By Leo Kalb Bourke (PO ’22)
On October 29, 2018, a Boeing 737 MAX departing from Jakarta, Indonesia, crashed into the Java Sea 13 minutes after takeoff, killing all 189 people on board. Several months later, on March 10, 2019, a MAX – this time leaving Addis Ababa, Ethiopia – plunged to the ground approximately six minutes after taking flight, killing 157 people. The crash of this second flight sparked a worldwide grounding of the 737 MAX and a flurry of investigations into the development of the plane. These investigations would soon pinpoint the technical cause of the crash: a malfunction of the MAX’s Maneuvering Characteristics Augmentation System (MCAS), a flight stabilizing program designed to compensate for differing weight distributions between the MAX and the previous 737. But as the investigations continued, it became clear that beyond the technical details of the crash lay another story, a story of how the agency charged with regulating Boeing gave the company wide leeway to certify their own aircraft, leading to the mass production of a plane with a deadly flaw.
The 737 MAX was conceived in 2011 as Boeing’s answer to Airbus’ A320neo: a new, fuel-efficient aircraft from Boeing’s biggest rival. To avoid losing customers to Airbus, Boeing shelved plans to develop an entirely new aircraft – which would be costly and time-consuming – and instead chose to refresh the previous generation of the 737 to match the A320neo’s capabilities. The pressure to rush the MAX into production “resulted in extensive efforts to cut costs, maintain the 737 MAX program schedule, and avoid slowing the 737 MAX production line,” according to a 2020 report from the House Transportation and Infrastructure Committee.
Boeing put its performance targets above safety on numerous occasions during the development of the MAX. For example, in 2013, Boeing engineers suggested installing a computer-based airspeed indicator to augment the MAX’s single external speed sensor. According to the House report, this request “was rejected by Boeing management due to cost concerns.” And in 2018, Ed Pierson, a senior Boeing plant supervisor at the MAX’s production facility, emailed Scott Campbell, the 737 General Manager, to request a meeting about “safety concerns.” Five weeks later, Mr. Pierson met with Mr. Campbell, where Mr. Pierson – a former military officer – told Mr. Campbell that the military would never tolerate the cavalier attitude towards safety present in the MAX’s development. Mr. Campbell allegedly responded: “The military is not a profit-making organization.’’
And yet the FAA, in a move that would ultimately cost 346 people their lives, certified the MAX despite its safety concerns. Why did it do so? One answer is that the agency was “captured” by Boeing.
Regulatory capture is the process by which an agency becomes dominated by the industry it is charged with regulating. In the case of the MAX, the FAA did not uphold its responsibility to ensure the safety of the aircraft – largely because it removed itself from the regulatory process altogether.
Since at least 1927, the FAA has delegated certain safety certification responsibilities to qualified individuals within the aviation industry. Until 2004, the FAA regulated the production of new Boeing aircraft through a web of Designated Engineering Representatives (DERs), employees of Boeing charged with ensuring that new aircraft met regulatory standards. These DERs, though paid by Boeing, were selected by and reported to the FAA, which signed off on all certification decisions. “We knew we’d lose our livelihood if we didn’t maintain the integrity of making decisions the way the FAA would do it,” said a former DER. The FAA retained final authority and possessed a clear view of new aircraft’s certification process.
This all changed in 2004, when a committee made up largely of industry backers passed a rule establishing the Organization Designation Authorization (ODA) system. The ODA system transformed the way DERs worked. Now called Authorized Representatives (ARs), these employees reported not to the FAA, but to Boeing managers. Their direct communication channels with the FAA were cut off, and safety reports were filtered through Boeing managers before being sent to the FAA. Ostensibly, the ODA system was instituted to make the certification process more efficient by delegating further authority to Boeing. Its true effect, however, was to vest Boeing with vast amounts of power over the certification of its own aircraft.
A safety engineer told the Seattle Times of the stark difference between the pre- and post-ODA world. “If I need guidance, I call my FAA adviser,” he said of the pre-ODA system. “I’m overseen directly by the FAA. And every year there is a pretty robust audit of my activity before the FAA will delegate me for the following year. Under ODA,” however, “the FAA no longer manages the people making the compliance findings. They never even talk to them.”
Boeing’s appointment authority of ARs gives it the power to align the certification process with its own interests. A copy of Boeing’s ODA manual obtained by the Seattle Times stated that Boeing ARs would be judged in part on whether they were “completing their duties in a timely and cooperative manner.” It is, of course, Boeing that determines whether ARs are meeting this vague standard. Mike Levinson, a former AR at Boeing for five years, reported feeling pressure from Boeing management to certify aircraft as meeting regulatory standards. Once, upon refusing to do so, he was summoned to his superior’s office, “told this was unacceptable and summarily dismissed the following day.”
Boeing’s broad discretion over the certification of its own aircraft contributed to a workplace where safety took a back seat to financial and performance targets and testing was limited to avoid delays, where the development MCAS software was outsourced to $9-an-hour engineers overseas, and where a plane was ultimately produced that would kill 346 people.
None of this was unforeseen. In 2006, the GAO warned that because the FAA’s introduction of the ODA program would “remove FAA from direct oversight of the individuals performing the delegated activities, it will be important for the agency to adhere to its policy of using designees only for less safety-critical work. It will also be important for the FAA to have the data and evaluative processes…to effectively monitor the new program.” Since then, however, a series of reports by the Transportation Department’s Inspector General (IG) and others have found that the FAA failed to sufficiently compensate for the risks created by the ODA system. In 2012, for example, a report by the Transportation Department’s IG noted that the FAA’s Transport Airplane Directorate (TAD), which has authority over manufacturers, was not receiving adequate support from FAA managers: “FAA headquarters managers have not always supported TAD employee efforts to hold Boeing accountable.” The process that allowed Boeing to manufacture a faulty aircraft was the result not only of structural changes in 2004, but of a consistent march towards self-certification ever since.How, then, should the FAA reform its regulatory process? The answer isn’t black and white. Further delegating oversight power to manufacturers, as the FAA proposed doing in 2012, would only exacerbate existing problems. But conducting all oversight and certification work itself would cost the FAA at least $1.8 billion and require another 10,000 engineers – and may not even be safer. Experience with and expertise of the latest technology is largely housed inside Boeing, rendering Boeing employees those most qualified to certify their aircraft. But they should do so under the oversight of the FAA. This would require the FAA to revert course, returning to the DER oversight structure. As this solution would simply be a rule change, it would sidestep the need for congressional legislation. But it would return meaningful public oversight to the aircraft certification process.
