so much on mechanisms of accountability, though they will be mentioned, but on the issue of where legal responsibilities lie. Furthermore, rather than analyzing the criminal responsibility of an individual working for a PMSC, this article considers which entities are jointly or severally responsible for that wrong. Those in the frame for the purposes of this article are: the company or corporate actor itself, the state or organization that contracted with the PMSC, the state in which the PMSC is registered, or the state in which it is working. Of course a complete review of all forms of responsibility would include possible individual criminal responsibility of contractors, 9 but even robust and Nigel D. White effective national and international mechanisms for determining individual criminal responsibility will not, by themselves, make up for the lack of accountability for violations of international law committed by those working for PMSCs. To build an accountability regime for PMSCs solely on the basis of individual criminal responsibility would be akin to relying on courts martial or criminal trials to address the responsibilities of the U.S. and the U.K. for prisoner abuse in Abu Ghraib and Basra during the military operations in Iraq, following the invasion of that country in March 2003. In the case of the U.K., the conviction of one soldier for war crimes in relation to the death of Baha Mousa in a British detention center in Basra was clearly inadequate to address the responsibility of the army and, ultimately, of the U.K., for prisoner abuse. 10 Such inadequacy is evidenced by the need for a public inquiry, 11 and by the proceedings against the U.K. before English courts for violation of the right to life and then before the European Court of Human Rights. 12 Compensation has also been paid by the U.K. government 13 and further criminal prosecutions may follow from the findings of the public inquiry.
Ethically speaking, though individual criminal responsibility can go toward satisfying the needs for retribution as well as deterrence, it fails to address fully the range of moral as well as legal responsibilities that arise from breaches of international law. For these reasons the iconic statement of the Nuremberg Tribunal in 1946*''crimes against international law are committed by men, not by abstract entities, and only by punishing individuals who commit such crimes can the provisions of international law be enforced'' 14 * oversimplifies, as Andre Nollkaemper argues, ''the relationship between individual and state.'' 15 As regards the actions of individuals like Adolf Eichmann in Nazi Germany, such crimes occurred, and could only occur according to Hannah Arendt, within a ''criminal state''; 16 in other words, both individual and state bear responsibility for the sort of systematic and egregious crimes committed. The same analysis is applicable to human rights violations, and is reflected in the fact that human rights are embodied and protected in international law and are not necessarily guaranteed in the national legal systems of all states. Given that states (and international organizations) are committed to protect and uphold human rights at the international level, they must bear responsibility in international law when they are violated. Furthermore, as Nollkaemper notes, the ''remedies for state responsibility and for individual responsibility are different,'' with the latter involving the punishment of individuals and the former involving reparations, though there can be overlaps between the two. 17 In order to address the responsibilities of states, organizations, and corporations (in the form of PMSCs) this article initially considers how international law defines and delimits their responsibilities. In so doing, it highlights the substantive weaknesses of international law in attributing the wrongful acts of private actors to either the states or organizations employing them or otherwise having interaction with them. Furthermore, it highlights the structural weaknesses of international law in not imposing obligations directly on PMSCs as nonstate actors. Given these circumstances, the article turns to consider whether the nebulous concept of due diligence, which applies in differing forms for the various actors, can provide a robust enough framework upon which accountability can be built. The article concludes by looking at whether the Montreux Process and the Draft Convention can work separately or together to develop responsibility and accountability of states, organizations, and PMSCs for internationally wrongful acts committed by PMSCs and their employees.

The Responsibility Matrix
Business corporations such as PMSCs, states, and international organizations are all, in a conceptual sense, corporate actors relying on individuals to carry out their will, and so all raise problems in attaching responsibility. Certainly there is difficulty in attaching criminal responsibility to these entities. The Rome Statute on the International Criminal Court covers neither corporations nor states, only ''natural persons.'' 18 Although the notion of criminal responsibility is underdeveloped at the international level (apart from individual responsibility for certain core crimes), there are developed and developing rules on state and institutional responsibility. As international actors possessing international legal personality, states and intergovernmental organizations (formed by states) are responsible for wrongful acts committed by them or attributed to them. Unfortunately, when it comes to corporations, which are non-state actors established under national private law, international law does not generally recognize their responsibility, at least not in the same sense as state or institutional responsibility.
The U.N.'s International Law Commission (ILC) has produced sets of articles on state and institu-tional responsibility (the latter still in draft form). Unfortunately they are rather abstract and reveal inconsistencies and differences of approach. States and organizations are very different*organizations have neither territory nor population over which they have jurisdiction, and furthermore do not possess a monopoly on the use of force and the capacity to enforce it by police and military means. 19 This should signify that the rules as to when an organization is responsible should be different from those that apply to a state, but although there are differences between the two sets of articles (for example, on attribution of conduct), they do not fully reflect the differences between the two types of international legal persons. Setting aside these differences, the responsibility of states and organizations is conceptually of a different order from the notion of CSR that is being developed at both national and international levels.

