7 The Criminalization of Human Error

Aviation and healthcare, as well as other fields of safety-critical practice, are reporting an increase in the criminalization of human error^1,2,3,4,5 and criminal prosecution in the wake of an aviation accident is currently standard practice in many countries,^6,7 Italy has a specific criminal category of causing "air disaster," and two airline pilots were recently sentenced to ten years in jail after a crash that killed 19 people.⁸ In aviation, criminal prosecution of mostly front-line operators in the wake of incidents and accidents has occurred in the Netherlands,⁹ England,¹⁰ Spain,¹¹ France,¹² Italy,¹³ Greece, Cyprus,¹⁴ the United States,¹⁵ and Taiwan,¹⁶ as well as other countries. In healthcare, Sweden recently debated the introduction of the category "patient safety crime".¹⁷

Concern with the criminalization of mistake exists in safety-critical domains beyond aviation and healthcare, including shipping,¹⁸ construction,¹⁹ and chemical processing.²⁰ The laws under which criminal prosecution of professionals currently occurs are mostly derived by extending general hazard statutes from particularly road traffic laws which criminalize the reckless endangerment of other people or property.²¹ The move to criminalize human error (a label that is itself a psychological attribution^22,23) could parallel the evolution of, for example, law on hate crime, which went from a broad, ambiguous category to a focused, determinate legal construct.^24,25

Doubts have been raised about the fairness of criminalizing errors that are made in the course of executing normal professional duties with no criminal intent,^26,27,28,29 and the capriciousness of criminal prosecution. Remember Mara from the prologue: She was criminally convicted for a medication administration error of a kind that was reported to the regulator by others more than 300 times that year alone.³⁰ Doubts also exist about the ability of a judiciary to make sense of the messy details of practice in a safety-critical domain,³¹ let alone resist common biases of outcome knowledge and hindsight in adjudicating people's performance.^{32,33,34,35,36,37,38,39,40}

So who are involved in the criminalization of human error? Who are the parties that make it so?⁴¹ Whose interests are at stake, and why do they collide? How can a society keep supporting a way of dealing with risk that perhaps works against its own long-term interests?

The Victims

Those who should benefit foremost from any legal action in the wake of an incident or accident are those who were affected most by it: the victims. Take the parents of the infant in the case from the epilogue. Or the family of a passenger in an airliner crash.

Most countries give victims the role of factual witness in a trial (in addition, a so-called witness-impact statement has become popular in the US, allowing witnesses to reveal to juries even the emotional and other toll taken by the accident or "crime." There are suggestions that this can unfairly sway juries against the suspect).

Witness testimony can highlight all kinds of angles on the case, from the emotional and practical consequences of the loss they suffered to their own observations of the behavior of, for example, doctors or other caregivers before, during, and after the occurrence. This can bring aspects to light that would not otherwise have been known, as victims may sometimes have had a close-up view of the unfolding incident.

This in turn can put judges (or juries) in a tricky position. If court cases are conducted on the presumption of innocence, and scrupulously avoid the word "perpetrator," instead using a more tentative "defendant" or "suspect," then what does this do to the status of the victim? And what does the victim do to the status of the defendant or suspect?

Without a proven crime, there can be no victim of a crime. A strong validation of a victim's account in court, then, could perhaps make people lose sight of the difference between suspect and guilty. It can become difficult to remain unbiased and retain the presumption of innocence.

But having victim's testimony in court serves other important functions that may sometimes outweigh these risks. Giving testimony in court offers victims an opportunity to get their voices heard. This is very important. They often want to tell their stories, or a part at least. A trial may be the first time that anybody bothers to seriously listen to the victim.

Such blocked yearning may be one of the grounds for going to court in the first place. Michael Rowe, a sociologist at Yale, captured this in an essay about his son's death after two failed liver transplants: "Many of those who sue doctors ... have no place else to hand their grief when that grief—and seemingly their loved one's life—is being ignored, even declared, in the space left by silence, a thing of no value.⁴²

Yet not everybody turns to courts to get their voices heard. Victims can turn to the media instead. These can provide an outlet for what could end up a rather one-sided account of the incident or accident.

