I. The Meaning of “High Risk” in the UNPG

The multiplicity of human rights abuses occurring within the context of migration control and the direct or indirect involvement of PMSC in such abuses have been accurately documented in the literature.Footnote ¹⁸ The achievement of an effective remedy for victims of business-related abuse, however, remains elusive, not least because traditionally non-state actors are not directly bound by international law. Home states are also reluctant to comprehensively regulate the transnational activities of companies registered or domiciled in their jurisdiction,Footnote ¹⁹ partly in fear of loss of competitiveness, partly because of the benefit they may gain from such transnational activities. More comprehensive regulation would contribute to the establishment of clearer horizontal obligations in domestic law and regulatory frameworks,Footnote ²⁰ and in turn close the “governance gap”Footnote ²¹ between the human rights standards enshrined in relevant human rights instruments and reflected in the UNGP on the one hand, and the measures adopted by states and companies to ensure effective remedies on the other. This governance gap appears particularly accentuated in the context of PMSC’s involvement in migration control, where states’ willingness to contain and deter migration is matched by a marked increase, over the last two decades, in the criminalizationFootnote ²² and securitizationFootnote ²³ of migration, including through cooperation with countries in the region of originFootnote ²⁴ and with private security actors.

As explained in this Section, to define a business operational context as “high risk,” it is necessary to take into consideration the human rights abuses taking place throughout a company’s business operations. This means that a company should not only be aware of the abuses taking place within the specific countries in which it operates, but also consider the broader context of its activities, and ascertain both the actual and potential adverse human rights impact related to such contexts.Footnote ²⁵ It is important to note that all conflict-affected contexts—irrespective of their legal classification and of whether the armed conflict is still ongoing or has subsided—will entail a high prevalence of human rights abuses, and therefore pose a high risk for a company to become involved in them. Various other complex operational contexts, however, even though not necessarily related to armed hostilities, will also qualify as “high risk.” For the purposes of our analysis, the provision of services that enable and contribute to migration policies resulting in human rights abuses also constitute high-risk contexts and high-risk business operations. Consider, for instance, the provision by the Nakamoto Group of substandard medical care in United States Immigration and Customs Enforcement’s (ICE) immigration detention centers,Footnote ²⁶ which has led to detainees dying of treatable and preventable diseases.Footnote ²⁷ Similarly, in US states and cities where the ICE is increasingly relying on the use of ankle bracelets as a “more humane” alternative to immigration detention,Footnote ²⁸ Global Positioning System (GPS) tracking and supervision services are increasingly outsourced to private security companies.Footnote ²⁹ This electronic monitoring practice has raised concerns not only in terms of privacy rights, data sharing, and health implications of wearing the device,Footnote ³⁰ but also in relation to the lawfulness of this outsourcing, which often results in an automatic ineligibility for bail or in a rise in the level of immigrants’ indebtedness. The high costs for the cash bond (on average USD 8,000–10,000) and for the GPS tracking services, in fact, are passed on to the detainees wearing such electronic devices. Security companies provide financing to those who cannot afford the cash bond but, in return, the detainees must pay for activating the ankle bracelet (USD 460); for leasing it and being tracked (USD 420 per month for the duration of the “bail);”Footnote ³¹ and ultimately for repaying the cash bond. If they cannot afford to pay, they are usually returned to detention in inhuman and degrading conditions.Footnote ³²

While there is no agreed-upon definition of “high-risk areas,”Footnote ³³ and Principles 7 and 23(c) of the UNGP only refer to conflict-affected areas and the heightened risk of gross human rights abuses there, it is possible to refer to other relevant definitions to evince the scope and content of these terms. The Organization for Economic Cooperation and Development (OECD), for instance, defines “conflict-affected and high-risk areas” as follows:

Similarly, the EU definition of “conflict-affected and high-risk areas” characterizes them as “[a]reas in a state of armed conflict, fragile post-conflict areas, as well as areas witnessing weak or non-existing governance and security, such as failed states, and widespread and systematic violations of international law, including human rights abuses.”Footnote ³⁵ The guidance produced by the UN Global Compact and the UN Principles for Responsible Investment initiative also clarified that the terms “conflict affected” and “high risk areas” could include situations “in which there are serious concerns about abuses of human rights and political and civil liberties, but where violent conflict is not currently present.”Footnote ³⁶ Both of these definitions therefore treat “conflict-affected areas” as an example of “high-risk areas” generally.

