Flying, Guns, Palladium, Security, Trust

Trust Isn’t Transitive (or, “Someone fired a gun in an airplane cockpit, and it was probably the pilot”)

I’ve been saying that trust isn’t transitive for years, using this example:

We all have a cousin Bubba we trust to change the transmission in our 1970 AMX, but we wouldn’t trust him to babysit the kids for the weekend. Both involve trusting him with our kids lives, but trust isn’t transitive and we know from experience that Bubba is a hard-drinking and hard-living roustabout with greasy fingernails who can certainly keep track of little things like screws, but certainly can’t keep track of little things like children.

Bruce Schneier has pointed out many times that he thinks that arming pilots is stupid. I’d say that arming pilots is stupid only insofar as you don’t make sure they are as, or more, experienced with firearms as they are with airplanes.

Experience will make them predictable, and predictability is critical to trust.

This bring us to this: Someone ND’ed in an airplane cockpit. For those of you who aren’t gun-nuts, an ND is a “Negligent Discharge”. It is the better term, far more preferable than “AD – Accidental Discharge”, because modern guns don’t just accidentally go off. Modern guns built by reputable makers – and I guarantee that the gun this pilot had fits that category, much as the plane he had would fit it – are designed to go BANG when you pull the trigger, and to NEVER go bang when you don’t.

Just as modern cars don’t steer themselves into things they aren’t supposed to, guns don’t accidentally discharge. They go BANG when you pull the trigger. That’s it.

So someone was holding the gun, and it went BANG. There are a few ways this could happen. The pilot could have been checking the condition of the weapon. (Is it loaded? Ooops. Yes.) He (yes there are certainly female pilots, and some of them may be armed, but I will give them the benefit of the doubt in this case and say that all armed female pilots are too smart too shoot a gun in their own cockpit) could have been transferring it from a case to a holster. He could have been loading it… He could also have been showing it off to a flight attendant, which happens to be my favorite potential example:

“Do you guys really carry GUNS?”

“Why yes little lady, some of us sure do. I carry a Sig .357, it’s the same gun those air-marshals use!”.

“Ooooh, can I hold it?”

“Of course, but you need to understand that I’m a trained professional, you can’t just <BANG> <SCREAM>”

“oh shit”

Now, how does this relate to trust not being transitive? Let’s look at this quote from the article in question, attributed to Mike Boyd: “if somebody who has the ability to fly a 747 across the Pacific wants a gun, you give it to them.” This is a horribly flawed assumption, because it assumes that trust is transitive, when clearly it isn’t.

The reason trust isn’t transitive is because trust is most often based on data regarding the past which allows us to make assumptions about specific competence, quality of performance, and behaviors in the future.

We can assume that a trained pilot, when facing piloty thingies, will act like a trained pilot. WE CANNOT ASSUME THAT A TRAINED PILOT WILL ACT LIKE A TRAINED LION-TAMER WHEN FACING A WILD LION.

Skills from one domain cannot simply be moved from that domain to another. Saliently, the pilot in question must have thousands of hours of flight time, has done the pre-flight check hundreds or even thousands of times, has been steeped in pilot-ness and thus pilot-safety, probably since he was a late teen. He’s very likely an extraordinarily safe pilot. We can assume that every experienced 747 pilot has a keen awareness of the potential lethality of full loaded 747. In the past we can assume that they at least had a deep appreciation of the potential for harm to their own passengers, and post 9/11 we can assume that they appreciate the harm their plane can be to thousands of additional people.

But this can’t just be automatically carried to guns – guns aren’t planes anymore than they are motorcycles, and many pilots will tell you that jet pilots are much more like to die on a motorcycle than they are on a plane, because they act stupid on motorcycles.

Good gun-nuts know that you learn specific skills for your weapons and then you do them over and over and over again. In my case, ensuring a gun is unloaded will consist of a series of discrete steps that I’ve repeated at least hundreds of times to ensure that only the things I want to happen will happen.

I always check the condition of a weapon which has been handed to me the exact same way, even if the woman who handed it to me is mrs super gun chick and I watched her remove the magazine, repeatedly work the slide back and forth and then lock it back, stick her finger in the chamber and then visually inspect the chamber and mag-well. Guess what? I’ll do whatever of those things are possible myself, too. And I still won’t paint her or anything I don’t want to destroy.

If you want to trust someone, you need to know about their innate trustworthiness, and you need to know about their experience. Some people are simply more trustworthy than others because, well, they are, and you can trust them more in new situations than other people.