State Responsibility
When considering the wrongful acts of PMSCs and the rules of state responsibility, the ILC's Articles on State Responsibility of 2001 indicate Nigel D. White that the state is responsible for those wrongful acts in three possible separate circumstances. First, when PMSCs are incorporated into the armed forces, so becoming a part of a state organ (Article 4); second, if PMSCs were exercising elements of governmental authority (Article 5); or third, where, in the absence of the first or second circumstances, PMSCs act under the instructions, direction, or control of the state in carrying out that conduct (Article 8). The first two grounds are less likely to be applicable than the third* PMSCs are unlikely to be fully incorporated into the armed forces of a state since this would seem to negate the whole idea of outsourcing. Furthermore, there is an ideological dispute as to what are the inherent functions of a state. This dispute is revealed in the differences on permissible forms of outsourcing found between the Draft Convention and the Montreux Document.
The premise underlying the approach contained in the Draft Convention is that there are inherently governmental or state functions that should not be delegated or outsourced. 20 This is based on a certain understanding of the role of the state, a view that might not be shared by all governments, especially those with the most aggressive approaches to privatization. It contrasts with the Montreux Document, which identifies only prohibitions on contracting states outsourcing activities that international humanitarian law assigns to states (such as exercising the power of the responsible officer over prisoners of war or internment camps). 21 The Draft Convention defines inherent state functions broadly on the basis that they are ''consistent with the principle of State monopoly on the legitimate use of force,'' and cannot be outsourced or delegated to non-state actors. These functions include: direct participation in hostilities, waging war and/or combat operations, taking prisoners, law-making, espionage, intelligence, knowledge transfer with military, security and policing application, use of and other activities related to weapons of mass destruction and police powers, especially the powers of arrest or detention including the interrogation of detainees. 22 Although the Montreux Document views PMSCs as civilians and frowns upon them directly participating in hostilities (though not directly prohibiting them from so doing), 23 it assumes that all services, other than the ones assigned to states under international humanitarian law, can legitimately be performed by such actors. The Montreux Document states that military and security services include, in particular, armed guarding and protection of persons and objects, such as convoys, buildings and other places; maintenance and operation of weapons systems; prisoner detention; and advice to or training of local forces and security personnel. 24 Thus there are clear problems in compatibility between the Montreux Document and the Draft Convention as regards combat roles and other functions performed by PMSCs away from the front-line including detention.
The problems in determining the inherent functions of a state leave the ''control test'' under Article 8 of ILC's Articles as the most relevant and applicable one for attribution of PMSC conduct to a state. This test is said to be a strict one (requiring effective control of the conduct in question), and reflects the jurisprudence of the International Court of Justice in the Nicaragua case of 1986, 25 and the Bosnia case of 2007. In the latter case, the International Court dismissed lesser forms of control by saying that a state is ''responsible only for its own conduct, that is to say the conduct of persons acting, on whatever basis, on its behalf.'' 26 Assuming that a state contracts with a PMSC to perform functions such as escorting aid convoys and, furthermore, agrees with the PMSC that force can be used to protect those convoys, when lethal force is used it could be argued that the PMSC is acting under the instructions of the state, making the state directly responsible for the ensuing deaths. The doubt about this argument is in the formulation of the control test, which requires that the state has to be in effective control of the actual act, conduct, or operation in question. This is a high threshold to cross. 27 Although it may be argued that a contract for services should be construed as giving instructions to PMSCs, there could be doubt about whether those instructions were given in relation to the conduct or operation in question. Certainly in the Montreux Document, the participating states made it clear that, in their view at least, ''entering into contractual relations does not itself engage'' state responsibility; and that state responsibility would only be engaged if the PMSCs were part of the armed forces of the state, or were empowered to exercise governmental authority, or were ''in fact acting on the instructions of a State (i.e. the State has specifically instructed the private actor's conduct) or under its direction or control (i.e. actual exer-cise of effective control by the State over the private actor's conduct).'' 28 The Draft Convention simply refers to the ILC's Articles on State Responsibility of 2001 in its preamble, and so could be said to have incorporated the rules on attribution (including Article 8 on private conduct). This all suggests that there has been no loosening of the rules on attribution of private conduct to a state, making it very difficult in reality to establish that a contracting state is directly responsible for the wrongful acts of PMSCs. Given that this seems to be the position for the contracting state, it is even less likely that the home state or the host state will be in effective control of the PMSC conduct in question to allow for direct attribution of any wrongful conduct to those states.

Institutional Responsibility
Turning to an international organization's relationships with PMSCs, the latter could either be directly contracted with for services (for example, to provide humanitarian aid or even carry out peacekeeping functions) or may come within a peacekeeping operation when attached to a country's military or civilian component. Peacekeeping operations are normally composed of contingents from troop-contributing nations (TCNs), and some of those TCNs may well be supported by PMSCs under governmental contract. 29 In these two different sets of circumstances attention should be paid to the ILC's 2011 Draft Articles on Institutional Responsibility. 30 In this document, the issue of attribution of the acts of private actors is somewhat different from the rules on state responsibility. Those PMSCs Nigel D. White directly contracted with by an organization could potentially fall under draft article 5, which considers that the conduct of an ''organ'' or ''agent'' of the organization in performance of its functions shall be an act of the organization. Draft article 2's definition of ''agent'' was narrowed from earlier versions to mean ''an official or other person or entity, other than an organ, who is charged by the organization with carrying out, or helping to carry out, one of its functions, and thus through whom the organization acts.'' The tightening of the definition came after the U.N. Department of Legal Affairs expressed concern that, without the addition of a functional limitation, the ''definition of an agent could have been perceived as being so broad as to expose us to unreasonable liability in respect of persons or entities over whom we have little or no control, and who do not carry out the functions of the U.N., but rather provide goods and services which are incidental to our mandated tasks,'' specifically referring to contractors. 31 This follows the U.N.'s own internal law on contractors, which indicates that the UN does not view them as ''agents'' of the organization. 32 In the case of PMSCs working for TCNs within a peacekeeping operation, once again the draft articles do not provide great clarity, even though they adopt, in draft article 7, an effective control of conduct test for state organs (which would cover national military contingents) placed at the disposal of international organizations. This would suggest that as an effective control test applies to regular troops, the same would apply to PMSCs. But again the issue has not been settled because practice indicates that the UN accepts responsibility for the conduct of peacekeepers even when it cannot be said to be in effective control. 33 A looser form of control for multinational forces under UN mandate was* albeit controversially*accepted by the European Court of Human Rights in the Behrami case of 2007. In its decision, the court imputed responsibility to the U.N. for the conduct of French troops in Kosovo on the basis that the U.N. retained ''ultimate authority and control'' over the operation. 34 Disputes in international legal doctrine about the nature of the control test for the attribution of acts of private actors are set to continue and reflect the failure of international law to keep pace with changes in the structure of states and organizations.

