8 Is Criminalization Bad For Safety?

The sheer threat of judicial involvement is enough to make people think twice about coming forward with information about an incident that they were involved in.¹ Just imagine how the colleagues of the nurse in the prologue may have felt about this. The nurse, after all, stepped forward voluntarily with her view on the death of the infant. As long as there is fear that information provided in good faith can end up being used by a legal system, practitioners are not likely to engage in open reporting.

Many admit that they will only file a report when there is the chance that other parties will disclose the incident (e.g. an air traffic controller may think that a pilot will report a close call if s/he does not do it; a nurse may feel the same way with respect to a resident physician present during the same event, or vice versa), which would make the event known in any case.

This puts practitioners in a catch-22: Either report facts and risk being persecuted for them, or not report facts and risk being persecuted for not reporting them (if they do end up coming out along a different route). Many seem to place their bet on the latter: Rather not report and cross your fingers that nobody else will find out either.

Practitioners in many industries, the world over, are anxious of inappropriate involvement of judicial authorities in safety investigations that, according to them, have nothing to do with unlawful actions, misbehavior, gross negligence, or violations.

They are not alone in their anxiety. Operational organizations, and even regulatory authorities (which fall under departments or ministries other than justice—e.g. transportation) are concerned that their safety efforts, such as encouraging incident reporting, are undermined.² But what is it, exactly, that people are afraid of? Judicial involvement can consist of:

• The participation of law enforcement officials in investigations. There are countries in the developed world where the police is witness or even participant in accident investigations (in, for example, road traffic or aviation). This can impede investigatory access to information sources, as pressures to protect oneself against criminal or civil liability can override any practitioner's willingness to cooperate in the accident probe.
• Judicial authorities stopping an investigation altogether or taking it over when evidence of criminal wrong-doing emerges. This often restricts further access to evidence for safety investigators.
• Launching a criminal probe independent of a safety investigation or its status. Accident investigation boards in many countries say that this severely retards their efforts to find out what went wrong and what to do to prevent recurrence.³
• Using a formal accident report in a court case. Even though using such reports as evidence in court is proscribed through various arrangements, these routinely get overridden or circumvented. And, in any case, nobody can prevent a prosecutor or judge from reading a publicly-available accident report.
• Getting access to safety-related data (e.g. internal incident reports) because of freedom-of-information legislation in that country, under which any citizen (including the judicial system) has quite unfettered access to many kinds of organizational data. This access is particularly acute in organizations that are government-owned (such as many air traffic control providers, or hospitals).
• Taking the results of a safety inspection if these expose possibly criminal or otherwise liable acts. This does not have to take much: An inspection report listing "violations" (of regulations, which in turn are based in law) can be enough for a prosecutor to start converting those violations (which were discovered and discussed for the purpose of regulatory compliance and safety improvement) into prosecutable crimes.

The safety manager for one organization told me how the person involved in an incident flatly refused that the incident be used for recurrent training, precisely because of the perceived risk of persecution. Even assurances of complete anonymity and de-identification of incident data were not enough to sway the practitioner. While understandable, this denied colleagues an opportunity to engage in a meaningful lesson from their own operation. Normal, structural processes of organizational learning are thus eviscerated; frustrated by the mere possibility of judicial proceedings against individual people.

In all of these ways, judicial involvement (or the threat of it) can engender a climate of fear and silence. In such a climate it can be difficult, if not impossible, to get access to information that may be critical to finding out what went wrong, or what to do to not have it happen again. Here is another example of what that can lead to.

