4 ms·

Airline pilot privacy. CVRs were always highly contentious when introduced, due to exactly the situations you see today in the media. The pilot unions were co

by phil21 3y ago

Airline pilot privacy. CVRs were always highly contentious when introduced, due to exactly the situations you see today in the media. The pilot unions were concerned that these recordings would be released to the public, both out of context and releasing private personal data not relevant to the public - especially if anything at all salacious could be found. There were strict protections about CVR data never being released, but of course those restrictions more or less no longer exist today in reality - leaks abound. I think those that dismiss this concern entirely are the folks who cannot think critically. It highlights a legitimate concern for workplace privacy, of which the Overton window has shifted drastically into less privacy expectations over my lifetime. The public will nearly unanimously call for 25 hours here, but this was not the case even 40 years ago. I think the benefit outweighs the concerns in this particular case, but you are now seeing the same fight regarding cockpit video recorders. I can't say the pilots are wrong given the history of CVR data breaches. If I were a pilot I'd grudgingly support the existence of the CVRs, but I can't say I'd really like the idea. I've seen how sound bites get taken completely out of context and sound worse than they were intended at the time. I've also seen how CVR data is absolutely critical in resolving some accidents. It's all a tradeoff, but certainly not an immediately obvious one unless you value privacy at zero. Edit: The idea behind the 2 hours thing, was that 2 hours would be plenty of time to record anything relevant to an actual accident. Either the plane is in pieces and recording has stopped, or the recordings get pulled on successful landing after declaring emergency. The entire intent was to limit what was available to only the accident sequences - not general chit chat 5 hours prior to any event while they were waiting for taxi clearance. Technical limitations at the time also didn't hurt this argument. Also I think it's good to point out that relying on the pilots to pull the breaker after an incident is not ideal and one of those things that the union has absolutely kept in as a feature, not a bug. This has obviously been abused.

