Watching the Guards

In the wake of war zone scandals, global partners set out to establish a code of conduct for private security firms.

When the United States invaded Iraq in 2003, coalition troops soon were followed by a flood of armed individuals who weren't in military uniform. Tens of thousands of private security contractors were dispatched to America's latest war zone to protect transportation convoys, high-ranking individuals and key facilities. Some represented large multinational corporations with reliable reputations. Others came from startup companies with little more than a Post Office box and a truck full of artillery. But they shared at least one thing in common: a lack of collective standards and industry protocols.

"What we saw in the early days of Iraq were some very capable companies that had no idea about the [Federal Acquisition Regulation]," says Doug Brooks, president of IPOA, a private security trade association. "They were able to undercut the more established companies with lower bids and then fall down on the compliance side. They did not have the back-office people and that caused problems."

More than seven years later, as Operation Iraqi Freedom draws to a close and tensions in Afghanistan grow exponentially, the private security industry, tarred by years of scandal and perceived abuses, is ready to adopt a global code of conduct that will dictate expectations ranging from human rights to employee training. Complying with the international standards of conduct and, more important, earning certification soon will be a prerequisite for winning security work from the federal government.

"The end result will be a minimum set of standards for the industry," says Tara Lee, a partner at DLA Piper in Northern Virginia who has worked with industry groups in drafting the code of conduct. "Right now, three guys with guns, a truck and a website have a security company."

Ground Rules

The international effort to regulate security contractors was driven, in part, by the 2007 shooting in Nisoor Square, Iraq, by guards from Blackwater, now known as Xe Services LLC. The incident, which left 17 civilians dead, sparked a global outcry to reform the industry. In September 2008, 17 nations led by the Swiss government, including the United States, signed the Montreux Document, a nonbinding resolution to ensure private security contractors comply with international human rights law. Eighteen additional countries have since signed the document.

While the resolution contains broad goals, it lacks a method to impose its standards. With significant input from industry, human rights groups and other nongovernment organizations, a Swiss think tank began developing a universal standard of conduct that would be both comprehensive and enforceable. The Geneva Centre for the Democratic Control of Armed Forces sought to "provide unambiguous guidance to the industry, their clients, states, civil society and other stakeholders as to how services should be provided."

After two years of workshops, drafts and rewrites, the group released a final version of the code for public comment in August, aiming for formal adoption at a conference in Switzerland in late September. The rules run the gamut from regulating force on the battlefield to prohibiting torture, sexual abuse, bribery, child labor and human trafficking. Other sections focus on vetting and training personnel, establishing internal whistleblower and grievance procedures, and enforcing firearms controls.

Federal agencies, which already have established guidelines for the private security companies they work with, are considering inserting the code into future contracts.

Officials hope the clause, which would apply to subcontractors as well, will serve as a barrier to substandard companies entering the marketplace. "Unless you are in compliance and can meet the standards, then you will be considered nonresponsive and we would not even have to consider you," says Gary J. Motsek, the Defense Department's deputy assistant secretary for program support. "This is a precondition for consideration, even before you write the contract."

Industry officials insist the code will be successful only if it has a third-party enforcement mechanism. While that process has yet to be worked out, the most likely scenario involves an international standards organization that would check companies' back-office functions, training, vetting procedures and compliance with the FAR.

"With third-party certification you have someone coming in ahead of time and saying, 'this company meets these standards,' " says Mark DeWitt, vice president for government and regulatory affairs at Triple Canopy, a Herndon, Va., private security company that supports the enforcement effort. "So you get more transparency in what you are purchasing and who you are buying it from."

It's unclear how violations of the code of conduct would be handled-criminal or financial penalties, or revocation of contract opportunities-but the process almost certainly will include a system for individuals to bring grievances against companies. Skeptics suggest only harsh sanctions against noncomplying firms would make a tangible difference.

"It's a lot like the code of conduct at your neighborhood country club, but with even less bite," says P.W. Singer, senior fellow and director of the 21st Century Defense Initiative think tank and author of Corporate Warriors: The Rise of the Privatized Military Industry (Cornell University Press, 2003). "That is, it's a very nice document in terms of identifying good practices to aspire toward, but unless there is some legal or economic bite, it's not a code, but just some guidelines that have no definable impact."

Lawless Landscape

For years, private security contractors have operated in a shadowy province of legal and business ethics. Unlike engineers, accountants and attorneys, these contractors have no universal performance standards. And while groups such as IPOA have robust, albeit unenforceable, codes of conduct, others operate in a lawless environment.