A prosecutor responsible for aviation decided to launch what she termed a "test case."⁴ The crew of a large passenger jet on take-off had suddenly seen another aircraft, being towed by a truck, cross the runway in front of them. Immediately they aborted their take-off and stopped before reaching the intersection. Nobody was hurt. The air traffic control organization, as well as the country's independent transportation safety board, both launched investigations and arrived at pretty much the same conclusions. After unclear radio transmissions with the tow truck driver, an assistant controller had passed her interpretation of the tow's position to the trainee controller responsible for the runway. The assistant controller did not have a screen that could show ground-radar pictures. The trainee controller did, and took the position of the tow at the edge of the runway to mean that the crossing had been completed. Buttons on a newly-added panel in the tower for controlling lighted stop-bars at runway intersections proved ambiguous, but at the time all looked in order, and he cleared the other jet for take-off. Meanwhile, the coach of the trainee controller was performing supervisor duties in the tower. The account, in other words, was straightforward in its complexity: Mixing elements of interface design, production pressure, weather conditions, handovers, short-staffing, screen layouts, and communication and teamwork—among many other factors. This, the safety community knows, is what organizational incidents and accidents are made of. Many factors, all necessary and only jointly sufficient, are required to push a system over the edge of breakdown. And all of those factors are connected to normal people doing normal work in what seems a perfectly normal organization. These factors, then, are also the stuff of which recommendations for improvement are made. And they were, also in this case. The sir traffic control organization issued no fewer than 23 recommendations, all of them aimed at rectifying systemic arrangements in, for example, design, layout, staffing, coaching, communications, and handovers. The independent safety investigation board issued nine, quite similar, recommendations. This, as far as the community was (and is) concerned, is how the incident cycle was supposed to work. A free lesson, in which nobody got hurt, was milked for its maximum improvement potential. The people involved had felt free to disclose their accounts of what had happened and why. And they had felt empowered to help find ways to improve their system. Which they then did, for everybody's benefit.

But two years after the incident, the aviation prosecutor of the country decided to formally charge the coach /supervisor, the trainee, and the assistant controller with "the provision of air traffic control in a dangerous manner, or in a manner that could be dangerous, to persons or properties" (the country's law actually contains such provisions). Each of the three controllers was offered a settlement: They could either pay a fine or face further prosecution. Had they paid the fine, the prosecutor would have won her "test" and the door for future prosecutions would have stood wide open. The controllers collectively balked. A first criminal court case was held a year and a half after the incident. The judge ruled that the assistant controller was not guilty, but that both the trainee and the coach/supervisor were. They were sentenced to a fine of about 450 US dollars or 20 days in jail. The trainee and the coach/supervisor decided to appeal the decision, and the prosecutor in turn appealed against the assistant controller's acquittal.

More than a year later, the case appeared before a higher court. As part of the proceedings, the judges, prosecutor, and their legal coterie were shown the airport's tower (the "scene of the crime"), to get a first-hand look at the place where safety-critical work was created. It was to no avail. The court found all three suspects guilty of their crime. It did not, however, impose a sentence. No fine, no jail time, no probation. After all, none of the suspects had criminal records and indeed: The air traffic control tower had had its share of design and organizational problems. The court had found legal wiggle room by treating the case as an infringement of the law, as opposed to an offense. It was as if they were proving themselves right and wrong at the same time. The court was wrong to bring and prosecute the case because there was no offense, but did not waste tax money after all because they managed to find an infringement. This was actually a no-brainer, as an infringement means "guilt in the sense that blame is supposed to be present and does not need to be proven." The only admissible defense against this is being devoid of all blame. This would work only if the air traffic controller was off-duty and therefore not in the tower to begin with. It was a celebration of perverse formalism (to use Judge Thomas' words): A decorous nod to the prosecutor who had gone out to test the waters, and a measly but still unsettling warning to air traffic controllers and other professionals that they were not above the law. And it stopped all appeals: Appealing an infringement is not possible as there is no conviction of an offense, and no punishment. The real punishment, however, had already been meted out. It was suffered by the safety efforts launched earlier by the air traffic control organization, particularly its incident reporting system. Over the two years that the legal proceedings dragged on, incident reports submitted by controllers dropped by 50 per cent.

Many people, especially from the various professional communities, are duly concerned. The Secretary-General of a worldwide association of air traffic control providers warned of "grave and undesirable consequences for safety" when judicial systems get involved.⁵

But Isn’t There Anything Positive About Involving the Legal System?