panick21_ 3y ago
> I think those that dismiss this concern entirely are the folks who cannot think critically. So if you don't agree, you can't think critically. Got it. Or maybe, we did think about it critically and simply don't agree. There are various way this can be solved. We have modern encryption that could make this far, far safer then it is today. We have methods from data leaking. We have process to only allow data to be decrypted if required. This would actually force us to really think critically about who has what access when. In planing this the airlines, unions, FAA should sit together with some technical experts and think of this critically. This seems less complex to me then a modern high bypass turbo engine.
- phil21 3y ago
  > There are various way this can be solved. We have modern encryption that could make this far, far safer then it is today. We have methods from data leaking. We have process to only allow data to be decrypted if required. There are not. You cannot solve a social problem with a technical solution. If the data exists, it can and likely will be used. > This highlights a complete failure on multiple levels and an inability to critically think about the problem space. How much time was spent implementing a system that under most circumstances where it would be needed would render itself entirely useless? I was responding in particular to this. It does not highlight an inability to think critically unless you value privacy at zero and only look at these recordings as a technical problem. Under most circumstances when it's needed this system has functioned exactly as designed. You read about the failures because they are the exception. Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement. I would actually agree with you in general if for not that comment. It simply means we disagree. But it surely does not mean no one has thought critically about this subject when it was introduced or since.
  - panick21_ 3y ago
    > There are not. You cannot solve a social problem with a technical solution. If the data exists, it can and likely will be used. Except in reality we use often use technical solution to solve social problems. Or rather technical capabiltiy gives us the means to approach a social problem in a different way. > unless you value privacy at zero The assumption that privacy is 100% impossible if something is recorded and stored is simply categorically false. > only look at these recordings as a technical problem I didn't do that. I suggested that the FAA, the Unions, the Airlines and the manufactures sit together and come up with a solution of what the exact data access policies are. > Under most circumstances when it's needed this system has functioned exactly as designed. And yet when going threw the history of air incidents, there are lots of cases where this isn't the case. Most isn't good enough. > You read about the failures because they are the exception. Sure and a server crashing is the exception, and yet somehow most of use still run 2 server if we want things to work continuously. The argument 'mostly its fine, its just occasionally that a couple 100 people die and we don't know why' just doesn't work for me. Yes in most cases its not that dramatic, but it would still be very useful. > . Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement. Fair.
otterley 3y ago
What privacy? They’re recording conversations made in company livery while getting paid on the job, with notice of that fact in advance. If the recorders were recording them after they exited the plane that’d be a cognizable privacy violation, but that’s not what we’re talking about here.
- sokoloff 3y ago
  Are we willing to have our cubicle conversations recorded while we’re on the job to increase the data available in the event of a software defect?
  - otterley 3y ago
    It depends. Are people’s lives at stake?
    - xethos 3y ago
      Are you willing to have a camera pointed at you - not other drivers, you - as you drive to and from work every day? People's lives are at stake, driving is objectively more dangerous than flying, and it can be tied to work by the simple reason that you wouldn't be behind the wheel if you weren't heading to or from work. This smacks of "Privacy for me but not for thee", to say nothing of the effect it would have on the perpetual low-level pilot shortage due to things like working conditions.
      - otterley 3y ago
        It depends. Am I at work and being paid as a professional driver? > the perpetual low-level pilot shortage due to things like working conditions. There are a lot of pilots “waiting in the wings” at smaller carriers, currently being paid peanuts, to get nice cushy jobs at major carriers with union protections who won’t mind having their voice recorded and stored for 24 hours while on the job behind the yokes.
        3y ago
llm_nerd 3y ago
>I think those that dismiss this concern entirely are the folks who cannot think critically I will absolutely, unreservedly dismiss the concern of a pilot for privacy in the cockpit because I can think critically. The notion that someone deserves privacy in the cockpit of commercial aircraft is outrageously silly and utterly indefensible. Pilot your own personal aircraft if you want that privacy. And there is absolutely an "Overton window", but it is wrong to think that whatever way it moves is a regression or worsening (which is the classic "everything is always getting worse" melodrama). Sometimes the way things are is not rational or optimized, but just are. The 2 hour thing was nothing but a technical limit (a literal loop of magnetic tape), and every other justification is retconning.
- phil21 3y ago
  > The 2 hour thing was nothing but a technical limit (a literal loop of magnetic tape), and every other justification is retconning. The 2 hour thing was 30 minutes when it was magnetic tape. It moved to digital a while ago and that's when the unions negotiated it to 2 hours after some incidents. The 2 hour limit was not based on anything technical that I'm aware of. The privacy stuff is absolutely not reconning. Heck, it was pretty much the most talked about topic over the water cooler when I was doing some IT contract work for ALPA in my teens. My memory is certainly fuzzy but not quite that fuzzy.
sokoloff 3y ago
> recordings get pulled on successful landing after declaring emergency Declaring an emergency (standing alone) should not be a reason to pull the CVR, IMO. There should be an aviation-safety related reason at a minimum. (Declaring an emergency to facilitate expedited handling for a passenger medical emergency should not trigger a need to preserve the CVR recordings, as one concrete example.)
- jonas21 3y ago
  Additionally, this might make pilots more reluctant to declare an emergency, which would have a negative impact on safety.
  - sokoloff 3y ago
    Indeed! It's mind-blowing the number of conversations I've had online and in-person where pilots say something like "I didn't want to declare an emergency, because I didn't want to do a lot of paperwork." Invariably, someone (sometimes me) asks "for those of us who have declared an emergency, how much paperwork was involved?" In ~95% of declared emergencies, there is zero paperwork or followup required. In over half of them, the pilot elected to (voluntarily but advisedly) fill out a NASA ASRS form (which is about a 15 minute task and something they probably would have done under the same circumstances without the emergency declaration). ( https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf )
    - bombcar 3y ago
      The paperwork is often NOT government mandated; there may be corporate mandates, too around it. (I've technically declared pan-pan once, there was no paperwork.)
    - tialaramex 3y ago
      This might well be somewhere that you can improve with training. It reminds me of the situation for CAPS (the Cirrus Airframe Parachute System, a ballistic parachute for Cirrus small planes). Once you train pilots to specifically plan to use CAPS when things go wrong, rather than relying on them realising in time after something has gone wrong but before fatal injury is inevitable that the CAPS can save them, you get significant improvements in save rates. It may be that training pilots specifically to declare emergency as soon as there's a problem rather than waiting until they're sure they can't solve the problem and need outside assistance will improve overall safety outcomes. There's a tragic case I watched a safety video about where the private pilot, very low on fuel, asks if he can land at a (closed) airbase whose traffic controller he's talking to. The base's controller says he cannot land unless he's an emergency. That was his last chance to survive, all he needs to do is say he's an emergency - "I'm on fumes, I need to land right now" she'd turn the base's lights on, he puts it down on a strip that's not meant for civilians and maybe he spends the evening explaining to some MPs how he fucked up - but he's not dead. Instead he accepts this as a "No" and flies on for a few more miles until he runs out of fuel and crashes.
grotorea 3y ago
I think the problem is that the CVR is supposed to stop after landing but there are many successful landings where this is skipped, either because of overwork like here or because the pilots discounted the situation.
- sdh9 3y ago
  Every airplane type is a bit different, but typically, if the aircraft is powered then the CVR is recording. Even if it’s at the gate with nobody onboard— the CVR does not know nor care. The only way to stop the CVR from recording is to depower the airplane (which is one of the steps you take prior to an emergency evacuation) or to pull the circuit breaker if the airplane needs to stay powered. A pilot would never pull the circuit breaker without confirmation from management or safety to do so. It’s just not done routinely. Depending on the airline, it may not even be the pilot’s responsibility to do so. Every airline has a binder (likely, several binders) full of procedures to follow after a NTSB-reportable accident. No one person is expected to do the job of many.
Fatnino 3y ago
Seems like a decent compromise would be to record a 2 hour loop but as soon as the words "declaring emergency" or similar are detected it stops looping and just records everything till the storage is full. Say 25 hours worth. The point being that at the end of 25 hours it's no longer recording as there is no chance of anything relevant still being said at that time. Could even have some indicator in the cockpit that it's in emergency mode for the pilots to turn it back to loop mode in case of a false positive.
- mulmen 3y ago
  Pilots aren’t stupid. You have created a disincentive to declare an emergency and added to the crew workload in an emergency. Human systems are complicated.

