Aviation and healthcare, as well as other fields of safety-critical practice, are reporting an increase in the criminalization of human error and criminal prosecution in the wake of an aviation accident. Assigning such liability is currently standard practice in many countries. Italy has a specific criminal category of causing “air disaster,” and two airline pilots were recently sentenced to 10 years in prison after a crash that killed 19 people. In aviation, criminal prosecution of mostly front-line operators in the wake of incidents and accidents has occurred in the Netherlands, England, Spain, France, Italy, Greece, Cyprus, the United States, and Taiwan, as well as other countries. In healthcare, Sweden recently debated the introduction of the category “patient safety crime.”70
The judge investigating a 2008 Madrid air crash that killed 154 people has called three mechanics for questioning on suspicion of manslaughter. The two technicians who checked the plane and cleared it for takeoff on August 20 and Spanair’s head of maintenance at Barajas Airport are facing charges of 154 counts of negligent homicide for failing to detect faults that led to the tragedy.
Judge Javier Perez has launched a judicial investigation, independent from that of Spain’s Civil Aviation authority, to determine the causes of the crash. Spanair flight JK5022 bound for the Canary Islands crashed on its second takeoff attempt after the wing flaps failed to deploy. An alarm system in the cockpit failed to warn pilots of the fault and the twin jet engine rose about 40 feet before it veered to the right and slammed into the ground tail first. The back of the aircraft broke apart and the fuselage bounced three times before crashing into a shallow ravine and bursting into flames. Only 18 people survived Spain’s worst air accident in 25 years.
The preliminary report by Civil Aviation investigators absolved the pilots of any blame for the accident after data from the black box recorder showed they had followed the correct procedures. Judge Perez was investigating whether the maintenance crew charged with repairing an earlier fault that led to the first takeoff attempt to be aborted were negligent in making the necessary repairs. It appeared that they may not have checked whether a problem detected in an air temperature gauge on the outside of the aircraft was caused by a mechanical fault that affected other parts of the plane. It has also emerged that the same aircraft suffered problems with wing flap deployment on two occasions in the days leading up the crash.71
Concern with the criminalization of mistake exists in safety-critical domains beyond aviation and healthcare. This includes shipping, construction, and chemical processing. The laws under which criminal prosecution of professionals currently occurs are mostly derived by extending general hazard statutes from particularly road traffic laws that criminalize the reckless endangerment of other people or property. The move to criminalize human error (a label that is itself a psychological attribution) could parallel the evolution of, for example, laws on hate crimes, which went from a broad, ambiguous category to a focused, determinate legal construct.
Doubts have been raised about the fairness of criminalizing errors that are made in the course of executing normal professional duties with no criminal intent and the capriciousness of criminal prosecution. Remember Mara: as a nurse, she was criminally convicted for a medication administration error of a kind that was reported to the regulator by others more than 300 times that year alone. Doubts also exist about the ability of a judiciary to make sense of the messy details of practice in a safety-critical domain, let alone resist common biases of outcome knowledge and hindsight in adjudicating the professional work of practitioners.
Seven Tuninter pilots, technicians, and managers were convicted by an Italian tribunal for a crash in which 23 passengers survived and 16 were killed in August 2005, Andy Nativi wrote in Aviation News Release (March 25, 2009). The crash involved an ATR-72 that took off from Bari, Italy, that was headed to Djerba, Tunisia, and was forced to ditch in the sea just along the Sicilian coast.
The incident occurred because the aircraft fuel gauges and indicators had been incorrectly replaced by the maintenance personnel with those of the ATR-42. The instruments indicated there was enough fuel on board when the aircraft took off, although there was not actually enough fuel to carry out the intended flight.
The two pilots were charged with multiple counts of manslaughter and air disaster, and sentenced to a term of 10 years because, in theory, they had the opportunity to reach the Palermo Airport for an emergency landing if they had followed proper procedure. Instead, the pilots chose to pray. Another five technicians and managers were found guilty, with the chief operating officer and the maintenance chief sentenced to nine years each, while three technicians were sentenced to eight years each. Two others defendants were not found guilty. None of those indicted were present at the tribunal, and Tuninter lawyers announced they would appeal the verdict.
Let’s first look at who are involved in the criminalization of human error.72 Who are the parties that make it so? Whose interests are at stake, and where do they collide? Then let’s consider some of the evidence of what criminalization does to safety and ultimately raise the question how a society can support a way of dealing with risk that perhaps works against its own long-term interests.
Those who should benefit foremost from any legal action in the wake of an incident or accident are those who were affected most by it: the first victims. Take the parents of the infant in the case study just prior to this chapter. Or the family of a passenger in an airliner crash.
Most countries give victims the role of factual witness in a trial (in addition, a so-called witness-impact statement has become popular in the US, allowing witnesses to reveal to juries even the emotional and other toll taken by the accident or “crime.” There are suggestions that this can unfairly sway juries against the suspect).
Witness testimony can highlight all kinds of angles on the case, from the emotional and practical consequences of the loss they suffered to their own observations of the behavior of, for example, doctors or other caregivers before, during, and after the occurrence. This can bring aspects to light that would not otherwise have been known, as victims may sometimes have had a close-up view of the unfolding incident.
This in turn can put judges (or juries) in a tricky position. If court cases are conducted on the presumption of innocence, and scrupulously avoid the word “perpetrator,” instead using a more tentative “defendant” or “suspect,” then what does this do to the status of the victim? And what does the victim do to the status of the defendant or suspect?
If you follow this logic, then without a proven crime, there can be no victim of a crime. A strong validation of a victim’s account in court, then, could perhaps make people lose sight of the difference between suspect and guilty. It can become difficult to remain unbiased and retain the presumption of innocence.
But having victims’ testimony in court serves other important functions that may sometimes outweigh these risks. Giving testimony in court offers victims an opportunity to get their voices heard. This is very important. They often want to tell their story, or parts of it at least. As explained in Chapter 2, if no other provisions are in place, then a lawsuit or a trial may be the first time that anybody bothers to listen seriously to the victim, and the first time the victim has the opportunity to hear the story told by those who were involved.
Such blocked yearning may be one of the grounds for going to court in the first place. Michael Rowe, a sociologist at Yale, captured this in an essay about his son’s death after two failed liver transplants: “Many of those who sue doctors … have no place else to hand their grief when that grief—and seemingly their loved one’s life—is being ignored, even declared, in the space left by silence, a thing of no value.73
Yet not everybody turns to courts to get their voices heard. Victims can turn to the media instead. These can provide an outlet for what could end up a rather one-sided account of the incident or accident.
Remember from Chapter 2: What matters for an organization involved in a tragic incident is to validate first victims’ concerns and wants, and to do this promptly. Not all organizations have well-developed response mechanisms in place that deal in a respectful and timely manner with the needs of victims. A basic desire of the victim is simply to be recognized, to get a chance to tell his or her side of the story. And to not have to wait for months or to force the organization to listen.
DO FIRST VICTIMS BELIEVE THAT JUSTICE IS SERVED BY PUTTING ERROR ON TRIAL?
If a trial is the first time for victims to tell their story, then that part of justice will likely be seen as served. But what about the consequences for the accused? Do victims see those as just? The record may be surprising. In nurse Mara’s case, the mother of the infant began to doubt both the point and the fairness of the trials against one ICU nurse well before it was all over.
This is one reason why victims can have doubts about putting practitioners on trial for their alleged errors. The organizations that helped produce the problem are often left untouched; the norms, values, policies, and regulations that drive their business are not critically examined. Putting the front-end operator on trial is an example of single-loop learning, which focuses on the first part (possibly a human) that can be connected to the failure and replacing or otherwise dealing with just that part.
A judge on Monday convicted four people and acquitted three in a 2001 plane crash that killed 118 people at Milan’s Linate Airport in Italy’s worst civil aviation disaster, a lawyer for victims’ relatives said. The four were convicted of multiple manslaughter charges and sentenced to prison terms of up to four years and four months, said the lawyer, Alessandro Giorgetti. Three of the defendants were employees of the Italian air traffic control agency and one was an airport official, Giorgetti said.
Early reaction from some victims’ relatives in the Milan courtroom was lukewarm. “If we had to go by our feelings, no convictions would be enough,” said Paolo Pettinaroli, who lost a son and is president of an association of victims’ families. “But the law has decided this way and we accept it.” He said, however, that the victims’ families would appeal the acquittals.
It was the second verdict in the disaster. In a separate trial last year, an Italian court convicted four other defendants, including an air traffic controller and a former top aviation official, of multiple manslaughter and negligence and sentenced them to prison terms ranging from six and a half to eight years. The crash occurred on October 8, 2001, when a Scandinavian Airlines System airliner bound for Copenhagen and a corporate jet collided in morning fog on the Linate tarmac. The airport’s ground radar was out of service at the time. The collision killed 110 people on the MD-87 jetliner, 4 people on the Cessna business jet, and 4 members of the ground crew. The ruling Monday came after a fast-track trial, which allowed a limited amount of evidence and provided for lesser sentences on conviction.74
For some victims a fast-track conviction of the practitioners involved can seem too easy, too quick, too convenient. It may even leave them on the sidelines: retributive justice typically does. It relegates first victims to mere bystanders, to an audience, not participants in the creation of justice. And such a conviction might also not get at the heart of the issue that animates many first victims: making sure that there is no next time. This is often one of the few recourses that victims have left. They have already been bereaved or injured by the incident or accident, and putting somebody in jail is not going to give them back what they lost. What uplifts instead is getting some confidence that it will not happen again, that somebody else will not have to go through what they had to suffer.
This confidence can perhaps evaporate when victims realize how a trial confines the remedy to a judgment about the right or wrong of only one person’s actions. It does not get much better if the person in the dock is a manager or a director-general instead of an operator. Accused of deficient management or insufficient oversight, these individuals get to bear the full brunt of the diffuse failings of an entire system. Not many, not even victims, would see this as either reasonable or fair.
ARE VICTIMS IN IT FOR THE MONEY?