What matters for an organization involved in a tragic incident, then, is to validate victims' concerns and wants, and to do it quickly. Not all organizations have well-developed response mechanisms in place that deal respectfully and timely with the needs of victims. A basic desire of the victim is simply to be recognized, to get a chance to tell their side of the story. And to not have to wait for months or to force the organization to listen.

Do victims believe that justice is served by putting error on trial?

If a trial is the first time for victims to tell their story, then that part of justice will likely be seen as served. But what about the consequences for the accused? Do victims See those as "just"? The record may be surprising. In the nurses case of the prologue, the mother of the infant began to doubt both the point and the fairness of the trials against one ICU nurse well before it was all over. And there are similar examples.

In one case of criminalization, air traffic controllers in Yugoslavia were charged with murder and were jailed in the wake of a mid-air collision between two passenger aircraft. 176 lives were lost. It was 1976, and Zagreb was one of the busiest air traffic control centers in Europe. Its navigation beacon formed a crossroads of airways heavily used by traffic to and from southeastern Europe, the Middle East, the Far East, and beyond. The center, however, had been structurally understaffed for years. At the time of the accident, the radar system was undergoing testing and the center's radio transmitters often failed to work properly. Through a combination of different languages and flawed data presentation to the controller, one of the aircraft managed to level off exactly at the altitude of the other. Three seconds later, its left wing smashed through the other's cockpit and both aircraft plummeted to the ground. "Improper ATC operation," the accident investigation concluded. One controller, however, was singled out and sentenced to a prison term of seven years, despite officials from the aviation authority offering testimony that the Zagreb center was understaffed by at least 30 controllers. Significantly, the father of one of the victims of the collision led an unsuccessful campaign to prevent the controller's jailing. He then joined the efforts of other controllers to have him released after serving two years.⁴³ It was not until the early 1990s that the whole air traffic control system around Zagreb was revamped.

This is one reason why victims can have doubts about putting practitioners on trial for their alleged errors. The organizations that helped produce the problem are often left untouched; the norms, values, policies, and regulations that drive their business are not critically examined. Putting the front-end operator on trial is an example of single-loop learning, which focuses on the first part (possibly a human) that can be connected to the failure and replacing or otherwise dealing with just that part.

For some victims this can seem too easy, too quick, too convenient. And it does not get at the heart of the issue: Making sure that there is no next time. This is often one of the few recourses that victims have left. They have already been bereaved or injured by the incident or accident, and putting somebody in jail is not going to give them back what they lost. What uplifts instead is getting some confidence that it will not happen again, that somebody else will not have to go through what they had to suffer.

This confidence can perhaps evaporate when victims realize how a trial confines the remedy to a judgment about the right or wrong of only one person's actions. It does not get much better if the person in the dock is a manager or a director-general instead of an operator. Accused of deficient management or insufficient oversight, these individuals get to bear the full brunt of the diffuse failings of an entire system. Not many, not even victims, would see this as either reasonable or fair.

Are victims in it for the money?

What about financial compensation? Are victims interested in monetary compensation and is that why they will pursue or help pursue a trial? Not really. A recurring finding from lawsuits against physicians, for example, is not only that they are surprisingly rare, but also that patients or their families do not primarily engage in legal action because of money. They sue primarily to get the story out.⁴⁴ Patients and families do not typically engage in legal action until they have found that they are being stonewalled, that no "account" is forthcoming from the practitioners or organization involved in the adverse event. They want to hold the practitioners or organization involved accountable—literally—and initially often even without prejudice or reprisal. They want to hear the story from the side of the involved practitioners and their employing organizations: What went wrong? Where? And why? How can other patients or passengers or spouses of soldiers be protected from the same kinds of failures? These are often among the most pressing questions.