Acts of State and Organizations in a Post-modern World
Thus*as with state responsibility, according to the ILC Draft Articles at least*attribution of the conduct of PMSCs to an organization requires a high threshold of control to be crossed. 35 Though there are doubts about the ''effective control of conduct'' test for attribution to states and organizations, 36 the majority view supports the effective control test and dismisses any deviation from it as wrong. 37 However, as well as misrepresenting the way in which organizations exercise authority, the orthodox effective control test, as a depiction of acts of state, is inaccurate. The orthodox doctrine of international law*that conduct can constitute an act of state only if the state is in effective control of such conduct*arguably fails to understand how many post-modern states Due Diligence Obligations of Conduct: Developing a Responsibility Regime for PMSCs currently operate. In such a state* for example, the U.K.*many functions that were traditionally performed by organs and employees of the state, such as running prisons, prisoner escort, and protection services, are outsourced to private companies. Furthermore, in such states there may be greater outsourcing and privatization in some areas, such as security, than in others, such as health or education. Different speeds of outsourcing are reflective of what is achievable politically and ideologically, rather than what is ethically acceptable. In areas in which outsourcing is deeply entrenched, and applying the orthodox test, the government is no longer in effective control of the conduct of private companies and is therefore not responsible. The alternative view is that the government, in the words of the European Court in Behrami, retains ''ultimate authority and control'' of these services, and should, therefore, accept responsibility.
The prevailing orthodox view of state responsibility is very much based on the concept of a strong sovereign state, one that retains a firm grip if not monopoly on the use of force. Though such states clearly still exist, international legal doctrine has failed to adapt to the increasing variety of modern, post-modern, and also pre-modern states. 38 In this vein, Neil Walker has cogently argued that within the European Union at least, a post-Westphalian phase of sovereignty*what he labels as ''late sovereignty''*has been reached. In this phase, sovereignty is ''no longer so widely or so confidently conceived of as part of the meta-language of explanation and political language''; rather, it is ''about a plausible and reasonably effective claim to ultimate authority'' or a ''representation of authority made on behalf of a society which is (more or less successfully) constitutive of that society as a political society, or as a polity.'' Thus it should be possible to ''imagine ultimate authority, or sovereignty, in nonexclusive terms.'' 39 In relation to developing states in the context of colonialism and decolonization, Antony Anghie has argued that the ''acquisition of sovereignty by the Third World was an extraordinarily significant event; and yet, various limitations and disadvantages appeared to be somehow peculiarly connected with that sovereignty.'' 40 Anghie's compelling thesis is that sovereignty in the Westphalian sense was not simply extended from European states to newly decolonized states; rather, colonialism helped to shape a new form of sovereignty for this new wave of independent states, one that is ''rendered uniquely vulnerable and dependent by international law.'' 41 Add to this Gerry Simpson's powerful analysis of the sovereign inequality that exists between great power states and ''outlaw'' states. 42 Thus current thinking about sovereignty indicates that it is not the construct upon which international relations is conducted, though unfortunately the repetition of the Westphalian concept of sovereignty in legal doctrine signifies that its influence remains in core areas such as state responsibility.
The notion of what is ''inherently governmental'' has been hollowed out by certain key states, 43 rendering the orthodox test rarely applicable to them, though unsurprisingly these states continue to support such a test Nigel D. White as it effectively allows them to outsource their responsibility as well as their functions. The same argument can be applied to an international organization such as the U.N. where the level of control of its operations involving state and non-state actors rarely reaches the threshold required by the orthodox test.
Although it is possible to object morally to the reduction of a state's inherently governmental functions on the basis, for instance, that even a minimal state should provide security and not contract it out (as this may lead to some citizens, or areas, within a state not being covered by security arrangements), 44 the fact of governmental hollowing out has been clearly established in the case of the U.S. 45 This has resulted in a reduction in democratic accountability (for example, little attention is paid in democracies to the loss of life of private military or security personnel, in contrast to loss of regular soldiers) and corresponds to an increase of corporate influence in government. 46 Not conceding that the moral argument has been irrevocably lost, this article argues that even in such a weakened condition the state still has positive obligations to prevent human rights abuse by corporate actors it contracts with, or those which are based or operating within its jurisdiction.

Corporate (Social) Responsibility
It is unsurprising that just as international legal doctrine has failed to keep pace with the changing nature of sovereignty of the main actors (states), it has also failed to fully accommodate non-state actors within the subjects of the international legal order. International organizations are the exception in this regard, for though they are non-state actors, they are formed by states, and states often dominate their institutional structures. Nevertheless, the separate international legal personality of intergovernmental organizations has been grudgingly accepted by states. 47 Individuals have acquired derivative rights under international human rights law, though the applicability and enforcement of those rights remain problematic. Furthermore, duties have been imposed on individuals under international criminal law.
Corporations, despite the huge power and influence of multinational corporations especially in the era of economic globalization, are in many ways barely touched by international law at least directly in the form of binding treaty or customary obligations. The U.N. Sub-Commission on Human Rights' ''Norms on the Responsibilities of Transnational Corporations and other Business Enterprises with Regard to Human Rights'' of 2003 were ultimately rejected because they purported to impose obligations on corporations under international law. John Ruggie, then Special Representative of the U.N. Secretary-General on business and human rights, dismissed the Norms' assertion of obligatory force to corporations as having ''little authoritative basis in international law*hard, soft or otherwise.'' 48 Interestingly, there has been a more recent attempt to revive the possibility of legally binding corporations. An earlier version of the Draft Convention on PMSCs would have enabled corporations to have become parties to it, but the version that finally saw the light  49 This limitation is despite the fact that states and private companies have been intimately entwined since the days in which Hugo Grotius worked for the Dutch East India Company in the seventeenth century, a company that, along with the British East India Company, was responsible for establishing colonies on behalf of the state up until the end of the nineteenth century. 50 The presence of private corporations at the heart of empire-building states seems to have been forgotten in the history of international law, which sees the nineteenth century as the period of absolute state domination. 51 Antony Anghie writes that, ''examined in the context of colonial history,'' the multinational corporations of the twenty-first century are ''in many respects successors to entities such as the Dutch and British East India Companies which, after all, had been central to the whole imperial project.'' 52 Bearing in mind the global reach of companies such as G4S, with over half a million employees operating in 125 countries worldwide, 53 the impact they have on states, especially weak or post-conflict states, is considerable.
Although there appears to be no conceptual barrier to accepting corporations as having international legal personality and therefore being capable of having rights and duties, progress in establishing this has been limited. 54 Instead, a softer form of regulation has emerged, labeled ''corporate social responsibility,'' which can be found in initiatives such as the U.N.'s Global Compact launched in 2000 55 and, more specifically, in the International Code of Conduct for Private Security Service Providers of 2010. John Ruggie has undertaken the conceptual and normative development of this form of responsibility.
Ruggie's ''Guiding Principles on Business and Human Rights: Implementing the United Nations 'Protect, Respect and Remedy' Framework,'' 56 endorsed by the U.N.'s Human Rights Council in June 2011, 57 represents the culmination of his work on this matter. Ruggie's Framework has three pillars. The first ''protect'' pillar refers to the state's due diligence obligations under the international law discussed below, namely its ''duty to protect against human rights abuses by third parties, including business enterprises, through appropriate policies, regulation and adjudication.'' The second pillar (the ''respect'' pillar) refers to CSR*that is, a corporation's own due diligence obligations arising from the expectation that responsible corporate actors ''should act with due diligence to avoid infringing the rights of others and to address adverse impacts with which they are involved.'' The third pillar (the ''remedy'' pillar) is the ''need for greater access by victims to effective remedy, both judicial and non-judicial.'' 58 Ruggie states that each pillar is an essential component in an inter-related and dynamic system of preventative and remedial measures: the State's duty to protect because it lies at the very core of the international human rights regime; the corporate responsibility to respect because it is the basic expectation society has of business in relation to human rights; and access to remedy because even the most concerted efforts cannot prevent all abuse. 59