As illustrated by the examples presented above, if we apply the above contextual definitions to current situations in which migration control operations are implemented, various elements of such operations clearly suggest that they are taking place in high-risk areas and/or in contexts that increasingly entail high-risk operations, irrespective of the existence of an armed conflict. For instance, a closer examination of the cooperation between Italy and Libya indicates that Libya’s territory, both on land and at sea, represents a crucial theatre of Italian and EU migration control operations. The memorandum of understanding between Italy and Libya, signed in 2017Footnote ³⁷ and renewed in autumn 2019,Footnote ³⁸ includes cooperation on migration control, whereby Italy provides training and equipment to the Libyan coast guard to intercept EU-bound irregular migrants at sea and return them to Libya. Irrespective of whether we consider the situation on the ground in Libya to amount to a situation of armed conflict or to a post-conflict situation, Libya qualifies as a conflict-affected country as understood by UNGP 7. Given the well-documented widespread violations of international law, including human rights abuses against migrants, occurring both in Libyan territorial waters and in official and unofficial detention centers around the country, Libya also meets the criteria of a high-risk area as defined above. PMSC have been supplying advanced border control systems to Libya for at least a decade,Footnote ³⁹ when conditions in Libyan detention centers were already such as to amount to torture or inhuman and degrading treatment, and return to Libya to refoulement because it exposed them to the risk of ill-treatment. The decision by the European Court of Human Rights in Hirsi Jamaa and Others v. Italy,Footnote ⁴⁰ indeed, found that the prohibition against refoulement was breached by Italy’s interception and pushback of migrants to Libya in 2008. This was because the Italian authorities knew or should have known that the people returned to Libya “would be exposed in Libya to treatment in breach of the [Convention] and they would not be given any kind of protection in that country,” in breach of Article 3 of the European Convention of Human Rights (ECHR).Footnote ⁴¹ Human rights reports unanimously suggest that the situation has not improved since.Footnote ⁴² Any business involving the provision of advanced border control systems to Libyan authorities in such a context would be at risk of causing or contributing to human rights abuses, as they would be at risk of contributing to the implementation of the migration control operations found in contravention of Article 3 ECHR.

UNGP 23(c) makes explicit reference to “gross human rights abuses.” The commentary to this principle mentions conflict-affected areas as an example of complex operating environment in which the risks of enterprises being complicit in such abuses committed by other actors may increase.Footnote ⁴³ Although the UNGP do not define “gross abuses,” already in 1999, UN independent expert Cherif Bassiouni confirmed that the same contextual approach pertaining to high-risk contexts is also relevant to defining the term “gross violation of human rights.”Footnote ⁴⁴ This term, he explained, is used to “describe situations involving human rights violations by referring to the manner in which the violations may have been committed or to their severity,” rather than to denote a specific category of violations. In this sense, it is employed with reference to the factual circumstances of the abuse, thus also to the operational contexts in which business activities are carried out. The Interpretive Guide to the UNGP drafted in 2012 by the Office of the High Commissioner for Human Rights (OHCHR) provides a non-exhaustive list of examples and refers to the gravity of the abuse:

The commentary to UNGP 14 also clarifies that the “severity of impacts will be judged by their scale, scope and irremediable character.”Footnote ⁴⁶ The OHCHR Interpretive Guide further explains that the impact of business activities will be deemed to be severe based on the gravity of the harm, the number of people affected—both immediately and in the future— and whether it is possible to “restore those affected to a situation at least the same as, or equivalent to, their situation before the adverse impact.”Footnote ⁴⁷ Based on the above, there is little doubt that the harm risked by the migrants returned to Libya—at the time of the circumstances described in the Hirsi case as well as in those pertaining to current migration control operations—entails severe impacts,Footnote ⁴⁸ meaning that there is a high risk of gross human rights abuses in Libya.