If there is no other route to such disclosure, people turn to the legal system as their final address for forcing out "accountability." Again, the "accounts" produced under such duress, of course, may have little to do with what happened and much more with protecting vested personal or organizational interests (see the previous chapter).

The Suspect or Defendant

The person on trial (typically a "suspect" in a criminal trial, and a "defendant" in a civil trial) really suffers two kinds of consequences:

• Psychological. The suspect or defendant may experience stigmatization and excessive stress, and feel humiliation, isolation, shame, and depression. Judicial proceedings occur essentially in a foreign language for practitioners of other professions, and they may feel very little control over what is going on or what the outcome may be.
• Practical. Practical consequences can include jail time or significant financial costs (fines, court costs, lawyers' fees). Such costs can be borne by insurance (in case of malpractice suits) and otherwise by professional associations (and sometimes by employers), because few practitioners (currently) have insurance that covers the cost of criminal prosecution. One other real consequence of criminal prosecution is the risk of losing the license to practice. A criminal or otherwise judicially tainted record is enough for some organizations to avoid a practitioner altogether. Loss of license often means loss of income, livelihood. It can mean loss of colleagues, context, familiarity, and perhaps loss of meaning itself. Some organizations that have the resources redeploy the practitioner, but not all have the wherewithal to do so.

Where licenses were not lost, the employing organization may still not dare to have the practitioner work operationally any longer, or the practitioner him-or herself elects not to. The nurse in the Xylocard case actually did not lose her license to practice as nurse. In a bizarre twist of legal protocol, the medical licensing board lost its access to and control over the investigation once the judiciary stepped in. They were never able to form their own judgment about the case or the nurse's ability to practice. She still has her license in her pocket today. But what does that mean? The nurse won't practice anymore. It is not likely that she could face a prescription from any physician that was even remotely unclear. It is unlikely that she could hook a patient up to any drop without asking herself a thousand questions. It is not likely that she could be effective anymore. Or safe.

In most countries, testimony of the suspect can be used as evidence in court. Interestingly, courts are mostly, or exclusively, interested in confessions. Denials are generally not seen as convincing. But if a suspect confesses the "crime," then this can be adequate for a conviction. No other evidence may be necessary.

What this means is that the police, or other investigating authorities, may sometimes have an interest in "helping" the suspect remember certain things, or state them in a certain way. Add to this that courts in some countries are content to review only a summary of the interrogation transcript, which may have been drawn up months after the actual encounter with the suspect, and the distance between what was intended and what can get interpreted by a judge or jury becomes huge.

It is not strange that, also for this reason, suspects may feel as if they are caught up in a Kafkaesque process. They get accused of things they do not know or understand, because these are cast in a language profoundly foreign from that which makes up their own world, their own expertise.

The Prosecutor

Prosecutors are on the front-line of defending and upholding the law. They have to decide which acts should be prosecuted. The role of a prosecutor is to launch a prosecution on behalf of the State.

What to prosecute?

In the wake of an incident, whether to prosecute or not is often a very difficult call to make. In making this call, prosecutors could benefit from some guidance and perhaps even domain expertise. But access to objective domain expertise can be very hard. Whether to go ahead with prosecution or not is mostly at the prosecutor's discretion—in principle. In practice, there can be pressure from various directions:

• There may be political pressure to prosecute. Where prosecutors are elected, their constituencies could demand that they go ahead with prosecution. Where they are appointed, politicians could make clear in various ways that prosecution is desired (because politicians want to be seen as "doing something" about the problem).
• The role of the media can be significant here too: It could be that when the media calls for holding people accountable, then politicians may too.
• There can also be political pressure in the other direction (i.e. to not prosecute): Some organizations and professional associations have lobbied successfully for agreements between politicians and other stakeholders, so that prosecutors leave professional incidents in particular industries alone.

