Beyond the Governance Gap: Accountability in Privatized Migration Control

Abstract

This Article focuses on the accountability challenges raised by the increased involvement of Private Military and Security Companies (PMSC) in migration control. I argue that migration control activities outsourced to PMSC can be classified as high-risk operations for the purposes of the application of relevant business and human rights standards. This reclassification of migration control activities as high-risk business operations, in turn, has two significant implications in terms of establishing accountability for PMSC’s wrongful conduct. First, it acknowledges that the privatization of migration control, especially within the context of continued containment and deterrence trends, entails a high risk of human rights abuses to which PMSC may contribute, both directly and indirectly. Second, this reclassification enables us to identify heightened obligations vested upon the home state of a PMSC, as well as the heightened responsibility of PMSC themselves. The article also examines what these heightened obligations and responsibilities entail.

A. Introduction

This Article focuses on the accountability challenges raised by the increased involvement of PMSC in migration control. The involvement of private non-state actors in the implementation of migration control operations is not a new phenomenon.¹ There is a long history, for instance, of “indirect privatization”² of migration control, whereby the relationship between the state and the company is not stipulated through a direct contractual relationship but through the imposition of civil or criminal liability. The first type of indirect privatization in the context of migration control was introduced through carrier sanctions,³ whilst more direct forms of outsourcing to private non-state actors have historically included the implementation of visa policies;⁴ the handling of security checks at the border; and involvement in immigration detention,⁵ deportation, and removal. Unofficial border patrols have also often seen the involvement of private actors, ranging from individuals to organized paramilitary forces allied with extreme right-wing groups.⁶ More recently private non-state actors, and Private Military and Security Companies (PMSC)⁷ more specifically, have been increasingly involved in researching the security dimensions of migration;⁸ providing security services for reception and transfer centers, sometimes under the supervision of international organizations; and providing and managing border technology infrastructures,⁹ accommodation,¹⁰ food, and cash cards¹¹ for refugees and asylum seekers.

In this Article, I focus on the well-known legal challenges encountered in attempting to hold PMSC accountable for the human rights harm they have caused or contributed to, mainly in terms of attribution and jurisdiction. Specifically, I examine the added value that the United Nations Guiding Principles on Business and Human Rights (UNGP)¹² provide in ascertaining state responsibility for business-related human rights abuses occurring in the migration context. The UNGP—adopted unanimously in 2011 by the United Nations Human Rights Council—provide a three-pillar framework aimed at clarifying the states’ obligation to protect human rights from third party interference (pillar one); the companies’ responsibility to respect human rights throughout their operations (pillar two); and the need to ensure effective remedies when human rights harm is caused, directly or indirectly, by business activities (pillar three). I will therefore consider the accountability challenges raised by outsourcing migration control from the complementary perspective of the UNGP by discussing how careful regulation of business activities may provide a pathway to accountability in domestic courts. As I discuss in this Article, migration control activities, which are outsourced to PMSC, can be classified as high-risk operations for the purposes of the application of the UNGP.¹³ According to the UNGP, all companies involved in high-risk operations require a higher degree of engagement and rigor when carrying out a more complex process of human rights due diligence.¹⁴ This due diligence generally implies an assessment of the way in which a company can adversely impact human rights through its own operations. In the language of the UNGP, an “adverse human rights impact occurs when an action removes or reduces the ability of an individual to enjoy his or her rights.”¹⁵ The reclassification of migration control activities as high-risk operations, in turn, has two significant implications in terms of establishing accountability for PMSC’s wrongful conduct. First, it acknowledges that the privatization of migration control, especially within the context of continued containment and deterrence trends,¹⁶ entails a high risk of gross human rights abuses to which PMSC may contribute, both directly and indirectly. Second, based on a joint reading of UNGP 7, UNGP 17(b), UNGP 23(c), and UNGP 24,¹⁷ this reclassification enables us to identify heightened obligations vested upon the state in which the parent company of a PMSC is registered or domiciled (home state) as well as heightened responsibility of the PMSC themselves.

The main argument put forward in this Article is that heightened home state obligations mean, at a minimum, an obligation to regulate the transnational activities of PMSC domiciled within a home state’s territory in order to both prevent them from causing, or contributing to, transnational human rights harm and provide redress when such harm occurs. In order to ensure accountability for human rights abuses through regulation, homes states are required to introduce mandatory human rights due diligence and provide effective remedies for any harm deriving from the wrongful conduct of the PMSC. Effective remedies would include, inter alia, providing access to the courts of the home state of the PMSC and imposing civil and criminal liability on PMSC for their wrongful conduct. As I demonstrate in this Article, the UNGP acknowledge that, in situations in which there is a high risk of gross abuses, home states are under an obligation to meaningfully regulate the transnational activities of PMSC domiciled in their territory. Failure to regulate would result in a breach of the home state’s obligation to protect from foreseeable human rights abuses by PMSC, that is, a breach of a positive obligation to protect.

The argument is developed as follows: Section B clarifies the reasons why, for the purposes of the application of the UNGP, migration control contexts involve high-risk operations. It also explains how this reclassification results in heightened home states’ obligations and heightened PMSC’s responsibility, as envisaged by the UNGP. Section C discusses whether this reconceptualization might be useful to bridge the accountability gap that usually characterizes corporate human rights abuses resulting from the cooperation between states and private non-state actors such as PMSC, including in contexts of transnational migration control. Section D concludes with some reflections on the relevance of state responsibility arguments supported by the UNGP.