What about financial compensation? Are victims interested in monetary compensation and is that why they will pursue or help pursue a trial? Not really. A recurring finding from lawsuits against physicians, for example, is not only that they are surprisingly rare, but also that patients or their families do not engage in legal action primarily because of money. They sue primarily to get the story out.17 Patients and families do not typically engage in legal action until they have found that they are being stonewalled, that no “account” is forthcoming from the practitioners or organization involved in the adverse event. They want to hold the practitioners or organization involved accountable—literally, and initially often even without prejudice or desire for retribution. They want to hear the story from the side of the involved practitioners and their employing organizations: What went wrong? Where? And why? How can other patients or passengers or spouses of soldiers be protected from the same kinds of failures? These are often among the most pressing questions.
If there is no other route to such disclosure, people turn to the legal system as their final address for forcing out “accountability.” Again, the “accounts” produced under such duress, of course, may have little to do with what happened and much more with protecting vested personal or organizational interests (see Chapter 3).
The person on trial (the second victim, but typically called a “suspect” in a criminal trial, and a “defendant” in a civil trial) really suffers two kinds of consequences:
• Psychological. The suspect or defendant may experience stigmatization and excessive stress, and feel humiliation, isolation, shame, and depression. Judicial proceedings occur essentially in a foreign language for practitioners of other professions, and they may feel very little control over what is going on or what the outcome may be.
• Practical. Practical consequences can include jail time or significant financial costs (fines, court costs, lawyers’ fees). Such costs can be borne by insurance (in case of malpractice suits) and otherwise by professional associations (and sometimes by employers), because few practitioners (currently) have insurance that covers the cost of criminal prosecution. One other real consequence of criminal prosecution is the risk of losing the license to practice. A criminal or otherwise judicially tainted record is enough for some organizations to avoid a practitioner altogether. Loss of license often means loss of income, livelihood. It can mean loss of colleagues, context, familiarity, and perhaps loss of meaning itself. Some organizations that have the resources redeploy the practitioner, but not all have the wherewithal to do so.
Where licenses were not lost, the employing organization may still not dare to have the practitioner work operationally any longer, or the practitioner him- or herself elects not to. The nurse in the Xylocard case actually did not lose her license to practice as nurse. In a bizarre twist of legal protocol, the medical licensing board lost its access to and control over the investigation once the judiciary stepped in. They were never able to form their own judgment about the case or the nurse’s ability to practice. She still has her license in her pocket today. But what does that mean? The nurse won’t practice anymore. It is not likely that she could face a prescription from any physician that was even remotely unclear. It is unlikely that she could hook a patient up to any drop without asking herself a thousand questions. It is not likely that she could be effective anymore. Or safe.
In most countries, testimony of the suspect can be used as evidence in court. Interestingly, courts are mostly, or exclusively, interested in confessions. Denials are generally not seen as convincing. But if a suspect confesses the “crime,” then this can be adequate for a conviction. No other evidence may be necessary.
What this means is that the police, or other investigating authorities, may sometimes have an interest in “helping” the suspect remember certain things, or state them in a certain way. Add to this that courts in some countries are content to review only a summary of the interrogation transcript, which may have been drawn up months after the actual encounter with the suspect, and the distance between what was intended and what can get interpreted by a judge or jury becomes huge.
It is not strange that, also for this reason, suspects may feel as if they are caught up in a Kafkaesque process. They get accused of things they do not know or understand, because these are cast in a language profoundly foreign from that which makes up their own world, their own expertise.
Prosecutors are on the front line of defending and upholding the law. They have to decide which acts should be prosecuted. The role of a prosecutor is to launch a prosecution on behalf of the state.
In the wake of an incident, whether to prosecute or not is often a very difficult call to make. In making this call, prosecutors could benefit from some guidance and perhaps even domain expertise. But access to objective domain expertise can be very hard. Whether to go ahead with prosecution or not is mostly at the prosecutor’s discretion—in principle. In practice, there can be pressure from various directions:
• There may be political pressure to prosecute. Where prosecutors are elected, their constituencies could demand that they go ahead with prosecution. Where they are appointed, politicians could make clear in various ways that prosecution is desired (because politicians want to be seen as “doing something” about the problem).
• The role of the media can be significant here too: it could be that when the media calls for holding people accountable, then politicians may too.
• There can also be political pressure in the other direction (i.e., to not prosecute): some organizations and professional associations have lobbied successfully for agreements between politicians and other stakeholders, so that prosecutors leave professional incidents in particular industries alone.
Prosecutors in the Netherlands requested the flight-data recorder and cockpit-voice transcripts from the crashed Turkish Airlines Boeing 737-800 at Amsterdam Schiphol, David Kaminski-Morrow of Air Transport Intelligence News wrote on February 28, 2009. The Openbaar Ministerie said the Dutch Safety Board does not have to grant the request, contained in a letter from its aviation department, because the prosecutor is “lacking” a legal basis.
“We are awaiting a response from the Safety Board,” said the prosecutor’s office, adding that it submitted the request because the data can give “an insight into the circumstances of the accident.” Judicial intrusion into accident investigation has attracted high-profile criticism, also after the Italian Agenzia Nationale per la Sicurezza del Volo (ANSV) accused legal officials of hampering the probe into a Cessna executive jet crash in Rome. ANSV called for deconflicting of investigators’ needs from the rules of criminal proceedings. The US Flight Safety Foundation (FSF) also echoed ANSV’s concerns, claiming prosecutors also interfered with French inquiries into a fatal Airbus A320 crash in the Mediterranean Sea. “In recent days the French authorities have returned some of the Airbus evidence to safety investigators,” it stated. The FSF understands the demand for justice and accountability but added: “We cannot allow the safety of the aviation system to be jeopardised by prosecutorial overreach. Unless there is evidence of sabotage, law enforcement and judicial authorities need to step aside, allow accident investigators immediate access to the wreckage and to surviving crew and passengers, and let safety professionals do their job.”
What to prosecute is clear—in principle. Just look in the law or jurisprudence. Yet in practice, and particularly in cases of “human error,” it appears more random and unsystematic. One important reason is the sorts of laws used for such prosecution. Most stem from what could be called general risk statutes, which proscribe, for example, “endangering the lives” of other people. In many countries such statutes have their roots in road traffic law or laws governing damage to third parties in the normal course of daily life. Such laws are deliberately vague, and their jurisprudence predictably diverse, because of the infinite variation of situations that judges or juries may have to handle. But consider what happens when such general notions of danger or risk slide into considerations of culpability of practitioners’ performance in a high-risk, safety-critical profession. Their very jobs involve the endangerment of the lives of other people.
Although safety data in many countries is unprotected because of freedom-of-information acts, prosecutors normally do not look into an organization’s database in the hope of finding evidence of prosecutable acts. Something else must often rouse interest. A prosecutor may get a cue about the presumed seriousness of an error from the media, for example. This can be entirely coincidental, as in the Xylocard case, where the prosecutor stumbled upon her story in the local newspaper. Errors can sometimes be portrayed in the media as sufficiently culpable (even before any investigation) so as to capture a prosecutor’s imagination.
SAFETY INVESTIGATIONS THAT SOUND LIKE PROSECUTORS
Prosecutors and judges are not supposed to use official investigation reports in their judicial proceedings—at least this is the rule in many countries. There, the official investigation report cannot be used as evidence in court. But there is nothing in those laws that forbids prosecutors or judges from reading publicly available reports, just like any other citizen.
Over the past few years, I have talked to various investigation boards or departments about the language they use to describe people’s actions in an incident or accident. All of these cases had attracted judicial interest. The people involved knew that judges and prosecutors were waiting for the formal report to come out (even though they were not supposed to use it formally in their judicial work).
If a trend toward criminalization is indeed happening, then recent safety board conclusions such as the ones about an aircraft accident that happened to two pilots on a repositioning flight, could be counterproductive. Unforeseen effects of high-altitude flying, for which the crew was not trained, made that they entered a stall and suffered a dual engine failure as well as other unfamiliar problems in their attempts to restart the engines (which had a history of in-flight restart problems). Cockpit procedures did not contain specific guidance on how to recover from the situation they had gotten into.
The transportation board, however, thought that “the pilots’ unprofessional operation of the flight was intentional and causal to this accident…the pilots’ actions led directly to the upset and their improper reaction to the resulting inflight emergency exacerbated the situation to the point that they were unable to recover the airplane…the probable causes were the pilots’ deviation from standard operating procedures, and poor airmanship.”75 Although such responses can be understandable (and may even be seen as justified), they are a little difficult to reconcile with the typical mandate of a safety investigation (which is not to find people to blame but to help prevent recurrence). Also, a focus on people’s putative lack of professionalism and a direct link between their actions and the bad outcome can overshadow the more diffuse contributions, from inadequacies in training to general unfamiliarity with high-altitude operations, a history of engine restart problems, incomplete flight manuals, and a host of deeper organizational issues.
Perhaps language in investigation reports should be oriented toward explaining why it made sense for people to do what they did, rather than judging them for what they allegedly did wrong before a bad outcome. An investigation board should not do the job of a prosecutor.
THE PROSECUTOR AS TRUTH-FINDER
Countries whose laws stem from the Napoleonic tradition (sometimes called inquisition law) typically offer their prosecutors or investigating magistrates the role of “truth-finder.” This means that they and their offices are tasked with finding all facts about the case, including those that acquit the suspect or mitigate his or her contribution. Just like a judge or jury, they have to presume that the suspect is innocent until the opposite has been proven.
Combining a prosecutorial and (neutral) investigative role in this way can be difficult: a magistrate or prosecutor may be inclined to highlight certain facts over others. Accusatory law (that stems from common law tradition), in contrast, actually assumes that a prosecutor is partisan. As shown in the case studies in this book, however, putting two versions of the “truth” opposite each other in an adversarial setting may still not be the best way to get to a meaningful, let alone honest, story of what happened and what to do about it. Also, the resources available to the two opposing parties may be quite asymmetric, with the prosecutor often in a better position.
Prosecutors can actually get access to evidence collected in safety investigations quite easily and use it in criminal cases. In the United States, National Transportation Safety Board (NTSB) investigators can be called to testify in civil cases, but only on factual information. They cannot be forced to offer their analysis or opinions about information collected in an accident investigation. There is no such restriction, however, when they are called to testify in a criminal court case.