What to prosecute is clear—in principle. Just look in the law or jurisprudence. Yet in practice, and particularly in cases of "human error," it appears more random and unsystematic. One important reason is the sorts of laws used for such prosecution. Most stem from what could be called general risk statutes, which proscribe, for example, "endangering the lives" of other people. In many countries such statutes have their roots in road traffic law or laws governing damage to third parties in the normal course of daily life. Such laws are deliberately vague, and their jurisprudence predictably diverse, because of the infinite variation of situations that judges or juries may have to handle. But consider what happens when such general notions of danger or risk slide into considerations of culpability of practitioners' performance in a high-risk, safety-critical profession. Their very jobs involve the endangerment of the lives of other people.

Although safety data in many countries is unprotected because of freedom-of-information acts, prosecutors normally do not look into an organization's database in the hope of finding evidence of prosecutable acts. Something else must often rouse interest. A prosecutor may get a cue about the presumed seriousness of an error from the media, for example. This can be entirely coincidental, as in Xylocard case, where the prosecutor stumbled upon her story in the local newspaper. Errors can sometimes be portrayed in the media as sufficiently culpable (even before any investigation) so as to capture a prosecutor's imagination.

Safety investigations that sound like prosecutors

Prosecutors and judges are not supposed to use official investigation reports in their judicial proceedings—at least this is the rule in many countries. There, the official investigation report cannot be used as evidence in court. But there is nothing in those laws that forbids prosecutors or judges from reading publicly available reports, just like any other citizen.

Over the past few years, I have counseled various investigative bodies about the language they used to describe people's actions in an incident or accident. All of these cases had attracted judicial interest. The people involved knew that judges and prosecutors were waiting for the formal report to come out (even though they were not supposed to use it formally in their judicial work).

If a trend toward criminalization is indeed happening, then recent safety board conclusions, such as the ones about an aircraft accident that happened to two pilots on a repositioning flight, could be counterproductive. Unforeseen effects of high altitude flying, for which the crew was not trained, made that they entered a stall and suffered a dual engine failure as well as other unfamiliar problems in their attempts to re-start the engines (which had a history of in-flight re-start problems). Cockpit procedures did not contain specific guidance on how to recover from the situation they had gotten into.

The transportation board, however, thought that "the pilots' unprofessional operation of the flight was intentional and causal to this accident... the pilots' actions led directly to the upset and their improper reaction to the resulting in-flight emergency exacerbated the situation to the point that they were unable to recover the airplane ... the probable causes were the pilots deviation from standard operating procedures, and poor airmanship."⁴⁵ While such responses can be understandable (and may even be seen as justified), they are a little difficult to reconcile with the typical mandate of a safety investigation (which is not to find people to blame but to help prevent recurrence). Also, a focus on people's putative lack of professionalism and a direct link between their actions and the bad outcome can overshadow the more diffuse contributions, from inadequacies in training to general unfamiliarity with high-altitude operations, a history of engine re-start problems, incomplete flight manuals, and a host of deeper organizational issues.

Perhaps language in investigation reports should be oriented toward explaining why it made sense for people to do what they did, rather than judging them for what they allegedly did wrong before a bad outcome.⁴⁶ An investigation board should not do the job of a prosecutor.

The prosecutor as truth-finder

Countries whose laws stem from the Napoleonic tradition (sometimes called inquisition law) typically offer their prosecutors or investigating magistrates the role of "truth-finder." This means that they and their offices are tasked with finding all facts about the case, including those that acquit the suspect or mitigate his or her contribution. Just like a judge or jury, they have to presume that the suspect is innocent until the opposite has been proven.

Combining a prosecutorial and (neutral) investigative role in this way can be difficult: A magistrate or prosecutor may be inclined to highlight certain facts over others. Accusatory law (that stems from common law tradition), in contrast, actually assumes that a prosecutor is partisan. As shown in the previous chapter, however, putting two versions of the "truth" opposite each other in an adversarial setting may still not be the best way to get to a meaningful, let alone honest, story of what happened and what to do about it. Also, the resources available to the two opposing parties may be quite asymmetric, with the prosecutor often in a better position.