B. Privatized Migration Control and High Risk of Gross Human Rights Abuses

I. The Meaning of “High Risk” in the UNPG

The multiplicity of human rights abuses occurring within the context of migration control and the direct or indirect involvement of PMSC in such abuses have been accurately documented in the literature.¹⁸ The achievement of an effective remedy for victims of business-related abuse, however, remains elusive, not least because traditionally non-state actors are not directly bound by international law. Home states are also reluctant to comprehensively regulate the transnational activities of companies registered or domiciled in their jurisdiction,¹⁹ partly in fear of loss of competitiveness, partly because of the benefit they may gain from such transnational activities. More comprehensive regulation would contribute to the establishment of clearer horizontal obligations in domestic law and regulatory frameworks,²⁰ and in turn close the “governance gap”²¹ between the human rights standards enshrined in relevant human rights instruments and reflected in the UNGP on the one hand, and the measures adopted by states and companies to ensure effective remedies on the other. This governance gap appears particularly accentuated in the context of PMSC’s involvement in migration control, where states’ willingness to contain and deter migration is matched by a marked increase, over the last two decades, in the criminalization²² and securitization²³ of migration, including through cooperation with countries in the region of origin²⁴ and with private security actors.

As explained in this Section, to define a business operational context as “high risk,” it is necessary to take into consideration the human rights abuses taking place throughout a company’s business operations. This means that a company should not only be aware of the abuses taking place within the specific countries in which it operates, but also consider the broader context of its activities, and ascertain both the actual and potential adverse human rights impact related to such contexts.²⁵ It is important to note that all conflict-affected contexts—irrespective of their legal classification and of whether the armed conflict is still ongoing or has subsided—will entail a high prevalence of human rights abuses, and therefore pose a high risk for a company to become involved in them. Various other complex operational contexts, however, even though not necessarily related to armed hostilities, will also qualify as “high risk.” For the purposes of our analysis, the provision of services that enable and contribute to migration policies resulting in human rights abuses also constitute high-risk contexts and high-risk business operations. Consider, for instance, the provision by the Nakamoto Group of substandard medical care in United States Immigration and Customs Enforcement’s (ICE) immigration detention centers,²⁶ which has led to detainees dying of treatable and preventable diseases.²⁷ Similarly, in US states and cities where the ICE is increasingly relying on the use of ankle bracelets as a “more humane” alternative to immigration detention,²⁸ Global Positioning System (GPS) tracking and supervision services are increasingly outsourced to private security companies.²⁹ This electronic monitoring practice has raised concerns not only in terms of privacy rights, data sharing, and health implications of wearing the device,³⁰ but also in relation to the lawfulness of this outsourcing, which often results in an automatic ineligibility for bail or in a rise in the level of immigrants’ indebtedness. The high costs for the cash bond (on average USD 8,000–10,000) and for the GPS tracking services, in fact, are passed on to the detainees wearing such electronic devices. Security companies provide financing to those who cannot afford the cash bond but, in return, the detainees must pay for activating the ankle bracelet (USD 460); for leasing it and being tracked (USD 420 per month for the duration of the “bail);”³¹ and ultimately for repaying the cash bond. If they cannot afford to pay, they are usually returned to detention in inhuman and degrading conditions.³²

While there is no agreed-upon definition of “high-risk areas,”³³ and Principles 7 and 23(c) of the UNGP only refer to conflict-affected areas and the heightened risk of gross human rights abuses there, it is possible to refer to other relevant definitions to evince the scope and content of these terms. The Organization for Economic Cooperation and Development (OECD), for instance, defines “conflict-affected and high-risk areas” as follows:

Conflict-affected and high-risk areas are identified by the presence of armed conflict, widespread violence or other risks of harm to people. Armed conflict may take a variety of forms, such as a conflict of international or non-international character, which may involve two or more states, or may consist of wars of liberation, or insurgencies, civil wars, etc. High-risk areas may include areas of political instability or repression, institutional weakness, insecurity, collapse of civil infrastructure and widespread violence. Such areas are often characterised by widespread human rights abuses and violations of national or international law.³⁴

Similarly, the EU definition of “conflict-affected and high-risk areas” characterizes them as “[a]reas in a state of armed conflict, fragile post-conflict areas, as well as areas witnessing weak or non-existing governance and security, such as failed states, and widespread and systematic violations of international law, including human rights abuses.”³⁵ The guidance produced by the UN Global Compact and the UN Principles for Responsible Investment initiative also clarified that the terms “conflict affected” and “high risk areas” could include situations “in which there are serious concerns about abuses of human rights and political and civil liberties, but where violent conflict is not currently present.”³⁶ Both of these definitions therefore treat “conflict-affected areas” as an example of “high-risk areas” generally.