There is also no legal restriction in the United States against the use of the actual tape from a cockpit voice recorder (CVR) in a criminal trial. This despite the Board’s own extensive limits on CVR usage: it does not extend to other agencies. The NTSB, for example, strictly limits who is permitted to listen to the actual CVR tape, and these people cannot make notes of its contents. The NTSB does not release the recording or any copy of it and only makes public a transcript of the recording that is limited to details pertinent to the safety investigation. But those restrictions end at the NTSB’s doors. There is no prohibition against criminal prosecutors issuing a subpoena for the CVR tape and using it in court.76
The defense lawyer has an important role in laying out the defense strategy of the suspect. He or she can, for instance, recommend that the suspect not answer certain questions, or not testify at all. Judges or juries are not supposed to draw conclusions about suspects’ culpability if they choose to remain silent. But, consistent with the fundamental nature of social relations and accountability, such silence can get interpreted as a desire to skirt responsibility.
A real and practical problem faced by most defense lawyers is that they are unlikely to understand the subtleties of practicing a particular safety-critical profession. Nor may they really have to understand. Contesting that a particular action is culpable or not is grounded in legal interpretation, rather than a deeper understanding of the meanings of risk, normative boundaries, and acceptable performance as the insider would have seen them in that operational world at the time. Indeed, the legal terms that get people in trouble in court (such as “negligence”) are not human performance terms. These things are worlds apart.
Defense lawyers can also be limited—in budget, in human resources, and in their authorizations to investigate—to dig up their own facts about the case. In contrast, prosecutors can for example deploy the police to force facts into the open (though even there, prosecutors often face competition for limited resources: others may want or need to deploy the police elsewhere). Prosecutors can sometimes draw on the resources of government crime labs, witnesses or forensic institutes. Defense lawyers instead often have to rely on voluntary disclosure of facts by parties that think it is their duty, or in their interest to help the suspect (the employing organization often does not, by the way). This is another reason why cases can get argued on legal rather than substantive grounds. Finding minor procedural or formal flaws that scuttle the prosecution’s case can be a cheaper and more effective defense than trying to match the investment in lining up facts that prosecutors can usually make.
A judge in Napoleonic law generally has three tasks:
• Establishing the facts.
• Determining whether the facts imply that laws were broken.
• If laws were broken, decide adequate retribution or other consequences.
The first task, establishing the “facts,” is a really hard one. “Facts,” after all, get assembled and then brought to the bench by different parties, foremost the prosecutor. Here the border between facts on the one hand and interpretations or values on the other begins to blur. Of course facts are disputed during a court case; this is the whole point of having a trial. But what a fact means in the world from which it came (e.g., a rule “violation”) can easily get lost. Neither judges, nor many of the other participants in a trial, necessarily possess the expertise to understand the language and practice from a particular domain such as nursing or air traffic control. They do not know how that world looks from the inside, and were they given a chance for such a look, they may still not really understand what they saw (the legal teams in the air traffic control case from Chapter 3 were given such an opportunity, and the nurse’s judges were given the Xylocard packages to look at). What the facts meant in context can remain hazy.
For this reason, judges sometimes rely on outside experts to help them decode the facts that are delivered to the bench. This is where expert witnesses come in: other practitioners or perhaps scientists whose field is relevant to the issue at hand. But judges and prosecutors and lawyers often want to ask questions that lie outside the actual expertise of the witness. Either the expert witness must decline answering, or indicate that she or he is not really confident about the answer. Neither is likely to bolster their credibility or usefulness in a courtroom. Expert witnesses are supposed to be friends of the court, that is, help the judge understand the facts from an unbiased point of view. But witnesses are selected by one of the parties, and neither party is obliged to disclose how long they looked around to find an expert witness whose opinion was favorable to their side of the story.
DETERMINING WHETHER LAWS WERE BROKEN
Determining whether the facts imply that laws were broken is at least as difficult as establishing the facts. How does a judge move from the facts to this judgment?
Scientists are required to leave a detailed trace that shows how their facts produced or supported particular conclusions. Such a trace typically involves multiple stages of analysis. The researcher shows, for instance, how he or she moved from the context-specific empirical encounter (the “facts”) to a concept-dependent conclusion. What scientists know, in other words, cannot be taken on faith: they have to show how they got to know what they know. This is hammered into the rules of the game; it is part of the prerequisites for publication.
For judges, however, such burden of proof does not seem to exist to the same extent. How they believe that the facts motivate a particular conclusion (and thereby judgment) can be expressed in a few lines of text.
Is a jury any better at this than a judge? Law based on Napoleonic principles does not use a jury to move from fact to judgment (nor to decide on punishment), but common law typically does. A jury takes away few of the problems that the judge faces (they are not likely trained in the practitioner’s domain either; establishing facts and basing a judgment of unlawfulness on them is probably difficult for them too), and also introduces new problems. One is the peculiarities of group behavior, from groupthink to the emergence of a dominant jury member. Jury selection is another, especially where jury members get selected on how they will likely vote on particular aspects of the case. And the resulting group is unlikely to be a “jury of peers” where the peer to be judged is somebody who exercised a complex safety-critical profession that required many years of specialist education and training.
Professionals convicted of wrongdoing often do not end up in jail, or not for a long time. Judges do seem to conclude that this is not going to be rehabilitative. Fines or conditional sentences may be given instead. Of course, neither is likely to help improve safety in the domain from which the practitioner came, and they may not even be seen as just either.
The former captain of the Costa Concordia cruise liner was sentenced to 16 years in prison on Wednesday for his role in the 2012 shipwreck, which killed 32 people off the Tuscan holiday island of Giglio. Francesco Schettino was commanding the vessel, a floating hotel as long as three football pitches, when it hit rocks off the island, tearing a hole in its side. A court in the town of Grosseto found him guilty of multiple manslaughter, causing a shipwreck, and abandoning his passengers in one of the highest profile shipping disasters in recent years.
However, the judges rejected a request that Schettino begin his sentence immediately. They ruled instead that would not go to prison until the appeals process is completed, which can take years. The captain wept during his final testimony on Wednesday but did not return to the court to hear the verdict. Prosecutors had asked for a prison sentence of 26 years for Schettino, who has admitted some responsibility but denied blame for the deaths that occurred during the evacuation. Some lawyers representing the victims said the sentence was inadequate.
Investigators severely criticized Schettino’s handling of the disaster, accusing him of bringing the 290 meter-long (950 feet) vessel too close to shore. The subsequent shipwreck set off a chaotic night-time evacuation of more than 4000 passengers and crew. Ann Decre, the head of a body representing French survivors, said the verdict could not cover the human cost. “For me it’s six months for each death. And the family of the dead people, it’s not six months or seventeen years for them, it’s forever,” Decre said outside the theatre that was turned into a makeshift courtroom.
Schettino was also accused of delaying evacuation and abandoning ship before all the 4229 passengers and crew had been rescued. He said earlier in the trial that he had been thrown off the ship as it tilted. The court sentenced Schettino to 10 years for multiple manslaughter, five years for causing the shipwreck, and one year for abandoning his passengers. He also received a one-month civil penalty for failure to report the accident correctly. He was left alone on the stand to answer for the disaster after the ship’s owner, the Costa Cruises unit of Carnival Corp, paid a 1 million euro ($1.3 million at the time) fine and prosecutors accepted plea bargains from five officials. “Lots of people who were there and played a role were excluded today,” Schettino’s lawyer Donato Laino said outside the theatre. “We think the facts of the case were different.” He and Costa Cruises were jointly ordered to pay a total of 30,000 euros each in compensation to many of the ship’s passengers as well as millions of euros in compensation to Italian government ministries, the region of Tuscany and the island of Giglio for environmental damage. Earlier on Wednesday Schettino had rejected prosecution accusations he had shown no sense of responsibility or compassion for the victims, saying “grief should not be put on show to make a point.”
The massive hulk of the Costa Concordia was left abandoned on its side for two-and-a-half years before it was towed away in the most expensive maritime wreck recovery in history. The last body was not recovered until 2014. Schettino’s defense team argued he prevented an even worse disaster by steering the ship close to the island as it sank. Many other Costa masters also made “flyby’s” of Giglio and other islands, as it was a commercially attractive thing to do. They said the sentence that was sought by prosecutors went beyond even sentences sought for mafia killers.77
Lawmakers do not have a direct stake in legal proceedings or what it does to the creation of just cultures—other than the stakes they represent for their constituencies (voters). But legislators do play an important role, as they are eventually the ones who help sketch out the lines in laws that will then be drawn more clearly and applied by prosecutors and judges. They may also have a stake in aligning national laws with those of international bodies. Employing organizations or professional organizations may find that without some type of access to relevant legislators, making changes in the direction of a just culture could be difficult.
At first sight, employing organizations would not seem to benefit from the prosecution of one of their practitioners. It often generates bad press, the brand name can get tarnished, and management can be made to look bad or incompetent in the media.
On the other hand, employers can sometimes feel that they have to protect vested organizational interests, which may involve a degree of defensive posturing and shifting of blame.
What can get lost in the struggle to handle the immediate stress and challenges of legal proceedings is the organization’s ethical mandate. This is, for example, to create safety (such as air traffic control) or to care for people (a hospital). Creating safety means not relying on simple, individual explanations for failure. Implicitly or explicitly supporting simplistic accounts of a bad apple could be seen as violating the very mandate the organization has. And why would that mandate not extend to the period after an accident that exposed the opposite? Caring for people means not discarding a nurse or doctor during or after he or she has been made to carry the blame for failure.
Some professions have come quite far with the development of so-called crisis intervention, peer support, or stress management programs that are intended to help practitioners in the aftermath of an incident. The importance of such programs cannot be overestimated: they help incidents become less of a stigma, that they can happen to everybody, and that they can help the organization get better if the aftermath is managed well.
THE CONSEQUENCES OF CRIMINALIZATION
MOST PROFESSIONALS DO NOT COME TO WORK TO COMMIT CRIMES
In considering the stakes of the various parties involved in the legal pursuit of justice, it is important to remember that most professionals do not come to work to commit a tort or a crime. They do not come to work to do a bad job at all. Their actions make sense given their pressures and goals at the time. Their actions are produced by and within a complex technological system, and are part and parcel of a normal workday. Professionals come to work to do a job, to do a good job. They do not have a motive to kill or cause damage. On the contrary: professionals’ work in the domains that this book talks about focuses on the creation of care, of quality, of safety.
IS CRIMINALIZATION BAD FOR SAFETY?