But these people aren’t necessarily the ones well trained in <foo>, so you can’t build security systems around them. If you want to build a system that scales across many users, you want a system that mandates everyone be predictable enough for the system to work. Judging the innate trustworthiness of a person is very hard, so while you may do that you also wind up forcing people you must have a high degree of trust in to do things that makes them appear to be more predictable in the ways you need them to be.

In other words, you train the living shit out of pilots before you let them fly a plane. The same should be said for guns, and I can pretty much guarantee that the armed pilots in the sky today have probably more than 100 times more experience in flying planes than in handling guns. So – either stop the armed pilot experiment, OR train the armed pilots well enough so that they are as predictable as you need them to be, so that you can make some assumptions about their trustworthiness.

Will there be ND’s anyway? Of course. But there are also plane crashes, and that has to be okay. What is important is that the system be predictable, and of course that it have a real, tangible and measurable result. Number of plane crashes vs. flight hours is a simple equation. Now that we’ve had an ND in a cockpit, lets’ take a look at number of ND’s vs. gun-handling hours…

I have related thoughts about guns and training that apply to personal gun ownership, but that’s for another post…


41 thoughts on “Trust Isn’t Transitive (or, “Someone fired a gun in an airplane cockpit, and it was probably the pilot”)

  1. Pingback: Security

  2. hawthorn says:

    The system is predictable.

    (1) If you have 10,000 gun-trained flight crew flying millions of routes over the years, you’ll eventually have a discharge.

    (2) When that happens, no matter how long it takes, someone will write an article arguing that it proves their point about security.

  3. Hey hawthorn – do you know if your numbers in (1) are correct? If so, can you give me a citation?

    I consider rare ND’s to be a very unfortunate but frankly acceptable side affect to allowing an armed populace, just as I consider air-crashes to be an acceptable result of flying.

    I want to know that I can trust the armed pliot system to produce armed pilots who are as well trained and competent in handling firearms in cockpits as normal pilots are in handling normal cockpits.

    I roughly KNOW what is required to become a pilot and I am deepy respectful of that, but I don’t really know what is required to become an armed pilot, and I have a deep suspicion that it is insufficient.

  4. Pingback: The Upholstered Apocalypse » Coffee, tea, or 9mm Hollowpoint?

  5. Transitive (Logic & Mathematics): Of or relating to a relationship between three elements such that if the relationship holds between the first and second elements and between the second and third elements, it necessarily holds between the first and third elements.

    The lack of relationship here between the second element (aviation safety) and the third (gun safety) defines the absence of a transitive relationship.

    I think that pretty much sums up the meaning of “transitive” as it pertains to this discussion.

    You should at least attribute quotes to their source, even fictional characters.

  6. I do agree with a lot of what you are saying here. However, I also think that pilots, in this day and age, need to have a way of protecting themselves and the passengers they carry. So, maybe the answer is along with pilot training and hours of training there comes gun training and the use thereof! Makes sense to me!

  7. I had a friend once who cleaned his pistol and reloaded and held the pistol out as if to admire it. The gun discharged and wounded his foot.
    The fool had friends over a day or so after he shot himself-and the question was asked “how’d it happen”?
    So my Bubba friend put his Budwieser and picked up the pistol to re-enact the accident for his friends…
    Moral of the story-Budwieser and a pistol and pain killers can mahke a fool out of anyone,it did my friend,he shot his other foot in the demo.
    The other moral-here’s a guy that was raised in a deer stand…handled guns all his life-and yet he still has the accident,ergo his mind at the moment.
    What troubles me-I live way out in the boonies,can’t even see a neighbor. Every once and a while I can here pistol practice going on. I always worry where that bullet is going to…what the heck is going to happen on that plane.
    And now our terrorist enemys know-theres a gun on the plane!
    wow-but great story! thanks

  8. Jet Pilot says:

    The fact that the ND happened during flight, not on the ground, seems to indicate that the pilot was unnecessarily showing off or playing with the gun. The FFDO program requires pilots to get a psych test and attend a week-long course administered by the federal government. One bad incident doesn’t mean the program should end; should police departments and the military be disarmed if they have an ND?

  9. Matt says:

    So one gun goes off in the several years Federal Flight Deck Officers and Air Marshals have been carrying them on planes, and suddenly it’s a huge problem that pilots are not as well-trained with guns as they are with planes? Honestly, most people can become experts at gun safety in a month if they’re trying hard enough. Planes are more complicated than guns, and more dangerous, too.