As illustrated by the examples presented above, if we apply the above contextual definitions to current situations in which migration control operations are implemented, various elements of such operations clearly suggest that they are taking place in high-risk areas and/or in contexts that increasingly entail high-risk operations, irrespective of the existence of an armed conflict. For instance, a closer examination of the cooperation between Italy and Libya indicates that Libya’s territory, both on land and at sea, represents a crucial theatre of Italian and EU migration control operations. The memorandum of understanding between Italy and Libya, signed in 2017³⁷ and renewed in autumn 2019,³⁸ includes cooperation on migration control, whereby Italy provides training and equipment to the Libyan coast guard to intercept EU-bound irregular migrants at sea and return them to Libya. Irrespective of whether we consider the situation on the ground in Libya to amount to a situation of armed conflict or to a post-conflict situation, Libya qualifies as a conflict-affected country as understood by UNGP 7. Given the well-documented widespread violations of international law, including human rights abuses against migrants, occurring both in Libyan territorial waters and in official and unofficial detention centers around the country, Libya also meets the criteria of a high-risk area as defined above. PMSC have been supplying advanced border control systems to Libya for at least a decade,³⁹ when conditions in Libyan detention centers were already such as to amount to torture or inhuman and degrading treatment, and return to Libya to refoulement because it exposed them to the risk of ill-treatment. The decision by the European Court of Human Rights in Hirsi Jamaa and Others v. Italy,⁴⁰ indeed, found that the prohibition against refoulement was breached by Italy’s interception and pushback of migrants to Libya in 2008. This was because the Italian authorities knew or should have known that the people returned to Libya “would be exposed in Libya to treatment in breach of the [Convention] and they would not be given any kind of protection in that country,” in breach of Article 3 of the European Convention of Human Rights (ECHR).⁴¹ Human rights reports unanimously suggest that the situation has not improved since.⁴² Any business involving the provision of advanced border control systems to Libyan authorities in such a context would be at risk of causing or contributing to human rights abuses, as they would be at risk of contributing to the implementation of the migration control operations found in contravention of Article 3 ECHR.

UNGP 23(c) makes explicit reference to “gross human rights abuses.” The commentary to this principle mentions conflict-affected areas as an example of complex operating environment in which the risks of enterprises being complicit in such abuses committed by other actors may increase.⁴³ Although the UNGP do not define “gross abuses,” already in 1999, UN independent expert Cherif Bassiouni confirmed that the same contextual approach pertaining to high-risk contexts is also relevant to defining the term “gross violation of human rights.”⁴⁴ This term, he explained, is used to “describe situations involving human rights violations by referring to the manner in which the violations may have been committed or to their severity,” rather than to denote a specific category of violations. In this sense, it is employed with reference to the factual circumstances of the abuse, thus also to the operational contexts in which business activities are carried out. The Interpretive Guide to the UNGP drafted in 2012 by the Office of the High Commissioner for Human Rights (OHCHR) provides a non-exhaustive list of examples and refers to the gravity of the abuse:

There is no uniform definition of gross human rights violations in international law, but the following practices would generally be included: genocide, slavery and slavery-like practices, summary or arbitrary executions, torture, enforced disappearances, arbitrary and prolonged detention, and systematic discrimination. Other kinds of human rights violations, including of economic, social and cultural rights, can also count as gross violations if they are grave and systematic, for example violations taking place on a large scale or targeted at particular population groups.⁴⁵

The commentary to UNGP 14 also clarifies that the “severity of impacts will be judged by their scale, scope and irremediable character.”⁴⁶ The OHCHR Interpretive Guide further explains that the impact of business activities will be deemed to be severe based on the gravity of the harm, the number of people affected—both immediately and in the future— and whether it is possible to “restore those affected to a situation at least the same as, or equivalent to, their situation before the adverse impact.”⁴⁷ Based on the above, there is little doubt that the harm risked by the migrants returned to Libya—at the time of the circumstances described in the Hirsi case as well as in those pertaining to current migration control operations—entails severe impacts,⁴⁸ meaning that there is a high risk of gross human rights abuses in Libya.

As discussed above, beyond conflict-affected contexts such as the one in Libya, other transnational migration control operations increasingly take place in highly volatile and securitized environments⁴⁹ where the severity of the impact (in terms of scale, scope and irremediable character) is such that there is a high risk of involvement in gross human rights abuses. Drones, border patrol vehicles and vessels, cameras, facial recognition systems, thermal vision equipment, biometric and surveillance systems are increasingly supplied and managed by PMSC to carry out migration control measures.⁵⁰ Thus, while the border security apparatus rapidly expands,⁵¹ the business opportunities for PMSC are also set to increase because of their long-standing expertise in highly securitized and unstable environments. As already mentioned above, the same PMSC do not only provide high-tech security systems, but also essential services for refugees and asylum seekers, such as access to health care and housing, food, and cash cards. These essential services are not only increasingly privatized, because they are outsourced to for-profit private non-state actors, but also increasingly securitized, as they are provided as part of broader security service “packages” offered by PMSC. In turn, as externalization and containment become the primary aims of migration control policies, and reflect a rising hostility against migrants,⁵² the risk of PMSC’s direct and indirect involvement in gross abuses at various stages of the migration journey increase. As explained in this Section, PMSC can be implicated in gross human rights abuses in various ways. Thus, the presence of an armed conflict is not definitive in ascertaining whether a business enterprise is exposed to a high risk of being involved in gross human rights abuses. What is key, instead, is understanding the operational context in which a company operates, and the severity of the actual and potential adverse human rights impact that it might have.