The sheer threat of judicial involvement is enough to make people think twice about coming forward with information about an incident that they were involved in.18 Just imagine how the colleagues of nurse Mara may have felt about this. The nurse, after all, stepped forward voluntarily with her view on the death of the infant. As long as there is fear that information provided in good faith can end up being used by a legal system, practitioners are not likely to engage in open reporting.
Many admit that they will file a report only when there is the chance that other parties will disclose the incident (e.g., an air traffic controller may think that a pilot will report a close call if he or she does not do it; a nurse may feel the same way with respect to a resident physician present during the same event, or vice versa), which would make the event known in any case.
This puts practitioners in a catch-22: either report facts and risk being prosecuted for them, or not report facts and risk being prosecuted for not reporting them (if they do end up coming out along a different route). Many seem to place their bet on the latter: rather not report and cross your fingers that nobody else will find out either.
Practitioners in many industries, the world over, are anxious of inappropriate involvement of judicial authorities in safety investigations that, according to them, have nothing to do with unlawful actions, misbehavior, gross negligence, or violations.
Italian investigators are criticizing judicial authorities for becoming involved in air accident inquiries at an early stage, accusing them of hampering the process, wrote David Kaminski-Morrow in Air Transport Intelligence News.78
The Agenzia Nazionale per la Sicurezza del Volo (ANSV) has expressed its exasperation in the wake of a Cessna 650 executive jet accident on February 7. The ANSV said the investigation had “come to a standstill” after the seizure of crucial material, including the flight recorders and relevant “vital” documentation, by court and judicial authorities. It added that the US National Transportation Safety Board had requested a copy of the data on the recorders but that the ANSV, as a result of the development, had been unable to provide the information, adding that the delay had a knock-on effect on safety.
The ANSV said it wanted regulators to take “decisive action” to avoid the “problem of conflict” between investigation requirements and the rules of criminal proceedings. Cockpit crew representatives were supporting the ANSV’s stance, and backed calls for a change in Italian law to give technical investigation priority over judicial inquiries. “Under present legislation the judicial inquiry takes precedence,” said the International Federation of Air Line Pilots’ Associations. Absence of data from the flight-data and cockpit-voice recorders from the Cessna jet will “seriously impact the effectiveness and speed” of the investigation, it added.
Operational organizations, and even regulatory authorities (which fall under departments or ministries other than justice—e.g., transportation) are concerned that their safety efforts, such as encouraging incident reporting, are undermined.18 But what, exactly, are people afraid of? Judicial involvement can consist of
• The participation of law enforcement officials in investigations. There are countries in the developed world in which the police is witness or even participant in accident investigations (in, e.g., road traffic or aviation). This can impede investigatory access to information sources, as pressures to protect oneself against criminal or civil liability can override any practitioner’s willingness to cooperate in the accident probe.
• Judicial authorities stopping an investigation altogether or taking it over when evidence of criminal wrongdoing emerges. This often restricts further access to evidence for safety investigators.
• Launching a criminal probe independent of a safety investigation or its status. Accident investigation boards in many countries say that this severely hinders their efforts to find out what went wrong and what to do to prevent recurrence.79
• Using a formal accident report in a court case. Even though using such reports as evidence in court is proscribed through various arrangements, these routinely get overridden or circumvented. And, in any case, nobody can prevent a prosecutor or judge from reading a publicly available accident report.
• Getting access to safety-related data (e.g., internal incident reports) because of freedom-of-information legislation in that country, under which any citizen (including the judicial system) has quite unfettered access to many kinds of organizational data. This access is particularly acute in organizations that are government-owned (such as many air traffic control providers or hospitals).
• Taking the results of a safety inspection if these expose possibly criminal or otherwise liable acts. This does not have to take much: an inspection report listing “violations” (of regulations, which in turn are based in law) can be enough for a prosecutor to start converting those violations (which were discovered and discussed for the purpose of regulatory compliance and safety improvement) into prosecutable crimes.
The safety manager for one organization told me how the person involved in an incident flatly refused that the incident be used for recurrent training, precisely because of the perceived risk of prosecution or other consequences. Even assurances of complete anonymity and de-identification of incident data were not enough to sway the practitioner. Although understandable, this denied colleagues an opportunity to engage in a meaningful lesson from their own operation. Normal, structural processes of organizational learning are thus eviscerated, frustrated by the mere possibility of judicial proceedings against individual people.
In all of these ways, judicial involvement (or the threat of it) can engender a climate of fear and silence. In such a climate it can be difficult, if not impossible, to get access to information that may be critical to finding out what went wrong, or what to do to not have it happen again. Here is another example of what that can lead to.
A prosecutor responsible for aviation decided to launch what she termed a “test case.”80 The crew of a large passenger jet on takeoff had suddenly seen another aircraft, being towed by a truck, cross the runway in front of them. Immediately they aborted their takeoff and stopped before reaching the intersection. Nobody was hurt. The air traffic control organization, as well as the country’s independent transportation safety board, both launched investigations and arrived at pretty much the same conclusions. After unclear radio transmissions with the tow truck driver, an assistant controller had passed her interpretation of the tow’s position to the trainee controller responsible for the runway. The assistant controller did not have a screen that could show ground-radar pictures. The trainee controller did, and took the position of the tow at the edge of the runway to mean that the crossing had been completed. Buttons on a newly added panel in the tower for controlling lighted stop-bars at runway intersections proved ambiguous, but at the time all looked in order, and he cleared the other jet for takeoff. Meanwhile, the coach of the trainee controller was performing supervisor duties in the tower. The account, in other words, was straightforward in its complexity: mixing elements of interface design, production pressure, weather conditions, handovers, short-staffing, screen layouts, and communication and teamwork—among many other factors. This, the safety community knows, is what organizational incidents and accidents are made of. Many factors, all necessary and only jointly sufficient, are required to push a system over the edge of breakdown. And all of those factors are connected to normal people doing normal work in what seems a perfectly normal organization. These factors, then, are also the stuff of which recommendations for improvement are made. And they were, also in this case. The Air Traffic Control organization issued no fewer than 23 recommendations, all of them aimed at rectifying systemic arrangements in, for example, design, layout, staffing, coaching, communications, and handovers. The independent safety investigation board issued nine, quite similar, recommendations. This, as far as the community was (and is) concerned, is how the incident cycle was supposed to work. A free lesson, in which nobody got hurt, was milked for its maximum improvement potential. The people involved had felt free to disclose their accounts of what had happened and why. And they had felt empowered to help find ways to improve their system. Which they then did, for everybody’s benefit.
But two years after the incident, the aviation prosecutor of the country decided to formally charge the coach/supervisor, the trainee, and the assistant controller with “the provision of air traffic control in a dangerous manner, or in a manner that could be dangerous, to persons or properties.” (The country’s law actually contains such provisions.) Each of the three controllers was offered a settlement: they could either pay a fine or face further prosecution. Had they paid the fine, the prosecutor would have won her “test” and the door for future prosecutions would have stood wide open. The controllers collectively balked. A first criminal court case was held a year and a half after the incident. The judge ruled that the assistant controller was not guilty, but that both the trainee and the coach/supervisor were. They were sentenced to a fine of about 450 US dollars or 20 days in jail. The trainee and the coach/supervisor decided to appeal the decision, and the prosecutor in turn appealed against the assistant controller’s acquittal.
More than a year later, the case appeared before a higher court. As part of the proceedings, the judges, prosecutor, and their legal coterie were shown the airport’s tower (the “scene of the crime”), to get a first-hand look at the place where safety-critical work was created. It was to no avail. The court found all three suspects guilty of their crime. It did not, however, impose a sentence. No fine, no jail time, no probation. After all, none of the suspects had criminal records, and indeed the air traffic control tower had had its share of design and organizational problems. The court had found legal wiggle room by treating the case as an infringement of the law, as opposed to an offense. It was as if they were proving themselves right and wrong at the same time. The court was wrong to bring and prosecute the case because there was no offense, but did not waste tax money after all because they managed to find an infringement. This was actually a no-brainer, as an infringement means “guilt in the sense that blame is supposed to be present and does not need to be proven.” The only admissible defense against this is being devoid of all blame. This would work only if the air traffic controller was off-duty and therefore not in the tower to begin with. It was a celebration of perverse formalism (to use judge Thomas’ words): a decorous nod to the prosecutor who had gone out to test the waters, and a measly but still unsettling warning to air traffic controllers and other professionals that they were not above the law. And it stopped all appeals: appealing an infringement is not possible as there is no conviction of an offense, and no punishment. The real punishment, however, had already been meted out. It was suffered by the safety efforts launched earlier by the air traffic control organization, particularly its incident reporting system. Over the two years that the legal proceedings dragged on, incident reports submitted by controllers dropped by 50%.
Many people, especially from the various professional communities, are duly concerned. The secretary-general of the worldwide association of air traffic control providers warned of “grave and undesirable consequences for safety” when judicial systems get involved.81
BUT ISN’T THERE ANYTHING POSITIVE ABOUT INVOLVING THE LEGAL SYSTEM?
Some in the legal community see the criminalization of error as a long-overdue judicial colonization of rogue areas of professional practice. It is, they say, a clamp-down on closed, self-serving, and mutually protective professional “brotherhoods” that somehow assert a special status and hold themselves to be above the law. Law is seen as authoritative, neutral, and fair, and it should reign equitably over everybody (hence Lady Justitia’s blindfold): there should be no exception or discrimination either way.82
An increasingly vocal consumer movement, wanting greater control over safety in a variety of products and services, has been seen as sponsoring this view.83 Pilots, doctors, air traffic controllers—already adequately compensated monetarily for the responsibility bestowed upon them—should be treated like everybody else. If they commit a culpable act, they should be held accountable for it. Exceptionalism is antidemocratic.
There is no evidence, however, that the original purposes of a judicial system (such as prevention, retribution, or rehabilitation—not to mention getting a “true” account of what happened or actually serving “justice”) are furthered by criminalizing human error.
• The idea that a charged or convicted practitioner will serve as an example to scare others into behaving more prudently is probably misguided: instead, practitioners will become more careful only in not disclosing what they have done.
• The rehabilitative purpose of justice is not applicable either, as there is usually little or nothing to rehabilitate in a pilot or a nurse or air traffic controller who was basically just doing her or his job.