Nigel D. White
Essentially Ruggie's Framework works within the structures and strictures of international law 60 as currently understood, by recognizing that proper accountability for human rights abuse will work only if a regime of CSR is underpinned by states fulfilling their duties under international law. As Sorcha MacLeod observes, Ruggie's ''position is that only states are required to protect human rights while business actors are expected to respect human rights standards and to utilize due diligence in their commercial activities to ensure that the standards are observed.'' 61 In effect, Ruggie's approach could be summed up in simple terms of states being required to fulfill their due diligence obligations under human rights law to ensure that corporations within their jurisdiction, with whom they contract or otherwise control, operate with due diligence to avoid violating human rights and other applicable international laws. An elaboration of the different due diligence obligations of states, organizations, and corporations will be provided below, before analyzing the Montreux Process and Draft Convention to see if they could provide the combination that Ruggie identifies.

Due Diligence
Given the weaknesses of international law in imposing direct responsibility on states, organizations, or corporations for the wrongful acts of individuals working for the latter, the specter is raised of a legal black hole in which PMSCs operate with impunity despite the existence of human rights law and international humanitarian law. 62 The solution may take the form of due diligence, by which these actors have obligations to try to prevent misconduct. As Susan Marks and Fiorentina Azizi have written: ''especially in the context of human rights, it is often the State's failure to act*its failure to ensure protection, including protection against invasions of human rights by non-State actors*that is the problem.'' 63 Due diligence obligations are of conduct rather than result, meaning that the actors in question have to ''deploy their best efforts to achieve a desired outcome (which might be to prevent a given event), even if that outcome need not be ensured.'' 64 This gives the actors in question certain latitude in how to fulfill these obligations.
In the case of states, the different perspectives of home state (where the PMSC is based), host state (where the PMSC operates), and contracting state (which is purchasing PMSC services) need separate consideration. 65 In general, much of Ruggie's first pillar (the protect pillar) is directed at the state's duty to ''prevent, investigate, punish and redress private actors' abuse.'' Ruggie explains that though states ''generally have discretion in deciding upon these steps, they should consider the full range of permissible preventative and remedial measures, including policies, legislation, regulations, and adjudication.'' 66 Thus, in discussing the positive obligations of different states, and later organizations and PMSCs, there is a fair degree of leeway in how due diligence should be implemented.  67 the home state in which the PMSC is based should be responsible for knowingly allowing its territory to be used for unlawful acts against or in other states. Francesco Francioni cogently argues that the home state is in a good position to prevent human rights violations arising from the commercial export of security services because it is able to regulate the PMSC 'at the source' by virtue of the effective control it exercises over the centre of management of the company.
This strongly supports the need for both a licensing and a monitoring system to be established by the home state. 68 Unfortunately, there are common misunderstandings concerning the obligations of the home state. Ruggie's statement that states are not ''required under international human rights law to regulate the extraterritorial activities of businesses domiciled in their territory and/or jurisdiction'' 69 misses the point that though the direct provisions of national human rights law and criminal law may not apply extraterritorially (depending upon a particular state's approach to jurisdiction), this does not absolve the state from ensuring, within its territory and jurisdiction, that corporate actors fulfill their human rights obligations. This could be achieved through proper training, impact assessment, and so forth. Thus although it is accurate to say that states have no obligation under international law to apply and enforce their laws extraterritorially (unless they exercise control over another state's territory or citizens), they still have due diligence obligations within their own jurisdictions to ensure that corporations based there (including ones such as PMSCs that operate overseas) are human rights compliant.

Host States
In international human rights law, cases such as the Velasquez Rodriguez case before the Inter-American Court of Human Rights (IACtHR) and subsequent ones developed by other human rights institutions 70 have confirmed that the host state, in which private actors operate, has an obligation to exercise due diligence to protect anyone within its jurisdiction from human rights abuse, whether committed by state agents or private actors. As the IACtHR has stated, an illegal act which violates human rights and which is . . . not directly imputable to a State (for example, because it is the act of a private person or because the person responsible has not been identified) can lead to international responsibility of the State, not because of the act itself, but because of the lack of due diligence to prevent the violation or to respond to it as required by the Convention. 71 Undoubtedly, many host states will be in a weak conflict or post-conflict condition, but they must not turn a blind eye to human rights abuses by private actors within their territory and therefore must try to bring the perpetrators to justice with the resources available to them. In addition, Ruggie suggests that where the host state is weak and unable adequately to protect human rights, the home state of any transnational corporation involved should also endea-Nigel D. White vor to ensure that the corporation is not involved in human rights abuse. 72

Contracting States
In addition to the possibility of directly imputable conduct discussed above, contracting states also have due diligence obligations. Ethically, it is the positive act of contracting for services with PMSCs that leads to wrongful acts being committed by their operatives; thus contracting governments should arguably bear responsibility above the home state, and certainly above the host state. Ruggie strongly argues that ''states do not relinquish their international human rights law obligations when they privatize the delivery of services that may impact upon the enjoyment of human rights.'' 73 His Framework lays down two principles that support this. Principle 5 declares that states ''should exercise adequate oversight in order to meet their international human rights obligations when they contract with . . . business enterprises to provide services that may impact upon the enjoyment of human rights''; and Principle 6 declares that ''states should promote respect for human rights by business enterprises with which they conduct commercial transactions.'' 74 There is jurisprudence from the various international and regional human rights systems to support the application of due diligence obligations to contracting states. 75 If a state is going to contract with a PMSC to help its troops in a foreign country, it should be prepared to ensure to the best of its ability that those contractors do not commit human rights abuses in that country. It is argued that due diligence obligations are necessary particularly when the contracting state does not itself assert effective national jurisdiction over such actors, beyond the enforcement of its contractual rights. This obligation would be strengthened further when the contracting state knows that the host state has a weak judicial system and enforcement mechanisms. Given that it is the contracting state that is responsible for the presence of PMSCs on the territory of another state, it would be incongruous for it not to have due diligence obligations when both the home and host state do. It might be argued further that, before it contracts with a PMSC for services to be rendered in the host state, the contracting state has a duty to ensure that the host state has satisfactory laws, courts, and enforcement mechanisms for holding PMSCs to account for human rights abuse if it is not prepared to assert jurisdiction over them itself. If such criteria are not met then the state should not contract with the PMSC in question. In this way it is contended that a contracting state has a positive obligation to undertake a human rights impact assessment of its decision to contract services to PMSCs or, alternatively, it has to have in place processes that give it confidence that the PMSC itself will undertake its own full impact assessment.