II. Home States’ Obligations in High-Risk Situations

A careful reading of the UNGP clearly reveals that whenever companies become involved in the implementation and operationalization of migration control, they embark in high-risk operations, that is to say business operations that entail a high risk of gross abuses.

Where the risk of gross human rights abuses is heightened, the UNGP recognize under pillar one the existence of heightened obligations vested upon the home state of the PMSC and heightened responsibilities for the companies themselves. According to UNGP 7, in fact, home states of PMSC involved in the implementation of migration policies which engender a high risk of gross human rights abuses are expected to “help them identify, prevent and mitigate the human rights-related risks of their activities and business relationships” and “to assess and address heightened risks of abuses.”⁵³ As further explained in the commentary to UNGP 7⁵⁴ and in another United Nations Human Rights Council report in an addendum to the UNGP,⁵⁵ home states’ engagement is not to be understood as replacing but as complementing the engagement of host states where the PMSC are deployed. Engagement by home states should be proactive and take place as early as possible, in order to help companies avoid involvement in human rights abuses before the situation escalates.⁵⁶ UNGP 7, as discussed above, refers specifically to gross abuses and, therefore, concerns human rights abuses of a severe nature, because of their gravity, scale, scope, and irremediability.⁵⁷ The grossness of the abuse, therefore, is reinforced by the increased likelihood of occurrence⁵⁸ and both demands that home states are not only proactive and supportive of cooperative companies, but also that they deny “access to public support and services for a business enterprise that is involved with gross human rights abuses and refuses to cooperate in addressing the situation.” Crucially, UNGP 7(d) also requires home states to “ensur[e] that their current policies, legislation, regulations and enforcement measures are effective in addressing the risk of business involvement in gross human rights abuses.” The addendum report on conflict-affected areas confirms that home states should establish adequate regulatory frameworks; clarify the applicability of such frameworks to business entities; and—for the most extreme situations—“make sure that the relevant agencies are properly resourced to address the problem of business involvement in international or transnational crimes, such as corruption, war crimes or crimes against humanity.”⁵⁹ The commentary to UNGP 7 further clarifies that states should also “consider multilateral approaches to prevent and address [gross human rights abuses], as well as support effective collective initiatives.”⁶⁰

At this point, it is important to note that the broader debate over whether a home state has a general duty, in international law, to regulate the transnational activities of a company registered in its territory and/or jurisdiction, continues to generate a vast amount of literature.⁶¹ This is partly because when the UNGP were adopted in 2011, the commentary to UNGP 2 took a conservative approach to the debate by stating that “[a]t present States are not generally required under international human rights law to regulate the extraterritorial activities of business domiciled in their territory and/or jurisdiction. Nor are they generally prohibited from doing so, provided there is a recognized jurisdictional basis.” While the general debate in international law is thus far from settled, it is relatively uncontroversial⁶² to state that in high-risk contexts, because of the nature of gross abuses and of their high likelihood of occurrence, home states have a duty to appropriately and effectively regulate the transnational conduct of business enterprises in order to prevent business-related human rights abuses. The 2013 OHCHR report on corporate liability for gross human rights abuses clarified that, although the UNGP are technically a non-binding instrument,

their provisions include restatements of existing international legal obligations. At the very least, they are evidence of an emerging consensus concerning the steps that State should now be taking, and the areas to be prioritized for action, in order to meet their responsibilities towards victims in cases where businesses are implicated or involved in gross human rights abuses.⁶³

III. Business Responsibility in High-Risk Situations

The provisions under pillar two of the UNGP provide that, in light of their responsibility to respect human rights, business enterprises should avoid infringing on the rights of others and address negative impacts that they have caused or contributed to. The primary mechanism to operationalize this responsibility to respect is human rights due diligence,⁶⁴ which essentially consists of a set of processes aimed at ensuring that a company assesses its actual and potential “adverse impacts”; takes action when such adverse impacts are identified; tracks and communicates to relevant stakeholders the ways in which it addresses such impacts; and contributes to remediating them. As I have argued so far, PMSC involved in migration control operate in high-risk contexts, which demand a heightened responsibility to respect human rights, including in terms of how to carry out human rights due diligence and the type of remediation mechanisms that they are required to provide.

Pillar two of the UNGP contains provisions related to the corporate responsibility to respect human rights. UNGP 17, more specifically, refers to human rights due diligence as an ongoing⁶⁵ risk-assessment process that companies are required to carry out—across their operations, products and services, as well as throughout their supplier and business partner networks⁶⁶—in order to “identify, prevent, mitigate and account for how they address their adverse human rights impacts.”⁶⁷ UNGP 17(b) confirms the relevance of ascertaining the severity of the impacts that a company may have and the nature of its operational context, by stating that the complexity of the human rights due diligence process will vary depending on “the size of the business enterprise, the risk of severe human rights impacts, and the nature and context of its operations.”⁶⁸