As discussed above, beyond conflict-affected contexts such as the one in Libya, other transnational migration control operations increasingly take place in highly volatile and securitized environmentsFootnote ⁴⁹ where the severity of the impact (in terms of scale, scope and irremediable character) is such that there is a high risk of involvement in gross human rights abuses. Drones, border patrol vehicles and vessels, cameras, facial recognition systems, thermal vision equipment, biometric and surveillance systems are increasingly supplied and managed by PMSC to carry out migration control measures.Footnote ⁵⁰ Thus, while the border security apparatus rapidly expands,Footnote ⁵¹ the business opportunities for PMSC are also set to increase because of their long-standing expertise in highly securitized and unstable environments. As already mentioned above, the same PMSC do not only provide high-tech security systems, but also essential services for refugees and asylum seekers, such as access to health care and housing, food, and cash cards. These essential services are not only increasingly privatized, because they are outsourced to for-profit private non-state actors, but also increasingly securitized, as they are provided as part of broader security service “packages” offered by PMSC. In turn, as externalization and containment become the primary aims of migration control policies, and reflect a rising hostility against migrants,Footnote ⁵² the risk of PMSC’s direct and indirect involvement in gross abuses at various stages of the migration journey increase. As explained in this Section, PMSC can be implicated in gross human rights abuses in various ways. Thus, the presence of an armed conflict is not definitive in ascertaining whether a business enterprise is exposed to a high risk of being involved in gross human rights abuses. What is key, instead, is understanding the operational context in which a company operates, and the severity of the actual and potential adverse human rights impact that it might have.

II. Home States’ Obligations in High-Risk Situations

A careful reading of the UNGP clearly reveals that whenever companies become involved in the implementation and operationalization of migration control, they embark in high-risk operations, that is to say business operations that entail a high risk of gross abuses.

Where the risk of gross human rights abuses is heightened, the UNGP recognize under pillar one the existence of heightened obligations vested upon the home state of the PMSC and heightened responsibilities for the companies themselves. According to UNGP 7, in fact, home states of PMSC involved in the implementation of migration policies which engender a high risk of gross human rights abuses are expected to “help them identify, prevent and mitigate the human rights-related risks of their activities and business relationships” and “to assess and address heightened risks of abuses.”^{Footnote 53} As further explained in the commentary to UNGP 7^{Footnote 54} and in another United Nations Human Rights Council report in an addendum to the UNGP,^{Footnote 55} home states’ engagement is not to be understood as replacing but as complementing the engagement of host states where the PMSC are deployed. Engagement by home states should be proactive and take place as early as possible, in order to help companies avoid involvement in human rights abuses before the situation escalates.^{Footnote 56} UNGP 7, as discussed above, refers specifically to gross abuses and, therefore, concerns human rights abuses of a severe nature, because of their gravity, scale, scope, and irremediability.^{Footnote 57} The grossness of the abuse, therefore, is reinforced by the increased likelihood of occurrence^{Footnote 58} and both demands that home states are not only proactive and supportive of cooperative companies, but also that they deny “access to public support and services for a business enterprise that is involved with gross human rights abuses and refuses to cooperate in addressing the situation.” Crucially, UNGP 7(d) also requires home states to “ensur[e] that their current policies, legislation, regulations and enforcement measures are effective in addressing the risk of business involvement in gross human rights abuses.” The addendum report on conflict-affected areas confirms that home states should establish adequate regulatory frameworks; clarify the applicability of such frameworks to business entities; and—for the most extreme situations—“make sure that the relevant agencies are properly resourced to address the problem of business involvement in international or transnational crimes, such as corruption, war crimes or crimes against humanity.”^{Footnote 59} The commentary to UNGP 7 further clarifies that states should also “consider multilateral approaches to prevent and address [gross human rights abuses], as well as support effective collective initiatives.”^{Footnote 60}

At this point, it is important to note that the broader debate over whether a home state has a general duty, in international law, to regulate the transnational activities of a company registered in its territory and/or jurisdiction, continues to generate a vast amount of literature.^{Footnote 61} This is partly because when the UNGP were adopted in 2011, the commentary to UNGP 2 took a conservative approach to the debate by stating that “[a]t present States are not generally required under international human rights law to regulate the extraterritorial activities of business domiciled in their territory and/or jurisdiction. Nor are they generally prohibited from doing so, provided there is a recognized jurisdictional basis.” While the general debate in international law is thus far from settled, it is relatively uncontroversial^{Footnote 62} to state that in high-risk contexts, because of the nature of gross abuses and of their high likelihood of occurrence, home states have a duty to appropriately and effectively regulate the transnational conduct of business enterprises in order to prevent business-related human rights abuses. The 2013 OHCHR report on corporate liability for gross human rights abuses clarified that, although the UNGP are technically a non-binding instrument,