The largest private security firm based in Afghanistan, Watan Risk Management, is owned by relatives of Afghan President Hamid Karzai and headed by Commander Ruhullah, a local warlord known to villagers as "the Butcher." The largest security provider for the U.S. supply chain in Afghanistan, Ruhullah readily admits to bribing governors, police chiefs, army generals, and is even suspected of paying off the Taliban, according to a recent congressional report. Ruhullah told investigators Defense regulations do not apply to him, as evidenced by his team's use of heavy machine guns and rocket-propelled grenades-weaponry not allowed among firms working for the U.S. government.

"U.S. taxpayer dollars are feeding a protection racket in Afghanistan that would make Tony Soprano proud," said Rep. John F. Tierney, D-Mass., chairman of the House Subcommittee on National Security and Foreign Affairs, when the panel released the report in June. Those familiar with the Middle East private security industry suggest it is riddled with corruption in a manner unrivaled in the West. Drugs, fraud and bribery are common, says Sindhu P. Kavinnamannil, who has worked with private security firms on a host of compliance issues. "They have been doing this a long time and just having a code of conduct will not change anything," says Kavinnamannil, who is now owner and chief executive officer of Compliance Consulting Services.

It is unclear how the United States would impose a voluntary code of conduct on Ruhullah or others like him whose private militias control key passage- ways in Afghanistan. "The code will be great for dealing with companies like Triple Canopy," says a staffer with the congressionally chartered Commission on Wartime Contracting who requested anonymity. "But for local people . . . what are the odds of them signing on? And, if not, what do you do?"

It's not just lawless warlords-or even heavily criticized contractors like Blackwater-that have caused private security headaches. Often problems emanate from smaller, less well-known firms that enter the marketplace with little to no experience by placing exceedingly low bids to win work. "This is the worst possible process to contract out [to the lowest bidder]," says Lee of DLA Piper. "There will always be a startup from some country we have not heard of, or a company that has no internal processes and has not done the risk mitigation involved in the bids."

For years, State Department regulations mandated private security work must be awarded to the cheapest bidder deemed capable of performing the job. The clause was allowed to expire after photos surfaced of drunk and disorderly employees of a security firm contracted to guard the U.S. Embassy in Kabul. The contractor's bid was $100 million lower than that of more experienced firms.

While the code of conduct will not address source selection, private security firms argue agencies must begin to reevaluate the process. "If you are buying a widget, that's one thing," says IPOA's Brooks. "But if you are providing security and start hiring only the cheapest ones you can find, then you end up undermining your own policy."

Reform or Remove

The code of conduct might be of limited usefulness for the U.S. government, at least for the time being. In August, Karzai issued a decree banning private security companies from operating in Afghanistan as of Jan. 1, 2011. The order, which cites "horrific and tragic incidents" involving the misuse of weapons by private guards, exempts companies providing security inside foreign embassy compounds, international businesses and some charitable groups. The U.S. government has argued that Karzai's four-month timetable is overly ambitious.

Critics believe the true goal of the decree was to improve recruiting and retention for the Afghan National Army and police by eliminating their biggest competitors. "If Karzai's intent is to remove the bad actor civilian contractors from the battlefields and streets of Afghanistan, he could, instead of throwing the good companies out with the bad-and in so doing endangering the security of those who are there trying to help-decree that his government will only contract with and issue licenses to companies who have signed the voluntary global code of conduct," says Lee.

While Karzai's order is a punishing blow for many private security firms, observers suggest it does not diminish the need for the code. "The Karzai decree is independent of this deliberate process," says the Commission on Wartime Contracting staffer. "The value of the effort is not what is currently going on in Afghanistan or Iraq but focused on the future."

One of the common misperceptions about private security contractors, particularly those operating in Iraq and Afghanistan, is they are primarily American companies working for the U.S. government. Neither is true. Roughly 10 percent of the 11,000 private security employees in Iraq at the end of March were American. Most come from third-party countries. The figures are even more staggering in Afghanistan, where less than 1 percent of all private guards are American. Nearly all are Afghans.

Likewise, the Pentagon estimates only one-quarter of war zone private security contractors work for the U.S. government, with most employed by nongovernmental groups, including the media. It is unclear whether those contractors would be subject to the code of conduct. "The challenge is we operate in a common space," says Defense's Motsek. "In a nation that may or may not have sovereignty, it's critical that we are operating under the same conditions and the same rules."

For years, the burden to reform private security has been on the U.S. government. Most recently, in July 2009, Defense proposed a regulatory overhaul of security firms, attempting to close gaps in selecting, training, equipping and overseeing private guards. But the code of conduct is unique. Not only is the effort global, encompassing businesses hired by dozens of other nations, but it has been endorsed by industry. The success or failure of the code will be determined not by words on parchment but by behavior on the battlefield, often in life-or-death situations.

"It is critical that we get this right and that our clients have some faith in the industry," says Brooks. "If there is confidence in the international body, they will use the industry more. The value would be unbelievable."