by phil21 3y ago

panick21_ 3y ago

> I think those that dismiss this concern entirely are the folks who cannot think critically. So if you don't agree, you can't think critically. Got it. Or maybe, we did think about it critically and simply don't agree. There are various way this can be solved. We have modern encryption that could make this far, far safer then it is today. We have methods from data leaking. We have process to only allow data to be decrypted if required. This would actually force us to really think critically about who has what access when. In planing this the airlines, unions, FAA should sit together with some technical experts and think of this critically. This seems less complex to me then a modern high bypass turbo engine.

phil21 3y ago
> There are various way this can be solved. We have modern encryption that could make this far, far safer then it is today. We have methods from data leaking. We have process to only allow data to be decrypted if required. There are not. You cannot solve a social problem with a technical solution. If the data exists, it can and likely will be used. > This highlights a complete failure on multiple levels and an inability to critically think about the problem space. How much time was spent implementing a system that under most circumstances where it would be needed would render itself entirely useless? I was responding in particular to this. It does not highlight an inability to think critically unless you value privacy at zero and only look at these recordings as a technical problem. Under most circumstances when it's needed this system has functioned exactly as designed. You read about the failures because they are the exception. Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement. I would actually agree with you in general if for not that comment. It simply means we disagree. But it surely does not mean no one has thought critically about this subject when it was introduced or since.
- panick21_ 3y ago
  > There are not. You cannot solve a social problem with a technical solution. If the data exists, it can and likely will be used. Except in reality we use often use technical solution to solve social problems. Or rather technical capabiltiy gives us the means to approach a social problem in a different way. > unless you value privacy at zero The assumption that privacy is 100% impossible if something is recorded and stored is simply categorically false. > only look at these recordings as a technical problem I didn't do that. I suggested that the FAA, the Unions, the Airlines and the manufactures sit together and come up with a solution of what the exact data access policies are. > Under most circumstances when it's needed this system has functioned exactly as designed. And yet when going threw the history of air incidents, there are lots of cases where this isn't the case. Most isn't good enough. > You read about the failures because they are the exception. Sure and a server crashing is the exception, and yet somehow most of use still run 2 server if we want things to work continuously. The argument 'mostly its fine, its just occasionally that a couple 100 people die and we don't know why' just doesn't work for me. Yes in most cases its not that dramatic, but it would still be very useful. > . Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement. Fair.

otterley 3y ago

What privacy? They’re recording conversations made in company livery while getting paid on the job, with notice of that fact in advance. If the recorders were recording them after they exited the plane that’d be a cognizable privacy violation, but that’s not what we’re talking about here.

sokoloff 3y ago
Are we willing to have our cubicle conversations recorded while we’re on the job to increase the data available in the event of a software defect?
- otterley 3y ago
  It depends. Are people’s lives at stake?
  - xethos 3y ago
    Are you willing to have a camera pointed at you - not other drivers, you - as you drive to and from work every day? People's lives are at stake, driving is objectively more dangerous than flying, and it can be tied to work by the simple reason that you wouldn't be behind the wheel if you weren't heading to or from work. This smacks of "Privacy for me but not for thee", to say nothing of the effect it would have on the perpetual low-level pilot shortage due to things like working conditions.
    - otterley 3y ago
      It depends. Am I at work and being paid as a professional driver? > the perpetual low-level pilot shortage due to things like working conditions. There are a lot of pilots “waiting in the wings” at smaller carriers, currently being paid peanuts, to get nice cushy jobs at major carriers with union protections who won’t mind having their voice recorded and stored for 24 hours while on the job behind the yokes.
      - 3y ago

llm_nerd 3y ago

>I think those that dismiss this concern entirely are the folks who cannot think critically I will absolutely, unreservedly dismiss the concern of a pilot for privacy in the cockpit because I can think critically. The notion that someone deserves privacy in the cockpit of commercial aircraft is outrageously silly and utterly indefensible. Pilot your own personal aircraft if you want that privacy. And there is absolutely an "Overton window", but it is wrong to think that whatever way it moves is a regression or worsening (which is the classic "everything is always getting worse" melodrama). Sometimes the way things are is not rational or optimized, but just are. The 2 hour thing was nothing but a technical limit (a literal loop of magnetic tape), and every other justification is retconning.