III. Business Responsibility in High-Risk Situations

The provisions under pillar two of the UNGP provide that, in light of their responsibility to respect human rights, business enterprises should avoid infringing on the rights of others and address negative impacts that they have caused or contributed to. The primary mechanism to operationalize this responsibility to respect is human rights due diligence,Footnote ⁶⁴ which essentially consists of a set of processes aimed at ensuring that a company assesses its actual and potential “adverse impacts”; takes action when such adverse impacts are identified; tracks and communicates to relevant stakeholders the ways in which it addresses such impacts; and contributes to remediating them. As I have argued so far, PMSC involved in migration control operate in high-risk contexts, which demand a heightened responsibility to respect human rights, including in terms of how to carry out human rights due diligence and the type of remediation mechanisms that they are required to provide.

Pillar two of the UNGP contains provisions related to the corporate responsibility to respect human rights. UNGP 17, more specifically, refers to human rights due diligence as an ongoingFootnote ⁶⁵ risk-assessment process that companies are required to carry out—across their operations, products and services, as well as throughout their supplier and business partner networksFootnote ⁶⁶—in order to “identify, prevent, mitigate and account for how they address their adverse human rights impacts.”Footnote ⁶⁷ UNGP 17(b) confirms the relevance of ascertaining the severity of the impacts that a company may have and the nature of its operational context, by stating that the complexity of the human rights due diligence process will vary depending on “the size of the business enterprise, the risk of severe human rights impacts, and the nature and context of its operations.”Footnote ⁶⁸

When examining high-risks contexts, it is important to read UNGP 17 in conjunction with UNGP 23(c), which requires business enterprises to “treat the risk of causing or contributing to gross human rights abuses as a legal compliance issue wherever they operate.”Footnote ⁶⁹ This means that companies “should treat this risk in the same manner as the risk of involvement in a serious crime, whether or not it is clear that they would be held legally liable.”Footnote ⁷⁰ The vigilance required of company lawyers is due to the severity of the human rights abuses involved, but also to “the expanding legal boundaries, including territorial boundaries … irrespective of the status of the law where the business activity is taking place.”Footnote ⁷¹ UNGP 24 is also relevant in high-risk contexts, as it refers to situations where companies may be unable to address all adverse human rights impacts simultaneously. According to UNGP 24 and related commentary, companies should address all their adverse impacts, but where necessary, they “should first seek to prevent and mitigate those that are most severe or where delayed response would make them irremediable.”Footnote ⁷² This means that companies should always have a clear and comprehensive understanding of the severity of the abuses that they become involved in and/or contribute to, in terms of scale and scope of the abuses but also in terms of the irremediable nature of the harm. It is important to emphasize that the primary focus of the human rights due diligence process, therefore, is not on the risk to the company, but on the higher risk to which refugees and migrants are exposed throughout migration control operations.Footnote ⁷³ PMSC, therefore, should consider both the likelihood and severity of the risk, and be aware that often the high risk of gross abuses may be so pervasive that it becomes almost impossible for a PMSC not to be involved in them. A joint reading of UNGP 17, UNGP 23 and UNGP 24, therefore, demands that whenever PMSC are involved in high-risk operations, they should not only ascertain the likelihood of their involvement in or contribution to gross abuses, but also prioritize actions to prevent and address the most severe impacts. The continued involvement of PMSC in migration policies of containment and deterrence, therefore, appears to ignore both the home states’ obligation to protect human rights and the companies’ responsibility to respect them, as specifically articulated in the UNGP for high-risk contexts. In the next Section, I explain in more detail how these obligations and responsibilities might help us go beyond the so-called “governance gap” identified in business and human rights and address the accountability gap that continues to characterize business-related abuses in migration control contexts.

I. The Challenge of Attributing Business Conduct to a State

Commentators have discussed the challenges raised by migration control operations in terms of allocation of responsibility for violations of human rights when multiple actors are involved in a breach of international law.Footnote ⁷⁴ For the purposes of this Article, and as mentioned in Section B, cooperation between states and PMSC in cross-border migration control activities presents an additional layer of complexity because of the non-state actor status of PMSC. Since attribution of conduct is a precondition of state responsibility, attempts have been made at ascertaining whether a non-state actor’s wrongful conduct is attributable to the collaborating state—in our case, usually the state engaging the services of the PMSC or, under certain circumstances, the home state.