International Organizations
As an international legal person, bearing rights and duties under international law, 76 an international organization such as the U.N. or EU*that either contracts with a PMSC for the delivery of services, or mandates and commands a peace-Due Diligence Obligations of Conduct: Developing a Responsibility Regime for PMSCs keeping force consisting of TCNs with PMSC support*cannot deny that it owes due diligence obligations under customary international law to ensure that the private actors it has contracted with or mandated either directly or indirectly do not violate human rights or international humanitarian laws. For example, the U.N. could achieve this through its own accountability mechanisms such as the Office of Internal Oversight Services (OIOS) in relation to directly contracted PMSCs; 77 or through its agreements with TCNs; or through the U.N. Secretary-General as commander of peacekeeping forces in relation to PMSCs working within U.N. mandated and commanded peace operations.

PMSCs
Although the due diligence obligations of states and organizations are binding customary obligations in international law, because corporations are not subjects of international law, any due diligence commitments they may have are non-binding outcomes of exercises in CSR. Although they are not subject to direct obligations under international law, corporations will be governed by national laws adopted by states in fulfillment of their human rights obligations to ensure that private actors within their jurisdictions do not violate human rights law. In this sense corporations would be wise, and would be expected, to respect human rights. This sense of CSR is the one used in Ruggie's Framework*for instance, in Principle 11, which states that ''business enterprises should respect human rights,'' meaning that ''they should avoid infringing on the human rights of others and should address adverse human rights impacts with which they are involved.'' 78 According to Ruggie, the relevant human rights standards are to be found in the Universal Declaration, the International Covenants and eight core ILO Conventions. 79 As explained above, although these standards are not binding directly on corporations under international law, such actors are expected to comply if they want to avoid adverse publicity and reputational consequences, as well as government action against them under applicable national laws.
The nature of corporate due diligence is illustrated by the International Code of Conduct for Private Security Service Providers of 2010. In subscribing to the International Code companies recognize that they must act ''with due diligence to avoid infringing the rights of others.'' 80 More specifically on this requirement, the International Code provides that signatory PMSCs will exercise due diligence to ensure compliance with the law and with the principles contained in this Code, and will respect the human rights of persons they come into contact with, including, the rights to freedom of expression, association, and peaceful assembly and against arbitrary or unlawful interference with privacy or deprivation of property. 81 The due diligence requirement emphasized in the code of conduct is not by itself a binding obligation on PMSCs 82 *this is in contrast to the due diligence obligations placed on states and organizations by international law. This significant limitation is made clear in the International Code of Conduct when it states that it ''creates no legal obligations on the Signatory Companies, beyond those Nigel D. White which already exists under national or international law. Nothing in this Code shall be interpreted as limiting or prejudicing in any way existing or developing rules of international law.'' 83 In a way this is akin to the Montreux Document, which is not a binding treaty and creates no new obligations on states. However, unlike the International Code of Conduct, the Montreux Document is based on an understanding of existing international legal obligations on states 84 whereas there are no such underpinning obligations on corporations in international law.
Nevertheless, Ruggie's Framework of 2011 contains a number of principles that help to flesh out the components of a corporate human rights due diligence process, which ''should include assessing actual and potential human rights impacts, integrating and acting upon the findings, tracking responses, and communicating how impacts are addressed.'' 85 More specifically, according to Ruggie, corporate due diligence should cover human rights impacts caused by businesses through their activities or directly caused by their operations. In addition: . it should be an ongoing process that varies with the size and type of business; . it should draw on internal and external human rights expertise and should involve meaningful consultation with potentially affected groups; . it should involve the effective implementation of the findings of any human rights impact assess-ment by assigning responsibility within the business but also by ensuring that decision-making and oversight mechanisms are designed to respond to such impacts; . it should include proper verification that human rights impacts are being addressed by businesses in tracking the effectiveness of their responses to impacts on individuals and groups, which can be done by obtaining feedback and by using indicators, surveys, and audits; . and, finally, it should include effective communication by corporations of how they address human rights impacts*meetings, online dialogues, consultation, and formal reports are all suggested. 86 Although responsible corporations are expected to fulfill these requirements, states are required by their positive obligations in international law to ensure their fulfillment. In these terms this binary form of responsibility*corporate social responsibility and state responsibility*has certain structural weakness arising out of its dependency upon states having the primary legal obligation to ensure corporations act responsibly. This premise means that if a state is weak, or simply fails to recognize its obligations, the framework is undermined unless there is a mechanism at the international level that could help ensure that states take action to ensure that PMSCs do not violate human rights. With that in mind, this analysis turns to the current international regulatory initiatives.

