When disaster hits, it's too easy to pin the blame on one person – fixing the underlying problems is better.
The exact circumstances of January's Costa Concordia incident are still being determined, but a few key facts are clear at the time of writing (although it's important to remember the adage that initial reports on such incidents have a high error rate). The root cause of the loss of the cruise liner was a collision with allegedly uncharted rocks that caused serious damage below the ship's waterline near the Tuscan island of Giglio.
It is alleged that the ship was taken deliberately off its (much safer) deep-water course by its commander, Francesco Schettino, in order to sail near to the coast for a ‘tribute' run for the benefit of the island's residents (Schettino claims this was at the company's instruction). At the time of writing, there are 17 confirmed casualties and another 15 passengers unaccounted for; a tiny fraction of the ship's complement, but still a tragic and unacceptable loss of life.
Much of the press coverage has focused on the actions of Schettino – in particular that he apparently ordered the diversion, left the ship too soon after it came to grief and refused to return when instructed to by an irate Italian coastguard. Rumours abound that Schettino was negligent, that he had left the bridge and was even entertaining young women at the time of the collision. He is currently under arrest on suspicion of manslaughter, and the general position seems to be one of blaming him entirely for the incident.
I certainly don't know the full facts of the case, but it is interesting to ask why the actions of a single, allegedly negligent officer could result in such a tragedy. Plenty of armchair observers are quick to point out the danger of such manoeuvres, and it seems unlikely that none of the other bridge crew was aware of the risks. The culture of ‘captain is king' may have taken priority over common sense.
The airline industry is well aware of such problems. After a number of serious accidents caused by pilots taking risks that went unchallenged by their co-pilots, the industry started training airline staff in ‘crew resource management'. Simply put, this does away with the mentality of blind obedience and encourages involvement in decision-making from all cockpit crew (even cabin stewards are encouraged to speak up if they have concerns).
The US Navy goes further, and in the highly risky environment of an aircraft carrier, any member of the flight-deck crew has the authority to abort a take-off or landing. This may sound extreme, but despite the presence of high explosives, fast-moving aircraft and highly flammable fuel stores, the deck of a US aircraft carrier is one of the safest places on the sea.
Back on dry land, these concepts can be applied to information security. There's little point in having a comprehensive security policy if senior staff ignore it and junior staff are too frightened to question practices that could be detrimental to security. It's not enough to encourage everyone to follow policy, but necessary to ensure everyone feels comfortable to raise any doubts they might have.
The case of the Costa Concordia highlights a number of problems with the ship's safety policy. Confused evacuation procedures, poor crew communications, apparent failure to question the captain's actions, lifeboats that could not be deployed – the list is worryingly familiar to anyone au fait with the Titanic disaster. Bizarrely, there is still no legal requirement on the operators of cruise liners to provide safety briefings before sailing.
When a tragedy happens, finding someone to blame often seems to overtake efforts to find, and fix, the root causes. This is understandable, as blaming a person is a simple fix, but fixing a broken system or culture, while far less palatable, has much greater payoff. As Henry Mencken once observed, “for every human problem there is a solution that is simple, neat and wrong”. Finding the right solution is the harder, but essential, choice.