The rules on attribution most relevant to our discussion on transnational PMSC’s migration control activities are those under Articles 5 and 8 of the Draft Article on Responsibility of States for International Wrongful Acts (ARSIWA).Footnote ⁷⁵ As confirmed by paragraphs 2 and 3 of the commentary to Chapter II, on attribution of conduct to a State, the general rule is that the conduct of private persons is not attributable to the state. This is because only the conduct of organs of government of a state or of agents of a state can be attributable. Article 5 ARSIWA, relating to the exercise of certain elements of governmental authority by a non-state actor (a person or entity which is not an organ of the state), is relevant because PMSC often carry out activities which would normally be performed by the state, such as the security and management of detention centers and the provision of essential services to asylum seekers and migrants, for example, services related to health, accommodation, and food. According to Article 5 ARSIWA, such private conduct is only attributable to the state if there is a legal act by the state empowering the non-state actor.

According to paragraph 2 of the commentary to Article 5 ARSIWA, only in special cases the term “entity” may include private companies, and in any case such entity will have to be “empowered by the law of the State to exercise functions of a public character normally exercised by State organs, and the conduct of the entity [must be related] to the exercise of the governmental authority concerned.”Footnote ⁷⁶ Paragraph 2 also provides the example of private security firms contracted to provide services as prison guards, exercising powers of detention and discipline. Such powers, however, will only be provided by national prison regulations or pertain to the enforcement of a judicial sentence. PMSC’s transnational activities, instead, are usually regulated by contractual agreements stipulated between the state and the company itself. Such contracts will usually not be a sufficient legal instrument to empower the PMSC with governmental authority. This is because the services in which they engage, although they would be normally performed by the state, are not necessarily regulated by law. Immigration detention, for instance, is usually of an administrative nature and as such it will not be covered by regulations pertaining to prisons and detention centers in the criminal justice system.

In the absence of such formal legal empowerment by the state, a PMSC’s conduct can be attributed to the state in accordance with Article 8 ARSIWA if the private non-state actors act on the instructions of, or under the direction or control of a state. Thus, responsibility of the contracting state will only be engaged if it can be proven, either by the wording of the contract or by the facts, that the company acted under the instructions of the state in carrying out the wrongful conduct or that it acted under the direction or control of the state.Footnote ⁷⁷ Human rights abuses or other wrongful conduct generally fall outside of the substantive scope of such contractual arrangements, so it would be difficult, based on the contract alone, to prove that the PMSC acted under the instruction of the hiring state.Footnote ⁷⁸ Similarly, the wording of the contract would not be sufficient to prove that the state has otherwise directed or controlled the conduct of the PMSC, since the contract would specify the activities to be carried out, but PMSC are generally quite independent in the planning and execution of their activities. This means that the threshold of state dependence established by Article 8 for attribution of a PMSC’s conduct to the state would usually not be met. Similarly, the conduct of PMSC acting outside of the scope of what has been contractually agreed will also not be attributable to the state.Footnote ⁷⁹

II. Positive Obligations and Their Evolving Character

It is because of these difficulties in identifying a valid attribution link between the state and the private non-state actor that international legal scholars often turn to the doctrine of positive obligations,^{Footnote 80} or what in business and human rights terms, as explained in Section B, is referred to as the home state’s obligation to protect from corporate abuse under pillar one of the UNGP. UN Treaty Bodies^{Footnote 81} have increasingly recognized in their work the relevance of a state’s positive obligations in relation to the conduct of private companies. The Human Rights Committee, which monitors compliance with the International Covenant on Civil and Political Rights (ICCPR),^{Footnote 82} for instance, has referred to positive obligations in relation to two Articles which are of particular relevance for the context of migration control: Article 6 (right to life)^{Footnote 83} and Article 7 (prohibition of torture, or other cruel, inhuman or degrading treatment or punishment).^{Footnote 84} General Comment 36 on the right to life is of specific significance because, at the moment of writing, it is the most recent General Comment issued by the HRC. Despite the fact that General Comments by UN Treaty Bodies are not legally binding instruments, they provide highly authoritative interpretations of the content of the rights and of the legal nature of the obligations enshrined in the relevant international human rights instruments.^{Footnote 85}