• Also, correctional systems are not equipped to rehabilitate the kind of professional behaviors (mixing medicines, clearing an aircraft for takeoff) for which people were convicted.
Not only is the criminalization of human error by justice systems a possible misuse of tax money—money that could be spent on better ways to improve safety—it can actually end up hurting the interests of the society that the justice system is supposed to serve. Indeed, other ways of preventing recurrence can be much more effective:
Alan Merry dryly remarked: “The addition of anti-hypoxic devices to anesthetic machines and the widespread adoption of pulse oximetry have been much more effective in reducing accidents in relation to the administration of adequate concentrations of oxygen to anesthetized patients than has the conviction for manslaughter of an anesthetist who omitted to give oxygen to a child in 1982.”83
If you want a people in a system to account for their mistakes in ways that can help the system learn and improve, then charging and convicting a practitioner is unlikely to do that.
So far, I have basically talked about criminal legal proceedings (and will do so again in Chapter 5). This has a reason: there may be a trend toward criminalizing human error. So it is useful to assess whether or not that is a reasonable way to achieve the dual goals of a just culture: explanations of failure that satisfy calls for accountability and offer opportunities for change and progress on safety. So far, the evidence suggests that criminal law does not contribute to the achievement of these goals.
But another kind, called tort (or civil) liability, has been in use to deal with human error for quite a while, particularly in healthcare. Tort is a legal term that means a civil (as opposed to a criminal) wrong. To be liable under tort law, you do not have to have a formal contract with the other party, as it covers duties for all citizens under a particular jurisdiction (which is true of criminal law too of course). If a court concludes that an action is a crime, then the state can impose punishment (such as imprisonment or fines). If an action is a tort, however, the consequence is usually the payment of damages to the party injured or disadvantaged by the action. Tort law is applicable particularly in legal systems that stem from English common law, but even Napoleonic and other legal systems have ways of compensating victims through civil legal procedures. The technical variations are of course both subtle and many. Also, there can be overlap between crime and tort in some countries: the same action can be prosecuted as a crime (possibly resulting in the state imposing penalties) and as a civil tort (possibly resulting in damages to the victim).
Tort law too, has come under criticism for contributing neither to safety nor to justice when it comes to human error1,60:
• Tort law is a very irregular mechanism to compensate victims of error. According to one study, only one in seven patients who can be said to have been “negligently” harmed ever gain access to the malpractice system. Those who are older and poorer are disproportionately excluded from access.59,84,85
• Tort law also delivers compensation inefficiently. Administrative costs account for more than 50% of total system costs, and a successful plaintiff recoups only one dollar of every $2.50 spent in legal and processing costs.85
• Malpractice claims offer only the chance of financial compensation. They do not have as a goal to encourage corrective action or safety improvements; they do not help people get an apology or any other expression of regret or concern.
• Tort law includes practices such as pre-trial discovery and all kinds of rules that govern disclosure and the protection of information. And of course, a trial is in itself adversarial, lining up people against each other in competitive positions. The upshot is that tort law makes it more difficult to get facts out, rather than helping people find out what went wrong and what to do about it so it does not happen again.
• Also, the adversarial process is based on the idea that the presentation of relentless, one-sided arguments to an impartial judge or jury is the best way to get to the “truth.” Chapters 2 and 3 did acknowledge that multiple stories are necessary if we want to learn anything of value about complex events, but that does not mean only two, necessarily opposing stories, where what is true in one is almost automatically false in the other. The ones who tell these stories are often not the ones who know them best (the physician or the patient), but rather their lawyers, who will have to abstract away from the details and cast things in a legal language that can get far removed from the actual meaning of people’s actions and intentions at the time.
• As with criminal trials (which do not deter people from making mistakes but do deter people from talking about their mistakes), tort law promotes defensive practice rather than high-quality care.86
WITHOUT PROSECUTORS, THERE WOULD BE NO CRIME
We do not normally ask professionals themselves whether they believe that their behavior “crossed the line.” But they were there, and perhaps they know more about their own intentions than we can ever hope to gather. Perhaps they are in a better position to say whether substance abuse played a role, or whether the procedures that they violated were workable or correct or available. And whether they knowingly violated them or not. Yet we don’t rely on insiders to give us the truth. After all,
• We suspect that those people are too biased for that.
• We reckon they may try to put themselves in the most positive light possible.
• We will see their account as one-sided, distorted, skewed, partial—as a skirting of accountability rather than embracing it.
To get a truthful account of what happened, we do not typically listen to the people who were there, even if we do sometimes give them a voice (like we do in a trial, for example).
So, again, the central question keeps coming up: who gets to decide instead? Is there a perspective that is not biased? A perspective that is impartial, neutral? We often turn to our legal systems for this. We expect a court to apply reason, and objectivity, and come up with the real story, with the truth. And then hand out consequences for those responsible for the outcome. From a distance, it may well come across this way. A disinterested party takes an evenhanded look at the case. The appropriate person gets to be held accountable. Appropriate consequences are meted out. Truth and justice are served.
The legal system certainly goes to great pains to appear as if it is impartial. Many of the trappings of the justice system are designed to impart an image of rationality, of consideration, of objectivity and impartiality.
• Think, for starters, of Lady Justitia’s blindfold—the very profile of neutrality.
• The pace of judicial proceedings is measured, the tone solemn.
• The rules of proceedings are tight and tightly controlled.
• The uniforms and settings and language invoke a kind of otherworldliness, of not exactly belonging to the daily, messy hubbub of the real world out there.
• Even the buildings are often designed so as to be set apart from the rest of the world: just imagine your own local courthouse. It is probably separated from the sidewalk by gates, lawns, forecourts, high steps.
• The judges are often behind enormous doors, seated at a distance from other people, on podia, behind solid desks, under high ceilings.
Does this symbolism and imagery, this elevation and separation—meant to offer the assurance of rationality and impartiality—really give a court a better, more neutral view of the truth?
Telling the story from an objective angle is impossible, no matter how objective, disinterested, unbiased you may think you are. Or how neutral we make Lady Justitia look with her blindfold. Just ask yourself, if you were to take an objective look at the world, from where would you look? An objective view is a “view from nowhere.”87 And there is no view from nowhere, as there would be nobody to form the view.
So no view can be neutral, or objective. Because no view can be taken from nowhere. This means that all views somehow have values and interests and stakes wrapped into them. Of course, we can try to control the influences of those values and interests. And the legal system has great traditions and symbols and rituals to do just that. But in the end, nobody can discover or generate a value-free truth. Judges are stakeholders in the healthcare system too. They may be consumers of it, after all. And they have a larger role: helping maintain stability, and confidence in a society’s institutions.
In nurse Mara’s Xylocard case, the Supreme Court admitted that its agenda was in part to reassure any disquiet about the safety of the healthcare system: “Concern for patients’ safety and their confidence in the healthcare system, demand that the nurse’s actions be seen as so clumsy that they imply culpable negligence. She therefore cannot avoid being responsible for manslaughter.”69 The maintenance of “confidence in the healthcare system” demanded the construction of a version where one antihero could be singled out to receive the blame, to bear the explanatory and moral weight of the infant’s death.
For a court to find an offense, and to call it criminal, is not the product of blind arbitration. It is not the clearest view on things from an objective stance. It is not the cleanest, truest rendering of a story. Instead, it is the negotiated outcome of a social process. And as such it is not much different (if at all) from any other social process, in how it is influenced by history, tradition, institutions, personal interactions, hopes, fears, desires.
To get to the “truth,” you need multiple stories. Recall from Mara’s case how the justices were struggling to divine what the medicine cartons were all about, what the strange names and figures meant. And recall from the pilot’s case how he tried to show to the court that configuring the airplane for approach took more time than had been available—and nobody cared. While the professionals on trial doggedly searched for ways to get “the truth” out, it never would.
Multiple versions competed and contradicted each other, but many of them seemed equally valid. All illuminated different aspects of the case. In the Xylocard trial, the pediatrician had a point: his repeated bolus doses of Xylocard into the baby could not be judged in light of the fact that the baby was already getting 10 times the prescribed dose through her drip. He could not have known that, after all. The nurses had a point too: ordering bolus dose after bolus dose, with only worsening effects, and without ever having established a diagnosis for the baby’s condition, did not make perfect sense. Settling for only one version amounts to an injustice toward the complexity of the adverse event that the nurse was on trial for.
Similarly, the captain had a point: it was the airline, its image, production pressures, and routine dispensations to as yet unlisted doctors and unqualified copilots that helped box him in. But the other side had a point too: why had this pilot not voluntarily contributed to learning and improvement after the incident?
This implies that forcing one story onto other people as if it were the true and only one (like the justice system sometimes does) is actually quite unjust. Just like the cubists try to paint multiple perspectives at the same time, a just culture always takes multiple stories into account, because
• Telling the story from one angle necessarily excludes aspects from other angles.
• No single account can claim that it, and it alone depicts the world as it is.
• Innumerable stories are possible, and, if you want to be “just,” or approximate the “truth,” a number are even necessary.
• Also, if you want to explore as many opportunities for safety improvement as possible, you probably want to listen to as many stories or angles as possible. The world is complex—live with it. And learn from it what you can.
A colleague in healthcare told me how he believed that some acts are objective, self-evident, or even unarguably criminal—substance above by the provider, for instance (a doctor being drunk on duty), or deliberately unsafe acts. He told me the story of some nurses who substituted diuretic tablets for pain relieving tablets as a prank to make patients demand urine bottles from the night staff. These were egregious acts, he said. Criminal acts. That could be dealt with only through discipline or other legal forms.
I am in no position to say that these things are not crimes. But what I find interesting is how we come to give the acts meanings as crimes, committed by these individuals at that moment. Seeing these acts as criminal can rule out or obscure a host of other factors that may once again trigger other people to behave similarly “criminally.” When it comes to doctors deliberately murdering patients, for example, this raises a host of questions about access control to the profession (Is there a psychiatric evaluation to become a doctor? To become an airline pilot there is. Are there regular proficiency checks for doctors practicing on their own? For pilots there are). Drunk or stoned doctors raise questions about working hours (36-hour shifts, 80+-hour weeks) and the effects on their personal lives. Playing a prank on the night staff at the cost of patients raises questions about organizational staff disputes that are left unaddressed, and about the ethical awareness of the staff involved.