The Montreux Process
This section contains an examination of the provisions of the Montreux Document and the International Code of Conduct (together forming the Montreux Process) to see how they address issues of responsibility, especially in furthering the due diligence obligations outlined above. The article will then turn to see how the Draft Convention would work if it came into force within the context of the existing Montreux Process.
In many ways, and despite leading analysis to the contrary, 87 the Montreux Document of 2008 is quite strong on due diligence content in the form of identifying obligations and good practices for states. In its first part, the document affirms the legal obligations, including ones of due diligence, under international humanitarian law and international human rights law, of home states, host states, and contracting states. 88 In addition to identifying ''hard'' laws binding under custom or treaty, the Montreux Document also lists ''soft standards'' in the form of 73 ''good practices.'' These good practices are detailed in the document's second part, and this list may lay the foundations for the regulation of PMSCs through contracts, codes of conduct, national legislation, regional instruments, and international standards. 89 In many ways the second part of the Montreux Document provides flesh to the due diligence bones of the first part, but its formulation in the form of good practices could be seen as recognition of the fact that due diligence standards may vary from state to state depending on their relationship to PMSCs.
What the Montreux Document does make clear in the first part is that all three types of states*home, host, and contracting*owe due diligence obligations to ensure respect for international humanitarian law by PMSCs and to give effect to their human rights obligations by taking appropriate measures to prevent, investigate, and provide effective remedies for PMSC conduct. 90 The second part then provides some detail of how these might be honored by states and here there is some variation, as expected, between the different types of state (though there is a large element of overlap in matters such as training). For contracting states, as well as indicating the procedures and criteria for selection of contractors, there is the expectation that the contract will include clauses and performance requirements to ensure respect for humanitarian and human rights law, and a stipulation that lowest price should not be the only criterion for selection. 91 For host and home states, good practice would require them to authorize PMSCs operating or based on their territories by having systems of licenses to be granted only after vetting of PMSCs as regards their policy statements, track records, monitoring and accountability systems, and training provision. 92 Although it can readily be construed as a significant contribution to recognizing the due diligence obligations of states, the Montreux Document has several weaknesses. First, it Nigel D. White 248 is not by itself obligatory for states. Although it invokes a mixture of hard and soft international law applicable to states, the Montreux Document itself is not in the form of a treaty and, as recognized in its preface, is therefore ''not a legally binding instrument and so does not affect existing obligations of States under customary international law or under international agreements to which they are parties.'' 93 Second, it is directed at states. The international law obligations identified and good practices proposed in the Montreux Document are mainly applicable to states, and, although PMSCs and their personnel do not completely escape from those provisions, 94 the document does not attempt to regulate the industry. Rather, it serves to remind states of their obligations when engaging PMSCs or allowing them to operate from or in their territories. Third, though human rights obligations are included, the focus of the Montreux Document is on the application of international humanitarian law to PMSCs in situations of armed conflict, when it is arguably more likely that PMSCs will be more readily deployed to post-conflict situations in which international human rights law is applicable.
Although the Montreux Document encourages national monitoring and supervision by home, host, and contracting states (including through licensing and accountability mechanisms), it does not itself establish any international mechanism for regulation of the due diligence obligations of either states or PMSCs. The Montreux Process has led to the development of the International Code of Conduct of 2010, which is premised on the creation of an oversight mechanism for corporations, but not for states, and thus may remedy the second of the weaknesses listed above.
The International Code of Conduct for Private Security Service Providers builds on the Montreux Document although the latter was directed at states. The Code of Conduct is directed at businesses, and is essentially an exercise in CSR as reflected in the preamble which refers to the ''Protect, Respect, and Remedy'' human rights framework for business developed by Ruggie. As explained earlier, in subscribing to the Code of Conduct companies recognize that they must act with due diligence. 95 More generally, in signing the code, PMSCs ''commit to the responsible provision of Security Services so as to support the rule of law, respect the human rights of all persons, and protect the interests of their clients.'' 96 The purpose here is not to go through all the Code of Conduct's provisions and consider whether they completely fulfill the due diligence requirements identified earlier.
In a sense that is not possible, given that due diligence is not by any means a precise science, but the indications are that the code has strengths in CSR terms. On applicable human rights standards, the code does have well-developed and quite specific rules on the use of force and on detention as well the following prohibitions: . on torture or other cruel, inhuman or degrading treatment; . on sexual abuse and gender based violence; . on human trafficking; . on slavery and forced labor; . on child labor; . and on discrimination. 97 Due Diligence Obligations of Conduct: Developing a Responsibility Regime for PMSCs 249 All of these deepen the Code of Conduct's human rights coverage. Arguably, though, the code should have covered all human rights standards, or at least those most applicable to PMSCs. The absence of any economic, social, or cultural rights is of concern because, for instance, the activities of a PMSC may well impact on cultural rights. The preamble to the Code of Conduct identifies the importance of PMSCs ''respecting the various cultures encountered in their work,'' 98 but does not develop due diligence standards in this regard. The code is explicitly stated to be the beginning of a process, the ''founding instrument,'' that will be built on by the development of ''objective and measurable standards for providing security services.'' 99 In developing standards for assessing human rights impact, cultural rights could and should be included.
The Code of Conduct requires signatory companies to exercise due diligence in the selection of personnel, which will include checks on the criminal and military records of individuals as well as reviewing their fitness to carry weapons. 100 Due diligence extends to the selection, vetting, and ongoing review of subcontractors, in relation to which the PMSC undertakes to take reasonable and appropriate steps to ensure that subcontractors select, vet, and train their personnel in accordance with the requirements of the code. 101 Signatory companies also agree on the training of personnel in ''all applicable international and relevant national laws, including those pertaining to international human rights law, international humanitarian law, international criminal law and other relevant criminal law.'' 102 Although there are also requirements for reporting of incidents of abuse, 103 there is little on PMSCs undertaking a proper assessment of their likely human rights impact, except for a very general statement that signatory companies ''take steps to establish and maintain an effective internal governance framework in order to deter, monitor, report, and effectively address adverse impacts on human rights.'' 104 Thus not all the due diligence obligations of corporations identified above in section 3.5 and contained in Ruggie's Framework are covered in the code.
In addition to management and training requirements, signatory companies agree to establish grievance procedures to address claims alleging failure to respect the principles contained in the Code of Conduct. Such procedures must be ''fair, accessible and offer effective remedies.'' 105 However, the creation of what is essentially a non-binding set of standards, one that businesses can choose to sign up to, can be labeled only as a means of selfregulation. All remedies will be at the whim of businesses, unless there is some form of supervision of the Code of Conduct either by an oversight body set up within the code itself or by states in fulfillment of their obligations under international law (a number of which are identified in the Montreux Document). Preferably, it would be both. Furthermore, in order to ensure that states fulfill their due diligence obligations, another level of supervision is required at the international level, established by states for states. Before looking at the proposal for this in the Draft Convention, we must first consider the oversight Nigel D. White mechanism for the industry as envisaged in the Code of Conduct.
The code, as originally adopted in 2010, is surprisingly light on regulation, though in the preamble an ''independent governance and oversight mechanism'' is envisaged, and a Steering Committee*consisting of a small group of stakeholders drawn from the industry, states (the U.S. and U.K.), and civil society*was established to develop such an oversight mechanism by November 2011. 106 The Steering Committee produced a Draft Charter for the oversight mechanism in January 2012 107 that envisaged a 12-strong executive board with equal numbers of members from industry, civil society, and states participating in the Montreux Process. This body would have competence over the oversight process to be operated by a secretariat including a chief of performance assessment (CPA). The CPA would have oversight over participating companies, including instances when a PMSC has committed a serious violation of the Code of Conduct. In such a case, the CPA would have responsibility for the development of a remediation plan. In-field as well as remote oversight and monitoring of PMSC compliance is envisaged. Sanctions for non-compliance are limited to suspension and expulsion by the board following a report from the CPA. 108 The strengths and weaknesses of the Draft Charter are readily apparent, especially the danger of the board being dominated by a small section of states and industry representatives. Furthermore, the sanctions at its disposal have not been proven to be effective in other codes of conduct. Nevertheless, the operation of the Draft Charter, assuming it comes into force, will determine whether it is a robust mechanism of oversight and accountability, or more of a symbolic form of CSR.