Prosecutors can actually get access to evidence collected in safety investigations quite easily and use it in criminal cases. In the U.S., National Transportation-Safety Board (NTSB) investigators can be called to testify in civil cases, but only on factual information. They cannot be forced to offer their analysis or opinions about information collected in an accident investigation. There is no such restriction, however, when they are called to testify in a criminal court case.

There is also no legal restriction in the U.S. against the use of the actual tape from a cockpit voice recorder (CVR) in a criminal trial. This despite the Board's own extensive limits on CVR usage: It does not extend to other agencies. The NTSB, for example, strictly limits who is permitted to listen to the actual CVR tape, and these people cannot make notes of its contents. The NTSB does not release the recording or any copy of it and only makes public a transcript of the recording that is limited to details pertinent to the safety investigation. But those restrictions end at the NTSB's doors. There is no prohibition against criminal prosecutors issuing a subpoena for the CVR tape and using it in court.⁴⁷

The Defense Lawyer

The defense lawyer has an important role in laying out the defense strategy of the suspect. He or she can, for instance, recommend that the suspect not answer certain questions, or not testify at all. Judges or juries are not supposed to draw conclusions about suspects' culpability if they choose to remain silent. But, consistent with the fundamental nature of social relations and accountability, such silence can get interpreted as a desire to skirt responsibility.

A real and practical problem faced by most defense lawyers is that they are unlikely to understand the subtleties of practicing a particular safety-critical profession. Nor may they really have to understand. Contesting that a particular action is culpable or not is grounded in legal interpretation, rather than a deeper understanding of the meanings of risk, normative boundaries, and acceptable performance as the insider would have seen them in that operational world at the time. Indeed, the legal terms that get people in trouble in court (like "negligence") are not human performance terms. These things are worlds apart.

Defense lawyers can also be limited—in budget, in human resources, and in their authorizations to investigate—to dig up their own facts about the case. In contrast, prosecutors can, for example, deploy the police to force facts into the open (though even there, prosecutors often face competition for limited resources: Others may want or need to deploy the police elsewhere). Prosecutors can sometimes draw on the resources of government crime labs, witnesses, or forensic institutes. Defense lawyers instead often have to rely on voluntary disclosure of facts by parties that think it is their duty, or in their interest to help the suspect (the employing organization often does not, by the way). This is another reason why cases can get argued on legal rather than substantive grounds. Finding minor procedural or formal flaws that scuttle the prosecution's case can be a cheaper and more effective defense than trying to match the investment in lining up facts that prosecutors can usually make.

The Judge

A judge in inquisition law generally has three tasks:

• establishing the facts;
• determining whether the facts imply that laws were broken;
• if there were, decide adequate retribution or other consequences.

Establishing the facts

The first task, establishing the facts, is a really hard one. Facts, after all, get assembled and then brought to the bench by different parties, foremost the prosecutor. Here the border between facts on the one hand and interpretations or values on the other can begin to blur. Of course facts are disputed during a court case, this is the whole point of having a trial. But what a fact means in the world from which it came (e.g. a rule "violation") can easily get lost. Neither judges, nor many of the other participants in a trial, necessarily possess the expertise to understand the language and practice from a particular domain such as nursing or air traffic control. They do not know how that world looks from the inside, and were they given a chance for such a look, they may still not really understand what they saw (the legal teams in the air traffic control case from the previous chapter were given such an opportunity, and the nurse's judges were given the Xylocard packages to look at). What the facts meant in context can remain hazy.

For this reason, judges sometimes rely on outside experts to help them decode the facts that are delivered to the bench. This is where expert witnesses come in: Other practitioners or perhaps scientists whose field is relevant to the issue at hand. But judges and prosecutors and lawyers often want to ask questions that lie outside the actual expertise of the witness. Either the expert witness must decline answering, or indicate that she or he is not really confident about the answer. Neither is likely to bolster their credibility or usefulness in a courtroom. Expert witnesses are supposed to be friends of the court, that is, help the judge understand the facts from an unbiased point of view. But witnesses are selected by one of the parties, and neither party is obliged to disclose how long they looked around to find an expert witness whose opinion was favorable to their side of the story.