When examining high-risks contexts, it is important to read UNGP 17 in conjunction with UNGP 23(c), which requires business enterprises to “treat the risk of causing or contributing to gross human rights abuses as a legal compliance issue wherever they operate.”⁶⁹ This means that companies “should treat this risk in the same manner as the risk of involvement in a serious crime, whether or not it is clear that they would be held legally liable.”⁷⁰ The vigilance required of company lawyers is due to the severity of the human rights abuses involved, but also to “the expanding legal boundaries, including territorial boundaries … irrespective of the status of the law where the business activity is taking place.”⁷¹ UNGP 24 is also relevant in high-risk contexts, as it refers to situations where companies may be unable to address all adverse human rights impacts simultaneously. According to UNGP 24 and related commentary, companies should address all their adverse impacts, but where necessary, they “should first seek to prevent and mitigate those that are most severe or where delayed response would make them irremediable.”⁷² This means that companies should always have a clear and comprehensive understanding of the severity of the abuses that they become involved in and/or contribute to, in terms of scale and scope of the abuses but also in terms of the irremediable nature of the harm. It is important to emphasize that the primary focus of the human rights due diligence process, therefore, is not on the risk to the company, but on the higher risk to which refugees and migrants are exposed throughout migration control operations.⁷³ PMSC, therefore, should consider both the likelihood and severity of the risk, and be aware that often the high risk of gross abuses may be so pervasive that it becomes almost impossible for a PMSC not to be involved in them. A joint reading of UNGP 17, UNGP 23 and UNGP 24, therefore, demands that whenever PMSC are involved in high-risk operations, they should not only ascertain the likelihood of their involvement in or contribution to gross abuses, but also prioritize actions to prevent and address the most severe impacts. The continued involvement of PMSC in migration policies of containment and deterrence, therefore, appears to ignore both the home states’ obligation to protect human rights and the companies’ responsibility to respect them, as specifically articulated in the UNGP for high-risk contexts. In the next Section, I explain in more detail how these obligations and responsibilities might help us go beyond the so-called “governance gap” identified in business and human rights and address the accountability gap that continues to characterize business-related abuses in migration control contexts.

C. Heightened Obligations and Heightened Responsibility: Bridging the Accountability Gap in Transnational Migration Control?

I. The Challenge of Attributing Business Conduct to a State

Commentators have discussed the challenges raised by migration control operations in terms of allocation of responsibility for violations of human rights when multiple actors are involved in a breach of international law.⁷⁴ For the purposes of this Article, and as mentioned in Section B, cooperation between states and PMSC in cross-border migration control activities presents an additional layer of complexity because of the non-state actor status of PMSC. Since attribution of conduct is a precondition of state responsibility, attempts have been made at ascertaining whether a non-state actor’s wrongful conduct is attributable to the collaborating state—in our case, usually the state engaging the services of the PMSC or, under certain circumstances, the home state.

The rules on attribution most relevant to our discussion on transnational PMSC’s migration control activities are those under Articles 5 and 8 of the Draft Article on Responsibility of States for International Wrongful Acts (ARSIWA).⁷⁵ As confirmed by paragraphs 2 and 3 of the commentary to Chapter II, on attribution of conduct to a State, the general rule is that the conduct of private persons is not attributable to the state. This is because only the conduct of organs of government of a state or of agents of a state can be attributable. Article 5 ARSIWA, relating to the exercise of certain elements of governmental authority by a non-state actor (a person or entity which is not an organ of the state), is relevant because PMSC often carry out activities which would normally be performed by the state, such as the security and management of detention centers and the provision of essential services to asylum seekers and migrants, for example, services related to health, accommodation, and food. According to Article 5 ARSIWA, such private conduct is only attributable to the state if there is a legal act by the state empowering the non-state actor.

According to paragraph 2 of the commentary to Article 5 ARSIWA, only in special cases the term “entity” may include private companies, and in any case such entity will have to be “empowered by the law of the State to exercise functions of a public character normally exercised by State organs, and the conduct of the entity [must be related] to the exercise of the governmental authority concerned.”⁷⁶ Paragraph 2 also provides the example of private security firms contracted to provide services as prison guards, exercising powers of detention and discipline. Such powers, however, will only be provided by national prison regulations or pertain to the enforcement of a judicial sentence. PMSC’s transnational activities, instead, are usually regulated by contractual agreements stipulated between the state and the company itself. Such contracts will usually not be a sufficient legal instrument to empower the PMSC with governmental authority. This is because the services in which they engage, although they would be normally performed by the state, are not necessarily regulated by law. Immigration detention, for instance, is usually of an administrative nature and as such it will not be covered by regulations pertaining to prisons and detention centers in the criminal justice system.

In the absence of such formal legal empowerment by the state, a PMSC’s conduct can be attributed to the state in accordance with Article 8 ARSIWA if the private non-state actors act on the instructions of, or under the direction or control of a state. Thus, responsibility of the contracting state will only be engaged if it can be proven, either by the wording of the contract or by the facts, that the company acted under the instructions of the state in carrying out the wrongful conduct or that it acted under the direction or control of the state.⁷⁷ Human rights abuses or other wrongful conduct generally fall outside of the substantive scope of such contractual arrangements, so it would be difficult, based on the contract alone, to prove that the PMSC acted under the instruction of the hiring state.⁷⁸ Similarly, the wording of the contract would not be sufficient to prove that the state has otherwise directed or controlled the conduct of the PMSC, since the contract would specify the activities to be carried out, but PMSC are generally quite independent in the planning and execution of their activities. This means that the threshold of state dependence established by Article 8 for attribution of a PMSC’s conduct to the state would usually not be met. Similarly, the conduct of PMSC acting outside of the scope of what has been contractually agreed will also not be attributable to the state.⁷⁹