Yes, through the eyes of a lawyer or prosecutor, these acts may well look like crimes. The language of “crimes” is one that would seem to fit the acts above quite well. But that is not necessarily the only language in which we can talk about things such as the ones above. Or do something about them. Without the prosecutor, there would be no crime. Indeed, if given into the hands of others, these “crimes” can be constructed quite easily as different things:
• As societal or professional trade-offs (we make our doctors work long hours in part because healthcare is hugely expensive already, and we trust them to remain healthy, alert, and self-responsible once we license them)
• As managerial issues (simmering interdepartmental or cross-shift conflicts are not resolved early enough through higher-level intervention)
• As pedagogical ones (ethical training for staff)
No one can say that one interpretation is better or more “right” or just than another. But different interpretations are possible. And all interpretations have a logical repertoire of action appended to them. See only one interpretation and you may miss other important possibilities for progress on safety.
JUDICIAL PROCEEDINGS AND JUSTICE
But wait, you may say, doesn’t the legal system help society understand what went wrong and why, and what we can do about it? The chances that a legal system will tease out a meaningful and just account of what happened are actually remote. It is not its charter, and even if it were, it is not particularly good at it.
Go back again to nurse Mara’s case: putting all of the responsibility for the baby’s death on her shoulders made no historical sense whatsoever, and was really hard to see as fair or just. Lots of other people had been involved, and she had not even administered the drug in question. The judicial proceedings in the aftermath of the baby’s death, through sheer design and rules of relevancy, played down or ignored these other contributions. It ended up with an account of a complex system failure that contradicted decades of research into how such accidents actually happen.
The potential for bad outcomes lies baked into the very activity that we ask practitioners to do for us. The criminal trial of the airline captain from a case earlier in this book (“Case Study: When Does a Mistake Stop Being Honest?”), for example, found him guilty of “endangering his passengers” while flying an approach to a runway in fog. “I do that every day I fly,” a colleague pilot had responded. “That’s aviation.”15
Pilots, nurses, doctors, and similar practitioners endanger the lives of this everyday as a matter of course. How something in those activities slides from normal to culpable, then, is a hugely difficult assessment, for which a judicial system often lacks the data, the education, and the expertise. The decision whether to prosecute a practitioner, then, can turn out to be quite haphazard, and the practitioner on the receiving end will likely see this as quite unjust.
In the same year that nurse Mara was first charged, more than 300 severe medication errors were reported to the country’s health authority. In another study, a full 89% of responding anesthetists reported having made drug administration errors at some stage in their careers. Most had done so more than once, and 12.5% reported having actually harmed patients in this way.88 So why the nurse in the Xylocard case, and not one of scores of other medical practitioners who go through similar medication misadventures—all the time, everywhere?
It is the whole point of legal proceedings to narrow in on a few acts by a few individuals or even a single individual. By its very nature, however, this clashes with what we know about accident causation in complex, dynamic systems today. Many factors, all necessary and only jointly sufficient, are needed to push a basically safe system over the edge into breakdown. Single acts by single culprits are neither necessary nor sufficient. This, logically, does not make judicial proceedings about complex events “just.”
The accounts of an accident that a legal system produces can be so limited in many ways because of the way it conducts its business—among other things through
• The way judicial proceedings rationalize the search for and consideration of evidence
• How they closely script turn-taking in speech and form of expression
• How they limit what is relevant, and are institutionally constrained in their deferral to domain expertise
• How they necessarily exclude the notion of an “accident” or “human error” because there are typically no such legal concepts
This is not to deny the relevance or even authority of a legal tradition, at least not on principle. It is, rather, to see it as that: one tradition, one perspective on a case of failure. One way for which prosecutors and judges have received the power to enforce it on others, one language for describing and explaining an event, relative to a multitude of other possibilities.
Another consequence of the accountability demanded by legal systems is that it is easily perceived as illegitimate, intrusive, and ignorant. If you are held “accountable” by somebody who really does not understand the first thing about what it means to be a professional in a particular setting (a ward, a cockpit, a control room, a police beat), then you will likely see their calls for accountability as unfair, as coarse and uninformed. Indeed, as unjust. Research shows that this results in less disclosure and a polarization of positions, rather than an openness and willingness to learn for the common good.27
Garuda Indonesia pilot Marwoto Komar was found guilty of criminal negligence while at the controls of a Boeing 737 that slammed onto the runway at Yogyakarta Airport. The plane careered into a field and burst into flames on March 7, 2007. A majority of a panel of five judges at the Sleman District Court sentenced the pilot to two years in prison. They said there was no evidence that his plane had malfunctioned. Prosecutors had called for four years in prison. They said he ignored a series of warnings not to land as he brought the plane in far above the safe speed. Twenty-one people were killed. Relatives attending the trial said the penalty was not enough. The Indonesian Pilots Federation said it would appeal. One of the panel of five judges remarked that the sentence was not about revenge, but about the prevention of future accidents.89
JUDICIAL PROCEEDINGS AND SAFETY
If judicial processes in the wake of accidents can be bad for justice, what about their effects on safety? Here is a summary of some of the adverse effects.
• Judicial proceedings after an incident can make people stop reporting incidents. The air traffic control provider in the example in this chapter reported a 50% drop in incidents reported in the year following criminal prosecution of controllers involved in a runway incursion incident. Interestingly, the criminal prosecution does not even have to be started, let alone lead to a conviction: the threat of criminal prosecution can make people hesitant about coming forward with safety information.
• Judicial proceedings, or their possibility, can create a climate of fear about sharing information. It can hamper an organization’s possibility to learn from its own incidents. People may even begin to tamper with safety recording devices, switching them off.
• Judicial proceedings can interfere with regulatory work. Some regulators, for example, have become more careful in using language such as “deviation” in their inspection reports. If it is a “deviation” that a regulator takes notice of, it is very likely a deviation from some regulation. And regulations have their basis in law. A “deviation” can then easily become a breaking of the law—a crime, rendering sources at the operator silent as a result. Regulators can become much less direct about what is wrong and needs to be done about it.
• Judicial proceedings can help stigmatize an incident as something shameful. Criminalizing an incident can send the message to everybody in the operational community that incidents are something professionally embarrassing, something to be avoided, and if that is not possible, to be denied, muffled, hidden.
• The stress and isolation that practitioners can feel when subject to legal charges or a trial typically causes them to perform less well in their jobs. And investing cognitive effort in considering how actions can get you in legal trouble detracts attention from performing quality work.27
• Finally, judicial proceedings in the aftermath of an accident can impede investigatory access to information sources, as people may become less willing to cooperate in the accident probe.79 This could make it more difficult for investigators to get valuable information, particularly when judicial proceedings are launched at the same time as the safety investigation. There is, however, a suggestion (at least from one organization) that criminal prosecution in the aftermath of an accident does not dampen people’s report willingness regarding incidents. This could point to a subtlety in how employees calibrate their defensive posture: an accident, and becoming criminally liable for one, is somehow judged to be qualitatively different from liability for incidents.
While the US National Transportation Safety Board was investigating a 1999 pipeline explosion near Bellingham, Washington, that killed three people, federal prosecutors launched their own criminal probe. They reportedly pressured employees of the pipeline operator to talk. Several invoked the US Constitution’s Fifth Amendment, which protects against self-incrimination. They refused to answer questions from Safety Board investigators as well as from the police.76
The cases of human error that have gone to trial so far suggest that legal proceedings—tort or criminal—in the wake of incidents or accidents could be bad for safety, and may not help in creating a just culture.
Many inside and outside professional circles see a trend toward criminalization of human error as troublesome. If justice exists to serve society, then prosecuting human error may work against that very principle. The long-term consequence for society of turning errors into crimes or culpable malpractice could be less safe systems. Criminalizing error, or pursuing tort claims, can
• Erode independent safety investigations
• Promote fear rather than mindfulness in people practicing safety-critical work
• Make organizations more careful in creating a paper trail, not necessarily more careful in doing their work
• Make work of safety regulators more difficult by stifling primary sources of information and having to package regulatory findings in a language that does not attract prosecutorial attention
• Waste money on legal processes that do not really end up contributing to justice or to safety
• Ignore needs of victims other than mere financial ones, such as apology or the recognition of having been harmed
• Discourage truth-telling and instead cultivate professional secrecy, evasion, and self-protection
If they become the main purveyor of accountability, legal systems could help create a climate in which freely telling accounts of what happened (and what to do about it) becomes difficult. There is a risk of a vicious cycle. We may end up turning increasingly to the legal system because the legal system has increasingly created a climate in which telling each other accounts openly is less and less possible. By taking over the dispensing of accountability, legal systems may slowly strangle it.
INDUSTRY RESPONSES TO CRIMINALIZATION
What if you try to build a just culture in an organization that has a tendency to prosecute your employees for their involvement in incidents while at work? How does that influence what you can accomplish inside your organization? There is of course a relationship between how willing your practitioners are to report their involvement in an incident and how the outside world is likely to discover and deal with such information. Protecting your organization’s data from undue outside probing is one response that gives your employees the confidence that they can report or disclose internally without fear of outside consequences. How can you do that? One response, as in the example that follows, is to do more to hide and protect your data.
Some of Canada’s large commercial airlines started requiring government inspectors to sign confidentiality agreements to make sure their safety records stay private before letting them comb over company records to assess a controversial new oversight system. Over the year that followed, inspectors were going to conduct in-depth assessments of the safety management system (SMS) at Canada’s large airlines, including Air Canada, WestJet, Air Transat, Porter Airlines, and Skyservice. The new safety system—a first in civil aviation—put more onus on airlines in managing safety risks in their operations and became fully phased in at Canada’s large commercial carriers.90 Asking inspectors to sign confidentiality deals before allowing them to do the inspections suggested a climate of a lack of trust and a fear of open or honest disclosure.