Determining whether laws were broken

Determining whether the facts imply that laws were broken is at least as difficult as establishing the facts. How does a judge move from the facts to this judgment?

Scientists are required to leave a detailed trace that shows how their facts produced or supported particular conclusions. Such a trace typically involves multiple stages of analysis. The researcher shows, for instance, how he or she moved from the context-specific empirical encounter (the "facts") to a concept-dependent conclusion. What scientists know, in other words, cannot be taken on faith: They have to show how they got to know what they know. This is hammered into the rules of the game; it is part of the prerequisites for publication.

For judges, however, such burden of proof does not seem to exist to the same extent. How they believe that the facts motivate a particular conclusion (and thereby judgment) can be expressed in a few lines of text.

Is a jury any better at this than a judge? Law based on Napoleonic principles does not use a jury to move from fact to judgment (nor to decide on punishment), but common law typically does. A jury takes away few of the problems that the judge faces (they are not likely trained in the practitioner's domain either; establishing facts and basing a judgment of unlawfulness on them is probably difficult for them too), and also introduces new problems.⁴⁰ One is the peculiarities of group behavior, from groupthink to the emergence of a dominant jury member. Jury selection is another, especially where jury members get selected on how they will likely vote on particular aspects of the case. And the resulting group is unlikely to be a "jury of peers" where the "peer" to be judged is somebody who exercised a complex safety-critical profession that required many years of specialist education and training.

Deciding adequate punishment

Professionals convicted of wrongdoing often do not end up in jail, or not for a long time. Judges do seem to conclude that this is not going to be rehabilitative. Fines or conditional sentences may be given instead. Of course, neither is likely to help improve safety in the domain from which the practitioner came, and they may not even be seen as "just" either.

Lawmakers

Lawmakers do not have a direct stake in legal proceedings or what it does to the creation of just cultures—other than the stakes they represent for their constituencies (voters). But legislators do play an important role, as they are eventually the ones who help sketch out the lines in laws that will then be drawn more clearly and applied by prosecutors and judges. They may also have a stake in aligning national laws with those of international bodies. Employing organizations or professional organizations may find that without some type of access to relevant legislators, making changes in the direction of a just culture could be difficult.

The Employing Organization

At first sight, employing organizations would not seem to benefit from the prosecution of one of their practitioners. It often generates bad press, the brand name can get tarnished, and management can be made to look bad or incompetent in the media.

On the other hand, employers can sometimes feel that they have to protect vested organizational interests, which may involve a degree of defensive posturing and shifting of blame.

What can get lost in the struggle to handle the immediate stress and challenges of legal proceedings is the organization's ethical mandate. This is, for example, to create safety (such as air traffic control) or to care for people (a hospital). Creating safety means not relying on simple, individual explanations for failure. Implicitly or explicitly supporting simplistic accounts of a bad apple could be seen as violating the very mandate the organization has. And why would that mandate not extend to the period after an accident that exposed the opposite? Caring for people means not discarding a nurse or doctor during or after he or she has been made to carry the blame for failure.

Some professions have come quite far with the development of so-called crisis intervention, peer support, or stress management programs that are intended to help practitioners in the aftermath of an incident. The importance of such programs cannot be overestimated: They help incidents become less of a stigma, that they can happen to everybody, and that they can help the organization get better if the aftermath is managed well.

Most professionals do not come to work to commit crimes

In considering the stakes of the various parties involved in the legal pursuit of justice, it is important to remember that most professionals do not come to work to commit a tort or a crime. They do not come to work to do a bad job at all. Their actions make sense given their pressures and goals at the time. Their actions are produced by and within a complex technological system, and are part and parcel of a normal workday. Professionals come to work to do a job, to do a good job. They do not have a motive to kill or cause damage. On the contrary: Professionals' work in the domains that this book talks about focuses on the creation of care, of quality, of safety.