II. Positive Obligations and Their Evolving Character

It is because of these difficulties in identifying a valid attribution link between the state and the private non-state actor that international legal scholars often turn to the doctrine of positive obligations,⁸⁰ or what in business and human rights terms, as explained in Section B, is referred to as the home state’s obligation to protect from corporate abuse under pillar one of the UNGP. UN Treaty Bodies⁸¹ have increasingly recognized in their work the relevance of a state’s positive obligations in relation to the conduct of private companies. The Human Rights Committee, which monitors compliance with the International Covenant on Civil and Political Rights (ICCPR),⁸² for instance, has referred to positive obligations in relation to two Articles which are of particular relevance for the context of migration control: Article 6 (right to life)⁸³ and Article 7 (prohibition of torture, or other cruel, inhuman or degrading treatment or punishment).⁸⁴ General Comment 36 on the right to life is of specific significance because, at the moment of writing, it is the most recent General Comment issued by the HRC. Despite the fact that General Comments by UN Treaty Bodies are not legally binding instruments, they provide highly authoritative interpretations of the content of the rights and of the legal nature of the obligations enshrined in the relevant international human rights instruments.⁸⁵

Paragraph 21 of General Comment 36 clarifies that state parties to the ICCPR have a “due diligence obligation to take reasonable, positive measures that do not impose disproportionate burdens on them in response to reasonably foreseeable threats to life originating from private persons and entities whose conduct is not attributable to the State.”⁸⁶ Furthermore, adequate protective measures “must be taken to prevent, investigate, punish and remedy arbitrary deprivation of life by private companies, such as private transportation companies, private hospitals, and private security firms.”⁸⁷

At first sight, with the above interpretation, the HRC seems to contradict the commentary to UNGP 2, which claims that states generally do not have an obligation to regulate. This latter approach is put forward by the UNGP despite clear evidence from the work of the UN OHCHR on accountability and effective remedies,⁸⁸ that weak, incoherent, and inconsistent regulation by both home and host states creates legal uncertainties and inefficiency, and imposes additional costs and complexity when it comes to enforcement.⁸⁹ John Ruggie, former UN Special Representative of the Secretary General on issues of business and human rights, and architect of the UNGP, has recently reiterated this stance when addressing concerns expressed in 2019 by Swiss business associations during discussions on national mandatory human rights due diligence. The associations had argued that such a mandatory requirement was in contradiction with the UNGP and had questioned the jurisdiction for legislation on extraterritorial business activities. In his response,⁹⁰ Ruggie explained that legislation requiring businesses to meet their responsibility to respect human rights was not in contradiction with the UNGP. Rather, he argued, UNGP 3 already clarified that states are expected to adopt a regulatory “smart mix” of measures—national and international, voluntary and mandatory—to encourage, support, and incentivize business enterprises. To assuage the concerns expressed by Swiss business associations in relation to legislation with extraterritorial effect, Ruggie also repeated verbatim the content of the commentary to UNGP 2, according to which “under international human rights law states are not generally required to regulate the extraterritorial activities of businesses domiciled in their jurisdiction, but nor are they generally prohibited from doing so provided there is a recognized jurisdictional basis.”⁹¹ The UNGP, at the same time, acknowledge the progressive work of the UN Treaty Bodies and recognize that the provisions concerning the regulation of transnational business activities pertain to an evolving area of international law.⁹²

Some elements of this evolution, it can be argued, are present in the work of the HRC, which interpreted the provisions of Article 2(1) ICCPR, according to which Covenant obligations are owed by a state party to “all individuals within its territory and subject to its jurisdiction,” as meaning all persons over whom it exercises power or effective control. In relation to the right to life, this “includes persons located outside any territory effectively controlled by the State whose right to life is nonetheless affected by its military or other activities in a direct and reasonably foreseeable manner.”⁹³ In General Comment 36, the HRC further clarified the situation in which home states of a company have an obligation to regulate, by affirming that state parties

must also take appropriate legislative and other measures to ensure that all activities taking place in whole or in part within their territory and in other places subject to their jurisdiction, but having a direct and reasonably foreseeable impact on the right to life of individuals outside their territory, including activities undertaken by corporate entities based in their territory or subject to their jurisdiction, are consistent with Article 6, taking due account of related international standards of corporate responsibility and of the right of victims to obtain an effective remedy.⁹⁴

The work of the UN Committee on Economic Social and Cultural Rights (CESCR) is also important when it comes to states’ obligations in relation to the business conduct. General Comment 24,⁹⁵ in particular, explicitly states that the obligation to protect also applies extraterritorially, requiring states to “take steps to prevent and redress infringements of Covenant rights that occur outside their territories due to the activities of business entities over which they can exercise control, especially in cases where the remedies available to victims before domestic courts of the state where the harm occurs are unavailable or ineffective.”⁹⁶