The Draft Convention
If the development of a regulatory regime for PMSCs were to stop at the Montreux Document and the International Code of Conduct, then, no matter how robust the CSR element, the state responsibility (SR) element would be inadequate, relying purely on states taking their due diligence obligations seriously. The current very limited regulatory regime put in place in the U.K., for example, where a large number of PMSCs are based, does not suggest that this will happen without some form of international regulation of states. 109 Although the Draft Convention on Private Military and Security Companies is a long way from seeing the light of day as a binding international treaty, this section contains an overview of some of its provisions in order to see how they address issues of responsibility and accountability. The Draft Convention was put forward by the U.N. Working Group on Mercenaries to the Human Rights Council in July 2010. The Draft Convention itself recognizes the value of codes of conduct, but declares that these are, by themselves not enough. 110 The rationale for some form of treaty regime is clear*that Due Diligence Obligations of Conduct: Developing a Responsibility Regime for PMSCs without proper supervision of states' positive obligations at the international level, there will not be a robust framework within which PMSCs will act in accordance with their due diligence obligations.
In general, the Draft Convention is restrictive on the types of activities that can be carried out by PMSCs. State responsibility is engaged if PMSCs undertake functions that would either be inherently governmental 111 or if they perform legitimately outsourced activities that violate the standards of international human rights law or international humanitarian law. 112 State responsibility is established for ''military and security activities of PMSCs registered or operating in their jurisdiction, whether or not these entities are contracted by the state.'' In addition to establishing the obligations of home and host state, the Draft Convention requires contracting states to ''ensure that the PMSCs it has contracted are trained in and respect human rights and international humanitarian law.'' 113 Furthermore, it is clear from the formulation of many of the provisions that the form of state responsibility envisaged is largely for failure to exercise due diligence over the actual or potential conduct of private actors within the jurisdiction of states (and organizations) parties to the convention. 114 State parties are required to take such ''legislative, administrative and other measures as may be necessary to ensure that PMSCs and their personnel are held accountable for violations of applicable national or international law.'' 115 Crucially, the Draft Convention requires that each state party ''ensure that PMSCs and their personnel apply due diligence to ensure that their activities do not contribute directly or indirectly to violations of human rights and international humanitarian law.'' 116 The Draft Convention provides a number of techniques for state parties to fulfill their positive obligations to ensure that PMSC operate with due diligence. Basically, these involve the criminalization of certain activities, on the one hand, and the regulation of PMSC activities, on the other. With respect to the former, each state party is required to create national laws prohibiting acts carried out by PMSCs that are in furtherance of inherently state functions or that violate either international standards (under international human rights law, international criminal law, and international humanitarian law) or other provisions of the Draft Convention (such as those limiting the use of firearms). Furthermore, according to the Draft Convention, unlicensed or unauthorized PMSC activities should also be made an offense under national law. 117 As well as mandating that states create legislation that can lead to punishment, the Draft Convention requires that state parties regulate the activities of PMSCs by adopting and implementing oversight laws. 118 The Draft Convention would require state parties to establish a comprehensive domestic regime of regulation and oversight over the activities in its territory of PMSCs and their personnel including all foreign personnel, in order to prohibit and investigate illegal activities as defined by this Convention as well as by relevant national laws.
To facilitate this, state parties are required to establish a register and/ or a governmental body to act as a Nigel D. White national center for information concerning possible violations of national and international law by PMSCs. State parties shall investigate reports of violations of international humanitarian law and human rights norms by PMSCs, ensure prosecution and punishment of offenders, as well as revoke licenses given under the national licensing system required by the Draft Convention. 119 The Draft Convention envisages national licensing regimes 120 that should cover trafficking in firearms 121 as well as the import and export of military and security services, 122 but there is little detail in the convention on whether licenses should be general to companies or specific to individual contracts. In addition, although the implementation of due diligence obligations allows states some choice, it may be necessary in any final version*in order to avoid the development of vastly different national licensing regimes and consequent problems of forum shopping*to specify some minimal conditions that rule out the possibility of a company being granted an open-ended and unsupervised license. 123 Such conditions could be developed in the jurisprudence of the Convention's Oversight Committee (discussed below), which is required to be kept informed about licensing regimes by those parties that import or export PMSC services. 124 The requirements that state parties have a register of PMSCs operating within their jurisdiction, that they establish a governmental body responsible for the register's maintenance, and that they exercise oversight over PMSC activities 125 are equally lacking in detail and again could lead to a very weak system of registration and licensing.
Supervision of the positive obligations of state parties would fall to the proposed Committee on the Regulation, Oversight and Monitoring of Private Military and Security Activities (Oversight Committee) consisting of international experts. 126 This committee would receive reports from state parties on the legislative, judicial, administrative, and other measures they have adopted to give effect to the Draft Convention, and the committee would make observations and recommendations thereon. 127 There are two further proposed methods of supervision and accountability by the Oversight Committee*an inquiry procedure and a conciliation process. 128 Having a range of potential avenues for resolving disputes and claims may help to ensure that accountability is possible even in the most sensitive of situations. Unfortunately, however, the focus of the inquiry and conciliation processes seems to be solely on states, and not on the victims of violations. 129 Having said that, in addition to a state complaints procedure 130 * which, if other human rights treaties are any guide, is unlikely to be used*the Draft Convention contains an individual and group petition procedure into which state parties may opt. Individuals or groups claiming to be victims of a violation of any of the duties contained in the Convention (by those state parties opting into the process) may bring a petition. This envisages complaints being brought against states for their failure to regulate and control PMSCs in fulfillment of their positive obligations under the Draft Convention.
The lack of direct forms of redress against PMSCs in the convention is remedied by the requirement that Due Diligence Obligations of Conduct: Developing a Responsibility Regime for PMSCs each party implements domestic legislation giving effect to the Draft Convention, thus giving complainants local remedies that must be exhausted before a petition is submitted to the Oversight Committee. 131 After considering petitions, the Oversight Committee shall forward its suggestions and recommendations, if any, to the state party concerned and to the petitioner. 132 Although the remedy seems weak, this is standard in this type of procedure, and, given the evidence from the various U.N. human rights committees, it can be successful if the Oversight Committee performs its tasks with impartiality and bases its decisions on accepted interpretations of international law. If the Oversight Committee manages to establish its legitimacy, its decisions will generally be accepted by state parties. It will then be the job of the governments of state parties to enforce these decisions against PMSCs based in or operating on their territory, or employed by them. 133