    This post seemed light on facts, long on holier-than-thou opinion.

  10. hawthorn says:

    The 10,000 FFDO estimate is from the ALPA which is giving this out to news organizations inquiring for the story. I believe DHS considers this to be confidential security information. Millions of routes is simply an extrapolation assuming the FFDO’s work a normal flight schedule. Did you think there were fewer?

  11. Matt – We don’t let Air Marshalls fly the planes, do we?

    Why lump FFDO and Air Marshals into the same category? Are you saying they all recieve the same training and are equally competent? AFAIK, comparing an Air Marshal to an FFDO is very unfair to the FFDO. They just aren’t even in the same ball-park.

    Why not ask someone from the FBI HRT if they would go on point in an active shooter situation in front of an FFDO? Now ask the same FBI HRT guy if he’d let an air marshall fly the next plane he’s on…

    Hawthorn – I have no idea if it’s more or less, it just didn’t sound like a real number.

  12. instinctivelyimpish says:

    wow. (this wow is not prompted by the thought of a pilot with a gun in an airplane…although…that in itself requires a “wow”…anyway…) several of your thoughts on trust have caused wheels to turn and cathartic thoughts to spring forth. i’m most likely going to write ’bout it…hope you don’t mind me mentioning your blog.
    thank you for writing this post.

  13. Keith Irwin says:

    I agree with the previous poster that transitive isn’t the word you want to use here. Transitivity is when A (rel) B and B (rel) C implies A (rel) C. In this case, (rel) would be trust. So when we’re talking about transitive trust, that would be: Alice trusts Bob, Bob trusts Carol, does that mean that Alice trusts Carol?

    On the other hand, there is no way to substitute “Us” “Pilots” “trust to fly planes” and “trust to carry guns” into the above. We trust pilots to fly planes. This would suggest A=We, B=Pilots, and (rel)=trust to fly planes. But then there’s no way to do the B (rel) C part, since that would be “Pilots trust ?? to fly planes”. Obviously we can’t put “trust to carry guns” into that sentence sensibly (“Pilots trust guns to fly planes”,”Pilots trust their trust in guns to fly planes”?).

    Instead, what we have here are two relations. So really what we’re saying is that A (rel1) B does not imply A (rel2) B. In this case, We trust pilots to fly planes does not imply we trust pilots to carry guns. A=us, B=pilots, (rel1)=trust to fly planes, (rel2)=trust to carry guns. So really, the point which is being made is that (rel1) != (rel2), i.e. trust is categorical, and the existence of one type of trust relationship does not imply the existence of another type of trust relationship. This is a good point and less obvious than it seems in this framework, since people do often expect trust to be non-categorical, however, it is not transitivity.

    Trust should definitely be categorical. Trusting your friend to keep your secret should not imply trusting you friend to do heart surgery.

    A minister who spoke to our congregation recently described trust as having three components: caring, commitment, and competency. Caring is how much the other person cares about you. Commitment is how committed they are to your well being. And competency is how able you believe they are. Caring and commitment are not necessarily categorical, but competency clearly is.

  14. Pingback: No More Free Passes » Blog Archive » One Obvious Problem with an Armed Populace

  15. Keith – I think it goes like like this:

    Me as a Passenger
    – trust –
    Pilot as a Pilot
    – trust –
    Pilot as a shooter

    I trust the pilot to be a pilot.
    Clearly the pilot trusts himself (as does his co-pilot) to be a shooter else he wouldn’t be carrying a gun in the cockpit.
    However I don’t neccesarily trust the pilot as a shooter.

  16. hawthorn says:

    As I suspected when I heard about this, it had nothing to do with some goofy redneck pilot trying to impress a stew, or First Officer Barney Fife being less of a “shooter” than he thinks he is.

    They need to come up with better requirements for weapons stowage. However, if they don’t, it’ll probably be another 8 years before the next oops happens.

  17. monadahl says:

    I really appreciated this, especially the little analogies, although honestly I would trust most pilots to know when or when not to be fiddling with a firearm (they should know the right time is never). After all, when a pilot is in the air and wants to impress a flight attendant, he does not do anything with the plane that would possibly put his plane, crew, and passengers in danger.

    After reading what hawthorn linked I sort of wonder why the pilot was trying to lock away his sidearm during the landing procedure. Is there not time for that after the plane has safely landed and there are no other pressing matters on the pilot’s mind?