The reference to the exercise of control over business entities operating abroad contained in General Comment 24 is reminiscent of Article 8 ARSIWA, but at paragraph 32 the CESCR clarifies that, although state responsibility for the wrongful conduct of private non-state actors is only engaged when such conduct can be attributed to the state, states would be in breach of their human rights obligations “where the violation reveals a failure by the State to take reasonable measures that could have prevented the occurrence of the event.”⁹⁷ In the CESCR’s view, it is thus possible to engage the responsibility of the state “even if other causes have also contributed to the occurrence of the violation, and even if the State had not foreseen that a violation would occur, provided such a violation was reasonably foreseeable.”⁹⁸ In such cases, the responsibility of the state does not arise for the abuse that a company has caused or contributed to, but for the state’s failure to protect from such abuse when the state knew or ought to have known of its likely occurrence, but failed to take reasonable steps to prevent it. The obligation to protect, predicated upon this lower threshold of foreseeability, is a due diligence obligation vested upon the state, and as such an obligation of conduct rather than of result.⁹⁹

The CESCR is not alone in advancing this understanding of extraterritorial obligations. Tilmann Altwicker, for instance, refers to this extraterritorial obligation to protect as “the external dimension of a transnational obligation to protect,” which in his view was already identifiable in the International Law Commission Draft Articles on the Prevention of Transboundary Harm from Hazardous Activities.¹⁰⁰ Under Article 3 of such Draft Articles, when lawful hazardous activities are planned or carried out in the territory of a state or otherwise under the jurisdiction or control of a state,¹⁰¹ the latter is under an obligation to “take all appropriate measures to prevent significant transboundary harm or at any event to minimize the risk thereof.”¹⁰² This includes hazardous transboundary activities conducted by private persons or enterprises in which case a state is required to establish and implement an appropriate regulatory framework rather than get involved in a company’s operational issues.¹⁰³

Similarly, the Committee on the Rights of the Child (CRC Committee)¹⁰⁴ refers to the need to identify “a reasonable link between the State and the conduct concerned”¹⁰⁵ when it comes to an obligation to enable access to an effective remedy, judicial and non-judicial, when rights are violated by business enterprises abroad. As examples of measures suitable to prevent the infringement of children’s rights by companies operating abroad, the CRC Committee includes making state support, such as public finance and insurance, conditional on a business carrying out appropriate and effective human rights due diligence and recommends the vetting of a company’s prior record on children’s rights.¹⁰⁶

III. Positive Obligations in High-Risk Contexts

As I have explained in Section B, it is at this juncture that the conceptualization of PMSC’s involvement in migration control activities as “high-risk” operations becomes particularly useful, especially to overcome potential issues of jurisdiction. Legal scholars and practitioners continue to disagree over whether and when a state’s obligation to protect from third parties’ interference with the enjoyment of human rights applies to transnational activities.¹⁰⁷ The main obstacle to the application of a state’s obligation to protect, in some cases, remains the issue of jurisdiction, that is to say the applicability of the relevant international legal instrument in which the obligation is enshrined. As seen above, on the one hand, state parties to a human rights treaty that contains a jurisdiction clause, such as the ICCPR, the Convention on the Rights of the Child, or the European Convention on Human Rights, have obligations when they have effective control over a territory (spatial mode of jurisdiction) or over a person (personal mode of jurisdiction).¹⁰⁸ The CESCR, on the other hand, interprets the obligations under the ICESCR as being “without any restriction linked to territory or jurisdiction.”¹⁰⁹

It is important to note that the debate over the obligation to regulate mainly concerns general duties, rather than specific duties applicable in high-risk situations where obligations and responsibilities, as explained in Section B, are understood as having a heightened character. Very much in line with the interpretations of the UN Treaty Bodies, the UNGP confirm that high-risk contexts, such as the ones pertaining to the implementation of migration policies and the involvement of PMSC therein, demand the special engagement of home states. They require appropriate regulation aimed at preventing business-related abuse and stopping the abuse that is identified and already occurring. The high risk of gross abuses taking place in migration control contexts means that a failure by the home state to take appropriate steps to protect individuals from abuse which is reasonably foreseeable, wherever this abuse may occur, would amount to a breach of its positive obligation to protect. PMSC, in turn, have a heightened responsibility to respect human rights and treat the risk of gross abuses as a legal compliance issue, that is to say, in the same manner as they would treat the risk of being involved in a serious crime, irrespective of whether this is prescribed by law where the business activity is taking place. Regulation of transnational business conduct is important because when it comes to PMSC’s involvement in migration control, especially in the contemporary context of containment and deterrence, the individuals suffering abuse are hardly ever within the territory of the state contracting with the PMSC or within the territory of the PMSC’s home state. Most commonly, in transnational migration control operations the individual is located outside of the territory of the relevant state and the unlawful conduct of the PMSC, when it occurs, cannot be easily attributed to the state.¹¹⁰ To obviate situations in which states purposely cooperate with other states or with private non-state actors in order to exploit the jurisdictional threshold and circumvent responsibility, scholars have called for a functional approach to jurisdiction.¹¹¹ This approach is based on the fact that indirect perpetration of an international wrong, that is to say a breach by proxy, would also incur responsibility.¹¹² It remains to be seen, however, whether courts will find this functional approach to jurisdiction persuasive enough for them to adopt it. In the meantime, the “smart mix” identified by the UNGP, including its specific approach to high-risk areas examined in this Article, offers a possible alternative perspective.