Some in the legal community see the criminalization of error as a long-overdue judicial colonization of rogue areas of professional practice. It is, they say, a clamp-down on closed, self-serving, and mutually protective professional "brotherhoods" that somehow assert a special status and hold themselves to be above the law. Law is seen as authoritative, neutral, and fair, and it should reign equitably over everybody (hence Lady Justitia's blindfold): There should be no exception or discrimination either way.⁶

An increasingly vocal consumer movement, wanting greater control over safety in a variety of products and services, has been seen as sponsoring this view.⁷ Pilots, doctors, air traffic controllers—already adequately compensated monetarily for the responsibility bestowed upon them—should be treated like everybody eke. If they commit a culpable act, they should be held accountable for it. Exceptionalism is anti-democratic.

There is no evidence, however, that the original purposes of a judicial system (such as prevention, retribution, or rehabilitation—not to mention getting a "true" account of what happened or actually serving "justice") are furthered by criminalizing human error.

• The idea that a charged or convicted practitioner will serve as an example to scare others into behaving more prudently is probably misguided: Instead, practitioners will become more careful only in not disclosing what they have done.
• The rehabilitative purpose of justice is not applicable either, as there is usually little or nothing to rehabilitate in a pilot or a nurse or air traffic controller who was basically just doing her or his job.
• Also, correctional systems are not equipped to rehabilitate the kind of professional behaviors (mixing medicines, clearing an aircraft for takeoff) for which people were convicted.

Not only is the criminalization of human error by justice systems a possible misuse of tax money—money that could be spent on better ways to improve safety—it can actually end up hurting the interests of the society that the justice system is supposed to serve. Indeed, other ways of preventing recurrence can be much more effective:

Alan Merry dryly remarked: "The addition of anti-hypoxic devices to anesthetic machines and the widespread adoption of pulse oximetry have been much more effective in reducing accidents in relation to the administration of adequate concentrations of oxygen to anesthetized patients than has the conviction for manslaughter of an anesthetist who omitted to give oxygen to a child in 1982.⁸

If you want people in a system to account for their mistakes in ways that can help the system learn and improve, then charging and convicting a practitioner is unlikely to do that.

Judicial Proceedings and Justice

But wait, you may say, doesn't the legal system help society understand what went wrong and why, and what we can do about it? The chances that a legal system will tease out a meaningful and just account of what happened are actually remote. It is not its charter and even if it were, it is not particularly good at it.

Go back again to the nurse's case from the prologue: Heaping all responsibility for the baby's death on her shoulders made no historical sense whatsoever, and it was really hard to see this as fair or just. Lots of other people had been involved, and she had not even administered the drug in question. The judicial proceedings in the aftermath of the baby's death, through sheer design and rules of relevancy, played down or ignored these other contributions. It ended up with an account of a complex system failure that contradicted decades of research into how such accidents actually happen.

The potential for bad outcomes lies baked into the very activity that we ask practitioners to do for us. The criminal trial of the airline captain fromChapter 2, for example, found him guilty of "endangering his passengers" while flying an approach to a runway in fog. "I do that every day I fly," a colleague pilot had responded. "That's aviation."⁹

Pilots, nurses, doctors, and similar practitioners endanger lives everyday as a matter of course. How something in those activities slides from normal to culpable, then, is a hugely difficult assessment, for which a judicial system often lacks the data, the education, and the expertise. The decision whether to prosecute a practitioner, then, can turn out to be quite haphazard, and the practitioner on the receiving end will likely see this as quite unjust.

In the same year that Mara, the nurse from the Prologue, was first charged, more than 300 severe medication errors were reported to the country's health authority. In another study, a full 89 per cent of responding anesthetists reported having made drug administration errors at some stage in their careers. Most had done so more than once, and 12.5 per cent reported having actually harmed patients in this way.¹⁰ So why the nurse in the Xylocard case, and not one of scores of other medical practitioners who fall victim to similar medication misadventures—all the time, all over the place?

It is the whole point of legal proceedings to narrow in on a few acts by a few individuals or even a single individual. By very nature, however, this clashes with what we know about accident causation in complex, dynamic systems today. Many factors, all necessary and only jointly sufficient, are needed to push a basically safe system over the edge into breakdown. Single acts by single culprits are neither necessary nor sufficient. This, logically, does not make judicial proceedings about complex events "just."