    Overall, thank you for the entry.

  18. Pingback: News » Pilot shoots hole in cockpit - trust is not transitive

  19. Pingback: SecureChurch.Info » Trust Isn't Transitive

  20. Dana says:

    Yes secondlady…the world could exist for a day without guns…and the bad guys would stab and beat you for the entire day.

  21. Pingback: Trust is not transitive

  22. Pingback: Yi Guan on stopping a pandemic before it starts: trust isn’t transitive [Effect Measure] |

  23. Pingback: John Wayne, United Airways, and Human Factors at the Human Factors Blog

  24. NextDoorToTheLandDownunda says:

    stepping sideways for a moment, Peter, you state that “I consider rare ND’s to be a very unfortunate but frankly acceptable side affect to allowing an armed populace, just as I consider air-crashes to be an acceptable result of flying.”

    As a pilot, ( albeit as such a low hour pilot) , I DO NOT consider an air-crash as acceptable. I accept that they will happen, but believe that they should be investigated with a view to modifying the system ( be it via engineering, procedures, training or any other means) to prevent a repeat performance.

    I would also expect a similar attitude towards firearm safety. Why are ND’s considered “unfortunate, but acceptable”.

    I also wonder if this is partly a language issue, but I am conscious of the fact that sods law can be repetitive if needed. ( I believe in the ‘states you call it “Murphy’s law”, which has a different but similar meaning where I live)

  25. Hello NextDoorToTheLandDownunda!

    I think that you are personalizing my general statement by referring to a specific air crash, rather than their possibility.

    No air crash should be considered acceptable, but the possibility of any one of them must be.

    If someone told me to make air crashes impossible, I’d say “ground every plane, remove their engines, and bulldoze furrows across every airfield”.

    But that still wouldn’t make them impossible, because somebody somewhere has an old Otter sitting in a barn beside a lake in Wisconsin, and that plane can, with a little tinkering, still take off, which means it can still crash…

    Rather than try to prevent this plane from crashing by trying to keep it from ever taking off, we choose instead to try to make sure that when it does take off, the chances of it crashing are lower than they were before the last air crash. We try to get better every time.

    The same should hold true, generally speaking, for ND’s and guns. Hopefully people somewhere are reviewing every aspect of this ND and figuring out how to make the chances of another one lower.

  26. NextDoorToTheLandDownunda says:

    OK, Thank you Peter.

    That was more or less what I hoped you would say. Basically that yes, there was a slight misunderstanding based on language.
    There is no activity in the world that is completely free from risk, however this makes you the first person that I have been in conversation with to express the idea of systemic closures of failure modality’s via incident analysis, in relation to firearms, or the associated “over-learning” in training of skills and procedures to come out of this analysis.

    It is somewhat heartening to hear.

  27. Pingback: Charles H. Green's Trust Matters

  28. Pingback: True Colors Consulting » Carnival of Trust Winners!

  29. Pingback: True Colors Consulting

  30. Pingback: Real Trust is Reciprocal (or, Human Kill Switches are a Bad Idea) « Obsessed

  31. Pingback: Thing Two « Obsessed

  32. Pingback: Trusted Advisor » Web Trust 2.0 vs Web Trust 3.0

  33. Bob the Chef says:

    There’s a more fundamental error at play here than transitivity of trust. You can’t possibly draw the conclusion that you can trust a guy very competent in one thing with another thing that required competence unless you misunderstand competence. For this reason you have stupidities like people asking Stephen Hawking about matters of philosophy or theology. He might have honed his skills to act as a competence physicist, but he is utterly clueless on matters like those I’ve mentioned. And oddly enough, he speaks on these topics from the pulpit (not that he should speak on any matters from the pulpit, but there is a marked arrogance about committing an error of excess in which one presumes that narrow specialization in one field somehow endows one the grand wisdom of all fields. It’s a common error among specialists, and I’m guessing it is the way they resolve the cognitive dissonance between knowing that they’ve sunk so much time and energy into something so narrow and tiny, and knowing it’s relatively minute value, or falsely assuming time + energy = pervasive value or comprehensiveness — ah, the folly of hard work).

  34. gadgets (be/nl) says:

    Hi there! I’m at work surfing around your blog from my new iphone 4! Just wanted to say I love reading through your blog and look forward to all your posts! Carry on the excellent work!

  35. Pingback: çok satan

  36. Pingback: Topic 10 – Trust | 30133184 e-Business Fundamentals

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s