Trust Isn’t Transitive (or, “Someone fired a gun in an airplane cockpit, and it was probably the pilot”)

I’ve been saying that trust isn’t transitive for years, using this example:

We all have a cousin Bubba we trust to change the transmission in our 1970 AMX, but we wouldn’t trust him to babysit the kids for the weekend. Both involve trusting him with our kids lives, but trust isn’t transitive and we know from experience that Bubba is a hard-drinking and hard-living roustabout with greasy fingernails who can certainly keep track of little things like screws, but certainly can’t keep track of little things like children.

Bruce Schneier has pointed out many times that he thinks that arming pilots is stupid. I’d say that arming pilots is stupid only insofar as you don’t make sure they are as, or more, experienced with firearms as they are with airplanes.

Experience will make them predictable, and predictability is critical to trust.

This bring us to this: Someone ND’ed in an airplane cockpit. For those of you who aren’t gun-nuts, an ND is a “Negligent Discharge”. It is the better term, far more preferable than “AD – Accidental Discharge”, because modern guns don’t just accidentally go off. Modern guns built by reputable makers – and I guarantee that the gun this pilot had fits that category, much as the plane he had would fit it – are designed to go BANG when you pull the trigger, and to NEVER go bang when you don’t.

Just as modern cars don’t steer themselves into things they aren’t supposed to, guns don’t accidentally discharge. They go BANG when you pull the trigger. That’s it.

So someone was holding the gun, and it went BANG. There are a few ways this could happen. The pilot could have been checking the condition of the weapon. (Is it loaded? Ooops. Yes.) He (yes there are certainly female pilots, and some of them may be armed, but I will give them the benefit of the doubt in this case and say that all armed female pilots are too smart too shoot a gun in their own cockpit) could have been transferring it from a case to a holster. He could have been loading it… He could also have been showing it off to a flight attendant, which happens to be my favorite potential example:

“Do you guys really carry GUNS?”

“Why yes little lady, some of us sure do. I carry a Sig .357, it’s the same gun those air-marshals use!”.

“Ooooh, can I hold it?”

“Of course, but you need to understand that I’m a trained professional, you can’t just <BANG> <SCREAM>”

“oh shit”

Now, how does this relate to trust not being transitive? Let’s look at this quote from the article in question, attributed to Mike Boyd: “if somebody who has the ability to fly a 747 across the Pacific wants a gun, you give it to them.” This is a horribly flawed assumption, because it assumes that trust is transitive, when clearly it isn’t.

The reason trust isn’t transitive is because trust is most often based on data regarding the past which allows us to make assumptions about specific competence, quality of performance, and behaviors in the future.

We can assume that a trained pilot, when facing piloty thingies, will act like a trained pilot. WE CANNOT ASSUME THAT A TRAINED PILOT WILL ACT LIKE A TRAINED LION-TAMER WHEN FACING A WILD LION.

Skills from one domain cannot simply be moved from that domain to another. Saliently, the pilot in question must have thousands of hours of flight time, has done the pre-flight check hundreds or even thousands of times, has been steeped in pilot-ness and thus pilot-safety, probably since he was a late teen. He’s very likely an extraordinarily safe pilot. We can assume that every experienced 747 pilot has a keen awareness of the potential lethality of full loaded 747. In the past we can assume that they at least had a deep appreciation of the potential for harm to their own passengers, and post 9/11 we can assume that they appreciate the harm their plane can be to thousands of additional people.

But this can’t just be automatically carried to guns – guns aren’t planes anymore than they are motorcycles, and many pilots will tell you that jet pilots are much more like to die on a motorcycle than they are on a plane, because they act stupid on motorcycles.

Good gun-nuts know that you learn specific skills for your weapons and then you do them over and over and over again. In my case, ensuring a gun is unloaded will consist of a series of discrete steps that I’ve repeated at least hundreds of times to ensure that only the things I want to happen will happen.

I always check the condition of a weapon which has been handed to me the exact same way, even if the woman who handed it to me is mrs super gun chick and I watched her remove the magazine, repeatedly work the slide back and forth and then lock it back, stick her finger in the chamber and then visually inspect the chamber and mag-well. Guess what? I’ll do whatever of those things are possible myself, too. And I still won’t paint her or anything I don’t want to destroy.

If you want to trust someone, you need to know about their innate trustworthiness, and you need to know about their experience. Some people are simply more trustworthy than others because, well, they are, and you can trust them more in new situations than other people.

But these people aren’t necessarily the ones well trained in <foo>, so you can’t build security systems around them. If you want to build a system that scales across many users, you want a system that mandates everyone be predictable enough for the system to work. Judging the innate trustworthiness of a person is very hard, so while you may do that you also wind up forcing people you must have a high degree of trust in to do things that makes them appear to be more predictable in the ways you need them to be.

In other words, you train the living shit out of pilots before you let them fly a plane. The same should be said for guns, and I can pretty much guarantee that the armed pilots in the sky today have probably more than 100 times more experience in flying planes than in handling guns. So – either stop the armed pilot experiment, OR train the armed pilots well enough so that they are as predictable as you need them to be, so that you can make some assumptions about their trustworthiness.

Will there be ND’s anyway? Of course. But there are also plane crashes, and that has to be okay. What is important is that the system be predictable, and of course that it have a real, tangible and measurable result. Number of plane crashes vs. flight hours is a simple equation. Now that we’ve had an ND in a cockpit, lets’ take a look at number of ND’s vs. gun-handling hours…

I have related thoughts about guns and training that apply to personal gun ownership, but that’s for another post…