Foreigners

How to Prevent the Next Germanwings Disaster

The one rule that could save lives.

A Germanwings Airbus.

A Germanwings Airbus takes off from the Cologne-Bonn airport in western Germany, on March 30, 2015.

Photo by Oliver Berg/AFP/Getty Images

Since the crash of Germanwings Flight 9525, we’ve heard lots of ideas on how to stop the next crazy pilot. The proposals, ranging from psychiatric tests to cockpit gadgets, have provoked eye rolls among airline industry veterans. The consensus of skeptics is that none of the proposed fixes can prevent a crash. “There are no quick solutions,” says Chris Manno, a pilot who runs the air travel blog Jethead. Instead, he advises, “Trust in your flight crew.” Patrick Smith, author of the respected Ask the Pilot column, draws the same conclusion.

Smith, Manno, and other critics are right about the many flawed proposals. But their conclusion doesn’t follow. You don’t have to trust pilots any more than you have to trust presidents or bank managers. Nor should you. Every government and every airline should immediately implement the one remedy that requires no gadgets, assumes no improvement in human nature, and doesn’t pretend to know what the next crisis will be. The rule is simple: No one should ever be left in the cockpit alone.

Most of the ideas floated since last week have obvious flaws. Subjecting pilots to additional mental health exams might catch a few worrisome cases. But mental illness can be hard to spot, and when it’s accompanied by malice, concealment is that much more likely. Requiring pilots to earn more flight time before they take the controls of a big plane would only delay the peril. Making cockpit doors easier to open would reintroduce the problem that led us to fortify them in the first place: hijackers breaking in.

The “rule of two” doesn’t share these flaws. It simply dictates that two people be in the cockpit at all times. If a plane has two pilots, and one wants to step out, a flight attendant, air marshal, or some other crew member must step in. This rule doesn’t depend on astute shrinks, candid pilots, or perfect technology. It works with planes and people as they are. All it relies on is basic math: No matter how unlikely it is that one person will do something awful or crazy, it’s even more unlikely that a second person, chosen separately, will permit or agree to the same crime.

This isn’t just a rule for airplanes. It’s a rule for any social organization, from doctor’s offices to federal agencies. It’s why companies hire outside accountants, armored cars have crews, nuclear missiles require multiple sign-offs, and FBI agents monitor one another’s custody of seized drugs. The entire U.S. government is an extension of, and a tribute to, the rule of two. Our republic has survived for more than two centuries not because of the nobility of Richard Nixon, Oliver North, or Dick Cheney, but because each branch of government keeps an eye on the others.

Unlike fortified doors, coded keypads, or psychiatric exams, the rule of two doesn’t assume that the next airborne crisis will be like the last one. It’s true that the crash of Mozambique Airlines flight 470 in Namibia two years ago was much like the Germanwings tragedy: One pilot went to the bathroom and was locked out by the other.* But in other disasters and near-disasters, the situations have differed. Pilots have gone rogue over demotions or for life insurance. On military flights, the main problems are pilot disorientation and loss of consciousness or situational awareness. Last year, an Air New Zealand pilot locked his co-pilot out of the cockpit for two minutes and ignored pleas to open the door, reportedly over an argument about a flight delay. (According to the New Zealand Herald, “The co-pilot eventually used an alternative method to gain entry to the cockpit, which the airline would not detail for security reasons.”)

What will the issue be next time? We don’t know. That’s why the rule of two is our best bet. If a second person is in the cockpit, he or she can diagnose the situation and respond accordingly.

The rule of two has its critics. They point out that flight attendants, since they aren’t trained as pilots, may be unable to save a plane that’s going down. A flight attendant might not even recognize that a setting has been fatally altered. In the case of EgyptAir Flight 990, even the presence of a second pilot wasn’t enough to avert the crash. The rule of two can’t solve every crisis. But it can give the passengers a chance. In the Germanwings and Mozambique Airlines cases, all we needed was somebody who could deter the tempted pilot, or at least unlock the door.

The other objection is that a flight attendant, once inside the cockpit, might become the new threat. But in that scenario, the remaining pilot would still be there to fight for the passengers. The rule of two doesn’t promise to put two trustworthy people behind the locked door. It only aims to give you one.

The second person might not even have to be physically present. Aviation Week reports that NASA, the U.S. Air Force, Lockheed Martin, and Saab have developed ground-control systems that can automatically take control of a plane if a pilot doesn’t respond to threat alerts. Manno says such a system would multiply the risks, setting up “two pilots who ‘could go rogue,’ ” plus “an entire spectrum of people, entities and hackers capable of taking over the jet.” But the military’s technology allows pilots to block external control. In a true rule-of-two system, neither party could commandeer the flight unilaterally. To exceed programmed parameters, you’d have to infiltrate both the cockpit and air traffic control.

The rule of two has been in force in the U.S. for years. Since the Germanwings crash, it has been adopted by many other countries. It should be required everywhere. It’s the remedy most likely to succeed, precisely because it assumes that every other safeguard will fail.

Correction, March 31, 2015: This article originally misidentified the number of the Mozambique Airlines flight that crashed in Namibia in 2013. It was flight 470, not E190. (Return.) 

Read more of Slate’s coverage of the Germanwings crash.