phil21 3y ago
> The 2 hour thing was nothing but a technical limit (a literal loop of magnetic tape), and every other justification is retconning. The 2 hour thing was 30 minutes when it was magnetic tape. It moved to digital a while ago and that's when the unions negotiated it to 2 hours after some incidents. The 2 hour limit was not based on anything technical that I'm aware of. The privacy stuff is absolutely not reconning. Heck, it was pretty much the most talked about topic over the water cooler when I was doing some IT contract work for ALPA in my teens. My memory is certainly fuzzy but not quite that fuzzy.

sokoloff 3y ago

> recordings get pulled on successful landing after declaring emergency Declaring an emergency (standing alone) should not be a reason to pull the CVR, IMO. There should be an aviation-safety related reason at a minimum. (Declaring an emergency to facilitate expedited handling for a passenger medical emergency should not trigger a need to preserve the CVR recordings, as one concrete example.)

jonas21 3y ago
Additionally, this might make pilots more reluctant to declare an emergency, which would have a negative impact on safety.
- sokoloff 3y ago
  Indeed! It's mind-blowing the number of conversations I've had online and in-person where pilots say something like "I didn't want to declare an emergency, because I didn't want to do a lot of paperwork." Invariably, someone (sometimes me) asks "for those of us who have declared an emergency, how much paperwork was involved?" In ~95% of declared emergencies, there is zero paperwork or followup required. In over half of them, the pilot elected to (voluntarily but advisedly) fill out a NASA ASRS form (which is about a 15 minute task and something they probably would have done under the same circumstances without the emergency declaration). ( https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf )
  - bombcar 3y ago
    The paperwork is often NOT government mandated; there may be corporate mandates, too around it. (I've technically declared pan-pan once, there was no paperwork.)
  - tialaramex 3y ago
    This might well be somewhere that you can improve with training. It reminds me of the situation for CAPS (the Cirrus Airframe Parachute System, a ballistic parachute for Cirrus small planes). Once you train pilots to specifically plan to use CAPS when things go wrong, rather than relying on them realising in time after something has gone wrong but before fatal injury is inevitable that the CAPS can save them, you get significant improvements in save rates. It may be that training pilots specifically to declare emergency as soon as there's a problem rather than waiting until they're sure they can't solve the problem and need outside assistance will improve overall safety outcomes. There's a tragic case I watched a safety video about where the private pilot, very low on fuel, asks if he can land at a (closed) airbase whose traffic controller he's talking to. The base's controller says he cannot land unless he's an emergency. That was his last chance to survive, all he needs to do is say he's an emergency - "I'm on fumes, I need to land right now" she'd turn the base's lights on, he puts it down on a strip that's not meant for civilians and maybe he spends the evening explaining to some MPs how he fucked up - but he's not dead. Instead he accepts this as a "No" and flies on for a few more miles until he runs out of fuel and crashes.

grotorea 3y ago

I think the problem is that the CVR is supposed to stop after landing but there are many successful landings where this is skipped, either because of overwork like here or because the pilots discounted the situation.

sdh9 3y ago
Every airplane type is a bit different, but typically, if the aircraft is powered then the CVR is recording. Even if it’s at the gate with nobody onboard— the CVR does not know nor care. The only way to stop the CVR from recording is to depower the airplane (which is one of the steps you take prior to an emergency evacuation) or to pull the circuit breaker if the airplane needs to stay powered. A pilot would never pull the circuit breaker without confirmation from management or safety to do so. It’s just not done routinely. Depending on the airline, it may not even be the pilot’s responsibility to do so. Every airline has a binder (likely, several binders) full of procedures to follow after a NTSB-reportable accident. No one person is expected to do the job of many.

Fatnino 3y ago

Seems like a decent compromise would be to record a 2 hour loop but as soon as the words "declaring emergency" or similar are detected it stops looping and just records everything till the storage is full. Say 25 hours worth. The point being that at the end of 25 hours it's no longer recording as there is no chance of anything relevant still being said at that time. Could even have some indicator in the cockpit that it's in emergency mode for the pilots to turn it back to loop mode in case of a false positive.

mulmen 3y ago
Pilots aren’t stupid. You have created a disincentive to declare an emergency and added to the crew workload in an emergency. Human systems are complicated.