Paragraph 21 of General Comment 36 clarifies that state parties to the ICCPR have a “due diligence obligation to take reasonable, positive measures that do not impose disproportionate burdens on them in response to reasonably foreseeable threats to life originating from private persons and entities whose conduct is not attributable to the State.”^{Footnote 86} Furthermore, adequate protective measures “must be taken to prevent, investigate, punish and remedy arbitrary deprivation of life by private companies, such as private transportation companies, private hospitals, and private security firms.”^{Footnote 87}

At first sight, with the above interpretation, the HRC seems to contradict the commentary to UNGP 2, which claims that states generally do not have an obligation to regulate. This latter approach is put forward by the UNGP despite clear evidence from the work of the UN OHCHR on accountability and effective remedies,^{Footnote 88} that weak, incoherent, and inconsistent regulation by both home and host states creates legal uncertainties and inefficiency, and imposes additional costs and complexity when it comes to enforcement.^{Footnote 89} John Ruggie, former UN Special Representative of the Secretary General on issues of business and human rights, and architect of the UNGP, has recently reiterated this stance when addressing concerns expressed in 2019 by Swiss business associations during discussions on national mandatory human rights due diligence. The associations had argued that such a mandatory requirement was in contradiction with the UNGP and had questioned the jurisdiction for legislation on extraterritorial business activities. In his response,^{Footnote 90} Ruggie explained that legislation requiring businesses to meet their responsibility to respect human rights was not in contradiction with the UNGP. Rather, he argued, UNGP 3 already clarified that states are expected to adopt a regulatory “smart mix” of measures—national and international, voluntary and mandatory—to encourage, support, and incentivize business enterprises. To assuage the concerns expressed by Swiss business associations in relation to legislation with extraterritorial effect, Ruggie also repeated verbatim the content of the commentary to UNGP 2, according to which “under international human rights law states are not generally required to regulate the extraterritorial activities of businesses domiciled in their jurisdiction, but nor are they generally prohibited from doing so provided there is a recognized jurisdictional basis.”^{Footnote 91} The UNGP, at the same time, acknowledge the progressive work of the UN Treaty Bodies and recognize that the provisions concerning the regulation of transnational business activities pertain to an evolving area of international law.^{Footnote 92}

Some elements of this evolution, it can be argued, are present in the work of the HRC, which interpreted the provisions of Article 2(1) ICCPR, according to which Covenant obligations are owed by a state party to “all individuals within its territory and subject to its jurisdiction,” as meaning all persons over whom it exercises power or effective control. In relation to the right to life, this “includes persons located outside any territory effectively controlled by the State whose right to life is nonetheless affected by its military or other activities in a direct and reasonably foreseeable manner.”^{Footnote 93} In General Comment 36, the HRC further clarified the situation in which home states of a company have an obligation to regulate, by affirming that state parties

The work of the UN Committee on Economic Social and Cultural Rights (CESCR) is also important when it comes to states’ obligations in relation to the business conduct. General Comment 24,^{Footnote 95} in particular, explicitly states that the obligation to protect also applies extraterritorially, requiring states to “take steps to prevent and redress infringements of Covenant rights that occur outside their territories due to the activities of business entities over which they can exercise control, especially in cases where the remedies available to victims before domestic courts of the state where the harm occurs are unavailable or ineffective.”^{Footnote 96}

The reference to the exercise of control over business entities operating abroad contained in General Comment 24 is reminiscent of Article 8 ARSIWA, but at paragraph 32 the CESCR clarifies that, although state responsibility for the wrongful conduct of private non-state actors is only engaged when such conduct can be attributed to the state, states would be in breach of their human rights obligations “where the violation reveals a failure by the State to take reasonable measures that could have prevented the occurrence of the event.”^{Footnote 97} In the CESCR’s view, it is thus possible to engage the responsibility of the state “even if other causes have also contributed to the occurrence of the violation, and even if the State had not foreseen that a violation would occur, provided such a violation was reasonably foreseeable.”^{Footnote 98} In such cases, the responsibility of the state does not arise for the abuse that a company has caused or contributed to, but for the state’s failure to protect from such abuse when the state knew or ought to have known of its likely occurrence, but failed to take reasonable steps to prevent it. The obligation to protect, predicated upon this lower threshold of foreseeability, is a due diligence obligation vested upon the state, and as such an obligation of conduct rather than of result.^{Footnote 99}