The accounts of an accident that a legal system produces can be so limited in many ways because of the way it conducts its business—among other things through:

• the way judicial proceedings rationalize the search for and consideration of evidence;
• how they closely script turn-taking in speech and form of expression;
• how they limit what is "relevant," are institutionally constrained in their deferral to domain expertise;
• how they necessarily exclude the notion of an "accident" or "human error" because there are typically no such legal concepts.

This is not to deny the relevance or even authority of a legal tradition, at least not on principle. It is, rather, to see it as that: One tradition, one perspective on a case of failure. One way for which prosecutors and judges have received the power to enforce it on others, one language for describing and explaining an event, relative to a multitude of other possibilities.

Another consequence of the accountability demanded by legal systems is that it is easily perceived as illegitimate, intrusive, and ignorant. If you are held "accountable" by somebody who really does not understand the first thing about what it means to be a professional in a particular setting (a ward, a cockpit, a control room, a police beat), then you will likely see their calls for accountability as unfair, as coarse, and uninformed. Indeed, as unjust. Research shows that this results in less disclosure and a polarization of positions, rather than an openness and willingness to learn for the common good.¹¹

Judicial Proceedings and Safety

If judicial processes in the wake of accidents can be bad for justice, what about their effects on safety? Here is a summary of some of the adverse effects:

• Judicial proceedings after an incident can make that people stop reporting incidents. The air traffic control provider in the example in this chapter reported a 50 per cent drop in incidents reported in the year following criminal prosecution of controllers involved in a runway incursion incident. Interestingly, the criminal prosecution does not even have to be started, let alone lead to a conviction: The threat of criminal prosecution can make people reluctant to come forward with safety information.
• Judicial proceedings, or their possibility, can create a climate of fear to share information. It can hamper an organization's possibility to learn from its own incidents. People may even begin to tamper with safety recording devices, switching them off.
• Judicial proceedings can interfere with regulatory work. Some regulators, for example, have become more careful in using language such as "deviation" in their inspection reports. If it is a "deviation" that a regulator takes notice of, it is very likely a deviation from some regulation. And regulations have their basis in law. A "deviation" can then easily become a breaking of the law—a crime, rendering sources at the operator silent as a result Regulators can become much less direct about what is wrong and needs to be done about it.
• Judicial proceedings can help stigmatize an incident as something shameful. Criminalizing an incident can send the message to everybody in the operational community that incidents are something professionally embarrassing, something to be avoided, and if that is not possible, to be denied, muffled, hidden.
• The stress and isolation that practitioners can feel when subject to legal charges or a trial typically makes them perform less well in their jobs. And investing cognitive effort in considering how actions can get you in legal trouble detracts attention from performing quality work.¹² Finally, judicial proceedings in the aftermath of an accident can impede investigatory access to information sources, as people may become less willing to cooperate in the accident probe.¹³ This could make it more difficult for investigators to get valuable information, particularly when judicial proceedings are launched at the same time as the safety investigation. There is, however, a suggestion (at least from one organization) that criminal prosecution in the aftermath of an accident does not dampen people's willingness to report regarding incidents. This could point to a subtlety in how employees calibrate their defensive posture: Accidents, and becoming criminally liable for one, is somehow judged to be qualitatively different from liability for incidents.

While the U.S. National Transportation Safety Board was investigating a 1999 pipeline explosion near Bellingham, Washington, that killed three people, federal prosecutors launched their own criminal probe. They reportedly pressured employees of the pipeline operator to talk. Several invoked the U.S. Constitution's Fifth Amendment, which protects against self-incrimination. They refused to answer questions from Safety Board investigators as well as from the police.¹⁴

Tort Liability

So far, I have basically talked about criminal legal proceedings (and will do so again in the next chapter). This has a reason: There may be a trend toward criminalizing human error. So it is useful to assess whether or not that is a reasonable way to achieve the dual goals of a just culture: Explanations of failure that satisfy calls for accountability and offer opportunities for change and progress on safety. So far, the evidence suggests that criminal law does not contribute to the achievement of these goals.