Right To An Effective Remedy
The dual combination of state responsibility and corporate social responsibility outlined above would facilitate the provision of remedial mechanisms and therefore facilitate access to justice for individuals. Such a view is supported by Ruggie's Framework in the ''Remedy'' pillar. The principles contained in that document require that states provide those affected by business-related human rights abuse within their jurisdictions with effective remedies. These should include ''apologies, restitution, rehabilitation, financial or non-financial compensation and punitive sanctions (whether criminal or administrative, such as fines), as well as the prevention of harm through, for example, injunctions or guarantees of non-repetition.'' Remedial avenues should take the form of both judicial and non-judicial mechanisms and fora*''courts (for both criminal and civil action), labor tribunals, National Human Rights Institutions, National [OECD] Contact Points, . . . ombudsperson offices, and Government-run complaints of-fices.'' 134 In addition to these burdens placed on states in fulfillment of their due diligence obligations, Ruggie also includes ''operational-level grievance mechanisms'' provided by corporations that are ''accessible directly to individuals and communities who may be adversely impacted by a business enterprise.'' 135 The presence of fair and effective remedies available from PMSCs for human rights abuses would reduce the need for victims to go through state procedures and, ultimately, to resort to the international level. The Draft Charter for an oversight mechanism for the International Code of Conduct put forward for consultation by the Steering Committee in January 2012 does give some positive indications by providing for supervision of the obligations in the Code of Conduct that all participating PMSCs have internal grievance procedures, and by allowing for individuals to bring complaints to the oversight mechanism alleging violations of the code. 136 However, the Draft Charter's provisions are Nigel D. White obscurely worded and seem to provide a great deal of leeway for PMSCs. In particular, the provisions present them with a chance, in the face of a complaint against them, to conduct an internal investigation and put forward proposals for remediation. Even more worryingly, it also allows the oversight mechanism itself to reject not only frivolous complaints but complaints that are too challenging due to the ''difficulties in establishing facts in the context of activities that take place in complex environments.'' 137 A reluctance to consider, let alone investigate, complex cases is not encouraging evidence of the type of CSR remedial mechanism envisaged by Ruggie.
The Draft Convention, on the other hand, does in general oblige states to provide the sort of remedies and access to them required by the ''Protect, Respect and Remedy'' framework and, furthermore, provides oversight and remedial processes at the international level. As outlined above, the Draft Convention generally envisages that such remedies will be found in the national systems of the contracting parties, with the Oversight Committee ensuring this through state reports and, where applicable, by allowing individual petitions. However, just looking at the international level, it is doubtful whether envisaging a right of individual petition to the Oversight Committee represents an ''effective remedy.'' The Draft Convention's protection of the individual victim at the international level is premised on the traditional paradigm of gaining the consent of states to an optional petition procedure, which is a supplement to remedies that the victim should gain (if the Draft Convention is in force for the state in question) before national courts and mechanisms. As it is, there is a recognition in the Draft Convention that a further remedial mechanism may be required at the international level, but it takes the form of a weak provision that requires states to ''consider establishing an International Fund to be administered by the Secretary General to provide reparation to victims of offences under this Convention and/ or assist in their rehabilitation.'' 138

Conclusion
The analysis in this article has shown that the Montreux Process and the Draft Convention (assuming the latter comes into being and enters into force) could either be rival or complementary regimes for the regulation of PMSCs. If rivals* each attracting a different set of stakeholders (states and non-state actors) 139 *it can be predicted that the Montreux Process will enhance the CSR of PMSCs whereas the Draft Convention will harden the SR of states (and the institutional responsibility of organizations). However, it is only if they emerge as complementary regimes, with the majority of the same states signing up for both, that the CSR regime of the Montreux Process can be made more effective by the SR regime of the Draft Convention. By themselves, neither sufficiently encompasses both CSR and SR elements. More particularly, Due Diligence Obligations of Conduct: Developing a Responsibility Regime for PMSCs neither fully addresses the relationship between these elements, which is necessary for a legitimate and effective system of regulation that will deliver access to justice for victims of human rights abuse by PMSCs. Without a supervised treaty regime to ensure that states fulfill their due diligence obligations under SR, there can be no assurance that states will ensure that corporations fulfill their due diligence obligations under CSR.
Until corporations are recognized as subjects of international law against which direct enforcement can be taken, any CSR regime for PMSCs, no matter how successful in its own terms, will not fully deliver justice and accountability for the simple reason that voluntary selfregulation (even with oversight) will primarily cover the good citizens of the corporate world and not the bad. Ensuring that states have strong national systems of accountability applicable to PMSCs, and providing international accountability mechanisms against states, is necessary to ensure that states fulfill these obligations. But, of course, this ultimately comes up against the weaknesses in all international regulation*that even though treaties provide for binding commitments for states, it is a decision of each state whether to become a party. Little can be done to change this given that a mandatory legislative decision of the U.N. Security Council on this matter is very unlikely and, in any case, is a hugely problematic way of making legitimate international law.
There is a great deal of work to be done, both to persuade those states that are behind the Montreux Process that an international treaty along the lines of a Draft Convention is necessary (and the recent meeting of the open-ended intergovernmental working group established by the Human Rights Council in 2010 shows how difficult this is going to be), 140 and to make the provisions of the Montreux Process and the Draft Convention compatible*for instance, in achieving clarity (via compromise) on what can and cannot be outsourced to PMSCs. Rather than the current approach adopted in the Draft Convention of prohibiting the outsourcing of inherently governmental functions, a compromise would be to recognize that certain functions such as combat, arrest, detention, interrogation, and intelligence gathering, are acts of states no matter who performs them. They therefore give rise to state responsibility. Under this approach the outsourcing of state functions is permitted but the outsourcing of state responsibility is not. If this agreement can be achieved, further work will still be required to ensure that the Montreux Process and the Draft Convention provide clear and interlocking due diligence obligations on all three actors*states, organizations, and PMSCs. One method of achieving this would be to bring the Draft Convention's due diligence obligations closer to the ''good practices'' detailed in the second part of the Montreux Document. The overriding purpose of any such developments must be to provide comprehensive provision for effective access to justice, through judicial and non-judicial means, for victims of abuse at the hands of PMSCs at both national and international levels.