The CESCR is not alone in advancing this understanding of extraterritorial obligations. Tilmann Altwicker, for instance, refers to this extraterritorial obligation to protect as “the external dimension of a transnational obligation to protect,” which in his view was already identifiable in the International Law Commission Draft Articles on the Prevention of Transboundary Harm from Hazardous Activities.^{Footnote 100} Under Article 3 of such Draft Articles, when lawful hazardous activities are planned or carried out in the territory of a state or otherwise under the jurisdiction or control of a state,^{Footnote 101} the latter is under an obligation to “take all appropriate measures to prevent significant transboundary harm or at any event to minimize the risk thereof.”^{Footnote 102} This includes hazardous transboundary activities conducted by private persons or enterprises in which case a state is required to establish and implement an appropriate regulatory framework rather than get involved in a company’s operational issues.^{Footnote 103}

Similarly, the Committee on the Rights of the Child (CRC Committee)^{Footnote 104} refers to the need to identify “a reasonable link between the State and the conduct concerned”^{Footnote 105} when it comes to an obligation to enable access to an effective remedy, judicial and non-judicial, when rights are violated by business enterprises abroad. As examples of measures suitable to prevent the infringement of children’s rights by companies operating abroad, the CRC Committee includes making state support, such as public finance and insurance, conditional on a business carrying out appropriate and effective human rights due diligence and recommends the vetting of a company’s prior record on children’s rights.^{Footnote 106}

III. Positive Obligations in High-Risk Contexts

As I have explained in Section B, it is at this juncture that the conceptualization of PMSC’s involvement in migration control activities as “high-risk” operations becomes particularly useful, especially to overcome potential issues of jurisdiction. Legal scholars and practitioners continue to disagree over whether and when a state’s obligation to protect from third parties’ interference with the enjoyment of human rights applies to transnational activities.^{Footnote 107} The main obstacle to the application of a state’s obligation to protect, in some cases, remains the issue of jurisdiction, that is to say the applicability of the relevant international legal instrument in which the obligation is enshrined. As seen above, on the one hand, state parties to a human rights treaty that contains a jurisdiction clause, such as the ICCPR, the Convention on the Rights of the Child, or the European Convention on Human Rights, have obligations when they have effective control over a territory (spatial mode of jurisdiction) or over a person (personal mode of jurisdiction).^{Footnote 108} The CESCR, on the other hand, interprets the obligations under the ICESCR as being “without any restriction linked to territory or jurisdiction.”^{Footnote 109}

It is important to note that the debate over the obligation to regulate mainly concerns general duties, rather than specific duties applicable in high-risk situations where obligations and responsibilities, as explained in Section B, are understood as having a heightened character. Very much in line with the interpretations of the UN Treaty Bodies, the UNGP confirm that high-risk contexts, such as the ones pertaining to the implementation of migration policies and the involvement of PMSC therein, demand the special engagement of home states. They require appropriate regulation aimed at preventing business-related abuse and stopping the abuse that is identified and already occurring. The high risk of gross abuses taking place in migration control contexts means that a failure by the home state to take appropriate steps to protect individuals from abuse which is reasonably foreseeable, wherever this abuse may occur, would amount to a breach of its positive obligation to protect. PMSC, in turn, have a heightened responsibility to respect human rights and treat the risk of gross abuses as a legal compliance issue, that is to say, in the same manner as they would treat the risk of being involved in a serious crime, irrespective of whether this is prescribed by law where the business activity is taking place. Regulation of transnational business conduct is important because when it comes to PMSC’s involvement in migration control, especially in the contemporary context of containment and deterrence, the individuals suffering abuse are hardly ever within the territory of the state contracting with the PMSC or within the territory of the PMSC’s home state. Most commonly, in transnational migration control operations the individual is located outside of the territory of the relevant state and the unlawful conduct of the PMSC, when it occurs, cannot be easily attributed to the state.^{Footnote 110} To obviate situations in which states purposely cooperate with other states or with private non-state actors in order to exploit the jurisdictional threshold and circumvent responsibility, scholars have called for a functional approach to jurisdiction.^{Footnote 111} This approach is based on the fact that indirect perpetration of an international wrong, that is to say a breach by proxy, would also incur responsibility.^{Footnote 112} It remains to be seen, however, whether courts will find this functional approach to jurisdiction persuasive enough for them to adopt it. In the meantime, the “smart mix” identified by the UNGP, including its specific approach to high-risk areas examined in this Article, offers a possible alternative perspective.