But another kind, called tort (or civil) liability, has been in use to deal with human error for quite a while, particularly in healthcare. Tort is a legal term that means a civil (as opposed to a criminal) wrong. To be liable under tort law, you do not have to have a formal contract with the other party, as it covers duties for all citizens under a particular jurisdiction (which is true of criminal law too of course). If a court concludes that an action is a crime, then the State can impose punishment (such as imprisonment or fines). If an action is a tort, however, the consequence is usually the payment of damages to the party injured or disadvantaged by the action. Tort law is applicable particularly in legal systems that stem from English common law, but even Napoleonic and other legal systems have ways of compensating victims through civil legal procedures. The technical variations are of course both subtle and many. Also, there can be overlap between crime and tort in some countries: The same action can be prosecuted as a crime (possibly resulting in the State imposing penalties) and as a civil tort (possibly resulting in damages to the victim).

Tort law too has come under criticism for neither contributing to safety nor to justice when it comes to human error:¹⁵'¹⁶

• Tort law is a very irregular mechanism to compensate victims of error. According to one study, only one in seven patients who can be said to have been "negligently" harmed ever gain access to the malpractice system. Those who are older and poorer are disproportionately excluded from access.¹⁷'¹⁸'¹⁹
• Tort law also delivers compensation inefficiently. Administrative costs account for more than 50 per cent of total system costs, and a successful plaintiff recoups only one dollar of every 2.50 US dollars spent in legal and processing costs.²⁰
• Malpractice claims offer only the chance of financial compensation. They do not have as a goal to encourage corrective action or safety improvements, they do not help people get an apology or any other expression of regret or concern.
• Tort law includes practices such as pre-trial discovery and all kinds of rules that govern disclosure and the protection of information. And of course, a trial is in itself adversarial, lining up people against each other in competitive positions. The upshot is that tort law makes it more difficult to get facts out, rather than helping people find out what went wrong and what to do about it so it does not happen again.
• Also, the adversarial process is based on the idea that the presentation of relentless, one-sided arguments to an impartial judge or jury is the best way to get to the "truth." The previous two chapters did acknowledge that multiple stories are necessary if we want to learn anything of value about complex events, but that does not mean only two, necessarily opposing stories, where what is true in one is almost automatically false in the other. The ones who tell these stories are often not the ones who know them best (the physician or the patient), but rather their lawyers, who will have to abstract away from the details and cast things in a legal language that can get far removed from the actual meaning of people's actions and intentions at the time.
• As with criminal trials (which do not deter people from making mistakes but do deter people from talking about their mistakes), tort law promotes defensive practice rather than high quality care.²¹

Summing up the Evidence

The cases of human error that have gone to trial so far suggest that legal proceedings—tort or ciminal—in the wake of incidents or accidents could be bad for safety, and may not help in creating a just culture.

Many inside and outside professional circles see a trend toward criminalization of human error as troublesome. If justice exists to serve society, then prosecuting human error may work against that very principle. The long-term consequence for society of turning errors into crimes or culpable malpractice could be less safe systems. Criminalizing error, or pursuing tort claims, can:

• erode independent safety investigations;
• promote fear rather than mindfulness in people practicing safety-critical work;
• make organizations more careful in creating a paper trail, not more careful in doing their work;
• make work of safety regulators more difficult by stifling primary sources of information and having to package regulatory findings in a language that does not attract prosecutorial attention;
• waste money on legal processes that do not really end up contributing to justice or to safety;
• ignore needs of victims other than mere financial ones, such as apology or the recognition of having been harmed;
• discourage truth-telling and instead cultivate professional secrecy, evasion, and self-protection.

If they become the main purveyor of accountability, legal systems could help create a climate in which freely telling accounts of what happened (and what to do about it) becomes difficult. There is a risk of a vicious cycle. We may end up turning increasingly to the legal system because the legal system has increasingly created a climate in which telling each other accounts openly is less and less possible. By taking over the dispensing of accountability, legal systems may slowly strangle it.