Some countries have succeeded in exempting safety data in very narrow cases from freedom-of-information legislation. The Air Law in Norway, for example, states in Article 12-24 about the “Prohibition on use as evidence in criminal proceedings” that “Information received by the investigating authority may not be used as evidence in any subsequent criminal proceedings brought against the persons who provided the evidence.” Of course, this does not keep a prosecutor or judge from actually reading a final accident report (as that is accessible to all citizens), but it does prevent statements provided in good faith from being used as evidence. Similar legislation exists, though in other forms, in various countries. Many states in the United States, for example, protect safety data collected through incident reporting against access by potential claimants. Most require a subpoena or court order for release of the information.1
One problem with this, of course, is that such protection locks information up even for those who can rightfully claim access, and who have no vindictive intentions. Imagine a patient, for example, or a victim of a transportation accident (or the family), whose main aim is to find out something specific about what happened to their relative. The protection of reporting, in other words, can make such disclosure more difficult. So when you contemplate formally protecting reported safety information, you should carefully consider obligations to these stakeholders as well.
Another, radically different response is to disclose preemptively. Preexisting trust between stakeholders is crucial for this to work. The judiciary might be willing to let an organization handle its own incidents when it has the confidence that the organization will come to it if a case is deemed to fall outside of what it is capable of handling. This is a step that requires courage on part of the organization and its employees.
Near misses and other incidents involving aircraft at Schiphol, one of Europe’s busiest airports, will from today (13 January 2015) be made public by the Dutch Air Navigation Service Provider Luchtverkeersleiding Nederland (LVNL), in a bid to reassure the public about the safety of air travel. LVNL will become the first European air traffic control provider to publish information on its website on individual incidents within days of them happening. In the UK and many other countries, these are collated and quantified to be published annually without specific information on individual incidents.
Paul Riemens, chief executive of LVNL, said the move was intended to show the public and regulators that incidents, such as when aircraft come too close to each other on a runway, were properly investigated and the lessons implemented quickly. After a year in which aviation suffered two catastrophic air accidents, the demand for increased transparency and higher safety levels had intensified. “I am convinced others will follow,” he said.
The UK’s Airprox Board said UK authorities would watch LVNL’s initiative with interest. “We are always looking at what we can do to improve the quality of information we hold,” he said. However there was a risk that making incidents known so quickly could inflame fears over air travel. “The public will see these incidents and suddenly they might think air travel is not safe, which is not the case,” he said. Even after the two disasters with Malaysia Airlines and AirAsia, the international safety record in 2014 was “the safest in many years.”
The Dutch move comes as Europe adopts a new way of measuring safety using a “risk analysis tool.” The results will be published annually from 2016 by the European Commission. However, Mr Riemens said that given the variation of airport layouts, standard rules benchmarks could be difficult to apply. Releasing incident information would help to encourage a culture of improved safety. “People that work for the organisation know that the whole world is looking at them,” he said.
LVNL has invested in information systems which will cut the time it takes to file an incident report, Mr Riemens said, which will then appear in a few hours or days. The website will show information on specific incidents, covering causes and effects as well as the measures taken to reduce the risk of similar incidents in the future. However it will not identify the airline or the individual aircraft involved.
In 2014 LVNL guided 539,548 flights in Dutch airspace. Schiphol, at Amsterdam, is Europe’s fourth busiest airport with 70 per cent of passengers transferring on to flights to the rest of the world. It handled a total of 449,379 flights in 2014. Between 2007 and 2013 the number of runway incursions reported to LVNL fell from 40 to 23. Between 2011 and 2014 the number of major and serious incidents fell from 57 to 35.91
The key idea in the preemptive solution above is once again trust: trusting that the information that is voluntarily shared will not get used against you. That, in turn, depends on a relationship of trust between people inside of the organization, and between the organization and other stakeholders outside of it (e.g., regulators, the media, the judiciary).
Let us put the question of the protection of safety data in the context of three questions we have been asking about retributive just cultures.
1. Who in the organization or society gets to draw the line between acceptable and unacceptable behavior?
2. What and where should the role of domain expertise be in judging whether behavior is acceptable or unacceptable?
3. How protected against judicial interference are safety data (either the safety data from incidents inside of the organization or the safety data that come from formal accident investigations)?
The differences in the directions that countries or organizations or professions are taking toward just cultures come down to variations in the answers to these three questions. Some work very well, in some contexts, and others less so. Also, the list of solutions is far from exhaustive, but it could inspire others to think more critically about where they or their organization may have settled (and whether that is a good or a bad thing). The case study concludes with a joint industry response: a declaration against automatic prosecution in the wake of incidents and accidents, and suggestions for what to do instead.
This is a solution that a number of country or professions apply, perhaps because they have not yet been confronted by the consequences of judicial action against practitioners or have themselves seen the difficulty of acting in the wake of failure. This may, of course, be just a matter of time.
1. Who gets to draw the line: in most likelihood a prosecutor who has become inspired by media reports or other triggers that made her or him look more closely into an occurrence. General risk statutes, or other laws, can be used to accuse practitioners of, for example, endangering the lives of other people. Access to data to build a criminal case should be relatively easy if the country or profession has not done much or anything to prevent such judicial intrusions into their safety data. The prosecutor draws the line in the first instance, and then the judge (or jury) gets to decide.
2. The role of domain expertise is likely minimal in judging whether a line of acceptability was crossed or not. A prosecutor, for example, has none or limited domain expertise, yet she or he gets to demonstrate whether professional judgments are culpable or not. The judge is not likely to have any domain expertise either.
3. Protection of safety data is not likely to exist, and even if it does, then a country or profession that goes by local solution 1 probably has caveats in its protection so that a prosecutor can open up databases on suspicion of a crime (and the prosecutor is often the one who decides when that is the case).
Practitioners may feel uncertain and anxious about whether “they will be next” because the rules of criminalization are left unclear and open to interpretation. Who gets criminalized for what seems random. A just culture is a long way off, and open and honest reporting could be difficult.
RESPONSE 2: THE VOLATILE SAFETY DATABASE
Some countries or professions that do not actively handle the three questions in legislation or cross-disciplinary arrangements (e.g., between their departments of transportation or health on the one hand and justice on the other) spontaneously call for the creation of a next local solution: the destroyable safety database. This means that the safety data that organizations gather themselves are stored in a form that is very easy and quick to destroy. Some safety departments have seriously considered this idea, so as to immunize themselves against prosecution. This is especially the case in countries where the organization’s personnel are themselves government employees (such as some hospital workers or air traffic controllers) and can thus be forced, through various statutes and laws, to hand over anything that belongs to the state.
1. Who gets to draw the line: same as local solution 1.
2. The role of domain expertise: same as local solution 1.
3. Protection of safety data could be guaranteed, as the data will vanish when prosecutorial pressure is applied. The cost, of course, is huge: the disappearance of an organization’s safety database (which can in turn violate other statutes).
This is not really a practical solution because of the consequences of destroying a database. But that it is being considered in several countries or professions in the first place should serve as an indication of the lack of trust necessary for building a just culture. The relationship between the various stakeholders may be troubled or underdeveloped. The suspicious climate sustained by this solution will not be good for the growth of a just culture.
RESPONSE 3: FORMALLY INVESTIGATE BEYOND THE PERIOD OF LIMITATION
In almost all countries, prosecutors have a limited number of years to investigate and prosecute crimes. In one country, the investigation of an accident took so long that the so-called period of limitation for any possible charges (seven years in this case) expired. Practitioners sighed in relief. Inspired by such apparently legitimate delaying tactics, stakeholders in other countries and professions have considered deliberately stalling an investigation so that the judiciary could not get access until the period of limitation has expired. This solution works only, of course, if the judiciary is legally limited in beginning its probe of an occurrence while the formal investigation is still ongoing. In some countries or professions this is indeed the case.
1. Who gets to draw the line: while prosecutors and judges would still be left to draw the line eventually, other parties can withhold from them both the data and the opportunity to do so.
2. The role of domain expertise is interesting in this solution, as those with more expertise of the domain (safety investigators) make a judgment of the potential culpability of the acts they are investigating. If they judge these acts to be potentially (but unjustifiably and counterproductively) culpable, they may stall an investigation until the period of limitation has expired. In this sense, investigators introduce domain expertise into the judgment of whether something is acceptable or not, but they apply this expertise in advance—anticipating how the judiciary would respond to the data they have. Investigators may of course lack the domain expertise in the legal area to really make an accurate ex ante judgment, but previous experiences or the general climate in the country or profession may give them a good basis for their conjecture.
3. Protection of safety data is pretty strong, but of course hinges on the strength of the laws and statutes that prevent the judiciary from getting access to investigation data before the period of limitation has expired. Any legal opportunities that allow the judiciary to get into the formal investigation will directly undermine this solution.
A climate of distrust and competition between stakeholders remains strong with this solution. Rather than resolving issues on merit, stakeholders may engage in legal gaming to try to get access (or retain privileged access) to safety data for their own purposes. The climate is not encouraging for the emergence of a just culture.
RESPONSE 4: RELY ON LOBBYING, PROSECUTORIAL, AND MEDIA SELF-RESTRAINT
A solution that is different from the previous ones relies almost entirely on trust between stakeholders. It has been achieved in a few countries (often after intense lobbying of lawmakers and other government officials by industry stakeholders). It has succeeded particularly in countries with strong freedom of information acts that leave their safety data exposed to both media and judiciary.
This local solution depends entirely on the extent of the trust developed and maintained, not on legal protection for any of the stakeholders. Thus, these countries typically have no protection in place for either reporters or safety data, and the judiciary has unfettered access to investigations—in principle. In practice, no prosecutor has dared to be the first to breach the trust built up. Interestingly, this solution seems to work in smaller countries that are culturally inclined toward homogeneity, trust, coherence, and social responsibility.
1. Who gets to draw the line: prosecutors would in principle get to draw the line, but they have so far not dared to draw anything. The proscription against them doing so is not a legal one, but rather cultural or political: going in and upsetting the delicate trust developed between parties is “not done” or politically not wise. But that does not mean it cannot be done. In fact, rules in countries with this solution still make exceptions for the kinds of “crimes” or “gross negligence” that prosecutors should still prosecute. The problem is of course chicken-and-egg: how is a prosecutor to find out whether a line was crossed without drawing one?
2. The role of domain expertise has been considerable in building the necessary trust between stakeholders, particularly in convincing other stakeholders (the media, the judiciary) of the value of their self-restraint, so that the entire society can benefit from safer professional systems.