As mentioned above, there is evidence of a certain willingness to regulate on the part of both home and host states, but their efforts often remain incoherent and inconsistent.^{Footnote 113} This leads to challenges in ensuring the right to an effective remedy envisaged both in international legal instruments^{Footnote 114} and in the UNGP (pillar 3).^{Footnote 115} The home states of PMSC involved in migration control contexts have also proven to be reluctant to regulate transnational business conduct, as they are usually the very states that have a vested interest in strengthening migration control and in collaborating with other states or private actors to circumvent state responsibility. A reclassification of migration control activities outsourced to PMSC as high-risk operations for the application of the UNGP can help forestall objections to the existence of a home state’s obligation to regulate the transnational activities of its PMSC. Because transnational migration control operations entail a high risk of gross human rights abuses, the UNGP clearly direct us to identify the nature and scope of the heightened obligations vested upon the home states of the PMSC, and the heightened responsibility pertaining to the PMSC themselves. Through a close analysis not only of the provisions in UNGP 7, 17(b), 23(c), and 24 discussed in Section B, but also of recent developments in international law and interpretations provided by the UN Treaty Bodies, it is apparent that the existence of heightened obligations and responsibility applicable in high-risk situations is broadly acknowledged. Such heightened obligations and responsibilities are due to the foreseeability of the harm and ability of the state to prevent it, as well as to the grossness of the abuses and the likelihood of their occurrence in such contexts.

Heightened home states’ obligations to protect entail, at a minimum, a duty to regulate the transnational activities of PMSC domiciled within a state’s territory, and/or under its jurisdiction. Such regulation must be aimed at effectively preventing PMSC from causing, or contributing to, human rights abuses in the course of their transnational operations, as clarified by UN Treaty Bodies and as suggested by a joint reading of UNGP 7, 17(b), 23(c), and 24. This would include the introduction, in the relevant domestic legal framework (pillar one), of mandatory human rights due diligence for PMSC involved in migration control (pillar two), and the provision of effective remedies for the harm deriving from the wrongful conduct of the PMSC (pillar three). Effective remedies would include, inter alia, providing access to the courts of the home state of the PMSC, especially when the courts of the host states are unable to provide effective remedies or are otherwise inaccessible to the victims; and imposing civil and criminal liability on PMSC for their wrongful conduct. Failure to regulate the transnational activities of PMSC would result in a breach of the home state’s obligation to protect from reasonably foreseeable human rights abuses by the PMSC, that is to say a breach of a positive obligation to protect.

Meaningful regulation will have to specify the type of mandatory human rights due diligence required of PMSC and create a system whereby state support to the PMSC—including continued registration and incorporation in the home state—would be made conditional to detailed reporting, auditing and corrective action whenever abuses are identified. PMSC involved in migration control operations also have a heightened responsibility to treat the risk of gross human rights abuses as a legal compliance issue and thus engage in ongoing monitoring and assessment of how they adversely impact human rights. Accordingly, they must also publicly notify harm when encountered and promptly intervene to prevent abuses or stop them if they are already occurring.

Anything short of this heightened approach would hollow out the significance of the UNGP in high-risk situations. Most importantly, a heightened approach would also engage the responsibility of the home state for a failure of its obligation to protect and trigger a requirement to remedy such breach. Non-compliance by the PMSC, in turn, would lead to civil and criminal liability in the relevant domestic frameworks. PMSC, therefore, rather than continuing to actively contribute to border securitization and lobby for increasingly militarized responses to migration flows,^{Footnote 116} will have to legally reconsider whether their engagement in migration control is indeed possible without incurring civil and criminal liability. Articulated in this way, heightened obligations and responsibility could start to obviate jurisdictional issues and complement current approaches to the doctrine of positive obligations. This could offer a possible solution to ensuring both state and corporate responsibility.