As mentioned above, there is evidence of a certain willingness to regulate on the part of both home and host states, but their efforts often remain incoherent and inconsistent.¹¹³ This leads to challenges in ensuring the right to an effective remedy envisaged both in international legal instruments¹¹⁴ and in the UNGP (pillar 3).¹¹⁵ The home states of PMSC involved in migration control contexts have also proven to be reluctant to regulate transnational business conduct, as they are usually the very states that have a vested interest in strengthening migration control and in collaborating with other states or private actors to circumvent state responsibility. A reclassification of migration control activities outsourced to PMSC as high-risk operations for the application of the UNGP can help forestall objections to the existence of a home state’s obligation to regulate the transnational activities of its PMSC. Because transnational migration control operations entail a high risk of gross human rights abuses, the UNGP clearly direct us to identify the nature and scope of the heightened obligations vested upon the home states of the PMSC, and the heightened responsibility pertaining to the PMSC themselves. Through a close analysis not only of the provisions in UNGP 7, 17(b), 23(c), and 24 discussed in Section B, but also of recent developments in international law and interpretations provided by the UN Treaty Bodies, it is apparent that the existence of heightened obligations and responsibility applicable in high-risk situations is broadly acknowledged. Such heightened obligations and responsibilities are due to the foreseeability of the harm and ability of the state to prevent it, as well as to the grossness of the abuses and the likelihood of their occurrence in such contexts.

Heightened home states’ obligations to protect entail, at a minimum, a duty to regulate the transnational activities of PMSC domiciled within a state’s territory, and/or under its jurisdiction. Such regulation must be aimed at effectively preventing PMSC from causing, or contributing to, human rights abuses in the course of their transnational operations, as clarified by UN Treaty Bodies and as suggested by a joint reading of UNGP 7, 17(b), 23(c), and 24. This would include the introduction, in the relevant domestic legal framework (pillar one), of mandatory human rights due diligence for PMSC involved in migration control (pillar two), and the provision of effective remedies for the harm deriving from the wrongful conduct of the PMSC (pillar three). Effective remedies would include, inter alia, providing access to the courts of the home state of the PMSC, especially when the courts of the host states are unable to provide effective remedies or are otherwise inaccessible to the victims; and imposing civil and criminal liability on PMSC for their wrongful conduct. Failure to regulate the transnational activities of PMSC would result in a breach of the home state’s obligation to protect from reasonably foreseeable human rights abuses by the PMSC, that is to say a breach of a positive obligation to protect.

Meaningful regulation will have to specify the type of mandatory human rights due diligence required of PMSC and create a system whereby state support to the PMSC—including continued registration and incorporation in the home state—would be made conditional to detailed reporting, auditing and corrective action whenever abuses are identified. PMSC involved in migration control operations also have a heightened responsibility to treat the risk of gross human rights abuses as a legal compliance issue and thus engage in ongoing monitoring and assessment of how they adversely impact human rights. Accordingly, they must also publicly notify harm when encountered and promptly intervene to prevent abuses or stop them if they are already occurring.

Anything short of this heightened approach would hollow out the significance of the UNGP in high-risk situations. Most importantly, a heightened approach would also engage the responsibility of the home state for a failure of its obligation to protect and trigger a requirement to remedy such breach. Non-compliance by the PMSC, in turn, would lead to civil and criminal liability in the relevant domestic frameworks. PMSC, therefore, rather than continuing to actively contribute to border securitization and lobby for increasingly militarized responses to migration flows,¹¹⁶ will have to legally reconsider whether their engagement in migration control is indeed possible without incurring civil and criminal liability. Articulated in this way, heightened obligations and responsibility could start to obviate jurisdictional issues and complement current approaches to the doctrine of positive obligations. This could offer a possible solution to ensuring both state and corporate responsibility.

D. Conclusion

In this Article, I have argued that the UNGP recognize the existence of heightened state obligations and business responsibility in contexts characterized by a high risk of gross human rights abuses. This risk does not only characterize conflict-affected areas, but also complex situations in which PMSC often find themselves carrying out their activities, including within the context of migration control.

After clarifying that, for the purposes of the application of the UNGP, migration control contexts involve a high-risk of business involvement in gross human rights abuses, I have examined how this reclassification results in heightened obligations of home states and heightened responsibility of PMSC, as envisaged by the UNGP. I have further argued that heightened home state obligations mean, at a minimum, an obligation to regulate the transnational activities of PMSC domiciled within a home state’s territory to prevent them from causing, or contributing to, transnational human rights harm, and provide redress when such harm occurs. As also confirmed by recent developments in the work of UN Human Rights Treaty Bodies, home states are required to introduce mandatory human rights due diligence and provide effective remedies for the harm deriving from the wrongful conduct of the PMSC. Effective remedies would include providing access to the courts of the home state of the PMSC and imposing civil and criminal liability on PMSC for their wrongful conduct.

The UNGP also acknowledge that, in situations in which there is a high risk of gross abuses, home states are under an obligation to meaningfully regulate the transnational activities of PMSC domiciled in their territory. Failure to regulate would result in a breach of the home state’s obligation to protect from foreseeable human rights abuses by PMSC, i.e., a breach of a positive obligation to protect.

A reconceptualization of migration control operations as high-risk contexts may prove useful to bridge the accountability gap that usually characterizes corporate human rights abuses resulting from the cooperation between states and private non-state actors such as PMSC, including in contexts of transnational migration control. As I have argued, when it comes to high-risk contexts, the UNGP can be an alternative tool to recent calls for a functional approach to jurisdiction and a complementary instrument when implementing the doctrine of positive obligations.