3. Protection of safety data is not legally guaranteed but achieved by cultural convention and/or political pressure.
At first sight, this solution comes across as a fraud, and as extraordinarily brittle. After all, there is nothing “on paper:” the entire contract between stakeholders to not interfere with each other’s business is left to consensual agreements and trust. Practitioners may feel free to report because historically there is no threat (but can history be a guarantee for the future in this case?). On deeper inspection, though, this solution is as robust as the culture in which it is founded. And cultures can be very robust and resistant to change. This, at the same time, creates a high threshold for entry into such an arrangement: without the right cultural prerequisites, this solution may be difficult to achieve.
RESPONSE 5: JUDGE OF INSTRUCTION
In the wake of prosecutions of practitioners that were widely seen as counterproductive to safety, some countries have moved ahead with installing a so-called judge of instruction. Such a judge functions as a go-between, before a prosecutor can actually go ahead with a case. A judge of instruction gets to determine whether a case proposed by a prosecutor should be investigated (and later go to trial). The judge of instruction, in other words, can check the prosecutor’s homework and ambitions, do some investigation him- or herself, and weigh other stakeholders’ interests in making the decision to go ahead with a further investigation and possible prosecution or not.
1. Who gets to draw the line: initially (and most importantly) it is the judge of instruction who gets to draw the line between acceptable and unacceptable (or: between worthy of further investigation and possible prosecution or not). Other considerations can make it into the drawing of the line too (e.g., the interests of other stakeholders).
2. The role of domain expertise is supposed to be considerable in this solution. In the solution of one country, the judge of instruction is supported by a team from the aviation industry to help determine which cases should go ahead and which not. The makeup of this team and their interaction with the judge of instruction are crucial of course. For example, if unions or professional associations are not sufficiently represented, industry representatives may decide that it is in their interest to recommend to the judge to go ahead with prosecution, as it may help protect some of their concerns.
3. Protection of safety data is managed through the judge of instruction. If prosecutors want access to safety data, they will have to go via the judge of instruction, but there are (as usual) exemptions for serious incidents and accidents.
A judge of instruction could function as a reasonable gate-keeper—weighing the various interests before a case can even be investigated by a prosecutor. It means, though, that such a judge needs a fair representation of all stakes, and not be susceptible to asymmetric lobbying by certain parties or interests over others. As it is a rather new solution to the criminalization of human error, there are not a great deal of data yet to see whether it works well or not.
RESPONSE 6: THE PROSECUTOR IS PART OF THE REGULATOR
A solution that takes domain expertise right up to prosecutor level is one in which the prosecutor him- or herself has a history in or affiliation with the domain, and the office of prosecutor for that particular domain is inside of the regulator.
1. Who gets to draw the line: the prosecutor gets to draw the line (to be confirmed or rejected by a judge or jury), and the prosecutor is a person from the domain and employed by a major stakeholder in the domain.
2. The role of domain expertise is considerable, as the prosecutor comes from the domain and is employed by one of its large safety stakeholders. It is thus likely that the prosecutor is better able to balance the various interests in deciding whether to draw a line, and better able to consider subtle features of the professional’s performance that nondomain experts would overlook or misjudge.
3. Protection of safety data is managed as an effect of this arrangement. The regulator has interests in protecting the free flow of safety information (not only as data for its oversight, but particularly for the self-regulation of the industry it monitors).
The integration of prosecutor and regulator can prevent unfair or inappropriate prosecution, not only because of the tight integration of domain expertise, but also because of the greater relevance of the laws or regulations that will likely be applied (as the prosecutor works for a body that makes and applies the laws for that particular domain). The risk in this solution, of course, is that the regulator itself can have played a role (e.g., insufficient oversight, or given dispensation) in the creation of an incident and can have a vested interest in the prosecution of an individual practitioner so as to downplay its own contribution. There is no immediate protection against this in this local solution, except for regulatory self-restraint and perhaps the possibility of appeals higher up in the judiciary.
RESPONSE 7: DISCIPLINARY RULES WITHIN THE PROFESSION
A large number of professional groups (everything from accountants to physicians to hunters to professional sports players) have their own elaborate system of disciplinary rules that are meant foremost to protect the integrity of a profession. Usually, a judiciary delegates large amounts of legal authority to the boards that credibly administer these professional disciplinary rules. Professional sanctions can range from warning letters (which are not necessarily effective) to the revocation of licenses to practice. The judiciary will not normally interfere with the internal administration of justice according to these disciplinary rules. There is, however, great variation in the administration of internal professional justice and thus a variation in how much confidence a country can have in delegating it to an internal disciplinary board.
1. Who gets to draw the line: the professional’s peers get to draw the line between acceptable and unacceptable. There may be pressures, of course, that go outside the actual situation considered, so as to guarantee society’s (and the judiciary’s!) continued trust in the system (e.g., air traffic control, healthcare) and its ability to manage and rectify itself. This may make it necessary to sometimes lay down the line more strictly so that a message of “we are doing something about our problems” clearly gets communicated to the outside—to the detriment of justice done to an individual professional. Who gets to draw the line for criminally culpable actions is an even larger problem: internal rules are not equipped to handle those, so somewhere there needs to be a possibility for judging whether outside legal action is necessary. This can be the prosecutor’s initiative (but then he or she needs enough data to trigger action) or the disciplinary board (yet they likely lack the legal expertise to make that judgment).
2. The role of domain expertise is total. Domain expertise is the basis for making the judgment about the right or wrong of somebody’s actions, not some externally dictated law or statute. Domain expertise is also used to consider whether to forward a case to the formal judiciary (as there will always be an escape hatch for cases of “gross negligence” and so forth). But it is at least largely domain expertise that gets to draw that line here too.
3. Protection of safety data is likely to be independent of professional disciplinary rules and would need additional legislation for formal protection. However, with a functioning (and trustworthy) internal professional disciplinary system in place, people inside a profession may feel freer to report incidents and concerns.
I came across an interesting, spontaneous variant of solving incidents and safety matters internally. An air traffic control center had essentially agreed with some of the airlines frequenting its airspace that they would send reports on near misses and other problems directly to them. This was of course a very short-loop way to learn: a problem was seen and reported directly to the air traffic control center that could do something about it. It also prevented outsiders from making their own judgments about the performance of those involved and meting out any consequences (legal, regulatory). But those other parties (e.g., the regulator) felt that accountability was being shortcut—reporting routines established earlier had ensured that reports would go through them. Lessons learned could also be relevant to the wider industry, something that was missed by this local, internal solution.
The total integration of domain expertise in the administration of justice makes a solution based on professional disciplinary rules attractive. Not only do domain experts judge whether something is acceptable or unacceptable, but they also draw largely from the domain the “rules,” written or unwritten, on which basis they make their judgment.
But there is a possible paradox in the justness of professional disciplinary rules. Because disciplinary rules exist for the maintenance of integrity of an entire profession, individual practitioners may still get “sacrificed” for that larger aim (especially to keep the system free from outside interference or undue scrutiny). To remain trustworthy in the eyes of other stakeholders, then, the disciplinary rules may have to wreak an occasional internal “injustice” so as to outwardly show that they can be trusted. This does not necessarily enhance the basis for just culture, as practitioners could still feel threatened and anxious about possible career consequences.
AVIATION SAFETY GROUPS ISSUE JOINT RESOLUTION CONDEMNING CRIMINALIZATION OF ACCIDENT INVESTIGATIONS92
Alexandria, VA—October 18, 2006—The Flight Safety Foundation (FSF), the Civil Air Navigation Services Organisation (CANSO), the Royal Aeronautical Society in England (RAeS) and the Academie Nationale de L’Air et de L’Espace (ANAE) in France today issued an unprecedented joint resolution decrying the increasing tendency of law enforcement and judicial authorities to attempt to criminalize aviation accidents, to the detriment of aviation safety.93
“We are increasingly alarmed that the focus of governments in the wake of accidents is to conduct lengthy, expensive, and highly disruptive criminal investigations in an attempt to exact punishment, instead of ensuring the free flow of information to understand what happened and why, and prevent recurrence of the tragedy,” said Bill Voss, FSF President and CEO.
“The aviation industry is the most labor-intensive safety operation in the world, and human error is a rare but inevitable factor in the safety chain. Prosecuting basic human error is a grave mistake, as punishment should be reserved for those who are breaking the law,” commented Alexander ter Kuile, Secretary General of CANSO.
“Authorities should be focusing on gathering all the facts and evidence from those involved,” said Keith Mans, RAeS President, “and encouraging pilots, air traffic controllers, mechanics, design engineers, managerial officers, and safety regulatory officials to come forward and admit any mistakes without fear of retribution.”
“There exist many civil and administrative mechanisms to deal with any violation of aviation standards, without resort to criminal sanctions,” said Jean-Claude Buck, President of ANAE.
The safety organizations noted several recent, high-profile examples of this trend, including the ongoing investigation of the recent Embraer/Gol midair collision in Brazil, a recent French Supreme Court decision not to dismiss criminal charges stemming from the July 2000 Air France Concorde crash, an imminent verdict in the criminal trial following the 1992 Air-Inter crash in Strasbourg, France, of government, airline, and manufacturing officials, and the pursuit of criminal manslaughter charges against a number of air traffic controllers and managers of Skyguide in Switzerland in connection with the DHL/Bashkirian midair collision over southern Germany in 2002. The joint resolution makes five main points:
1. Declares that the paramount consideration in an investigation should be to determine the probable cause of the accident and contributing factors, not to criminally punish individuals.
2. Declares that, absent acts of sabotage and willful or particularly egregious reckless conduct, criminalization of an accident is not an effective deterrent or in the public’s best interest.
3. Urges States to exercise far greater restraint and adopt stricter guidelines before officials initiate investigations or bring criminal prosecutions in the wake of aviation disasters.
4. Urges States to safeguard the safety investigation report and probable cause/ contributing factors conclusions from premature disclosure and direct use in civil and criminal proceedings. It also criticized prosecutorial use of relatively untrained and inexperienced “experts,” which can lead to “technically flawed analyses, a miscarriage of justice, and interference with official accident inquiries.”
5. Urges accident investigating authorities to assert strong control over the investigation, free from undue interference from law enforcement, invite international cooperation in the investigation, conduct investigations deliberately and avoid a “rush to judgment,” ensure the free flow of essential safety information, and address swiftly any acts or omissions in violation of aviation standards.