Statement of Captain Lindsay Fenwick, ALPA

CAPTAIN FENWICK: Thank you, Member Goglia, and ladies and gentlemen. Any time a line pilot has to be part of a panel that's got at least two attorneys, one of whom refers to himself as just a country attorney, it calls for heightened situational awareness.

As you've no doubt gathered by now, the security of recorded information is a highly-sensitive issue within the global airline pilot community. This presentation emphasizes that adequate security of recorded information is essential if air safety investigators and other safety professionals are to retain access or to improve access to recorded data.

Although the Airline Pilots Association is known primarily for its efforts to improve the wages and working conditions for pilots, many of you who are familiar with transportation issues are aware of the contributions of ALPA's safety professionals and volunteers.

Our members are vocal with their air safety concerns, and what our pilots are telling us, and there are more than 50,000 of them out there in the United States and Canada, is that data recordings and how they're used or abused are of utmost importance.

This presentation will discuss issues, such as privacy, fairness, trust, legislation and the need for pilot participation in the analysis of recorded data, and obviously this issue is not just confined to North America. The International Federation of Airline Pilots, which represents more than a 100,000 pilots in dozens of countries, also has much at stake in this debate.

For these purposes, recorded information includes not just the cockpit voice recorder and the cockpit video view recorder, but digital flight data recorder information, air safety reports that are electronically transmitted, as well as various forms of datalink information, such as ACARS, and for this presentation, the security of such information means the protection against unauthorized or inappropriate use.

The Airline Pilots Association is by no means against the use of recorded data to advance air safety. In fact, ALPA has written policies which accommodate and even encourage the use of such devices. Policy language almost 40 years old states, and I will read it through, "ALPA representatives shall endeavor to obtain the maximum usefulness for such devices while providing the greatest possible protection against the abuse and misuse of such devices by any government agency, carrier or any other group", and I should add that I suspect that includes most of the people in this room.

More recently, ALPA's been a proponent of expanding the number of parameters on DFDR devices, and it has encouraged the adoption of FOQA programs which analyze recorded data in order to advance flight safety.

From an airline pilot's perspective, the cockpit voice recorder issue is probably the most sensitive. It has certainly been the most controversial. When CVRs were first installed, it was with the understanding that pilots would be sacrificing their rights to privacy to help advance air safety by accommodating a tool that would be useful for accident investigation.

The quid pro quo was that the recorded information be of a specific duration, which was 30 minutes, and be erasable by the flight crew on the ground and be used only for its intended purpose, namely accident investigation.

Thus, there was a balance between the flight crew's individual rights to privacy and the collective benefits for aviation safety, but over time, certain of these constraints have become blurred, and the balance has tilted.

Some of the newer CVRs, which are quite legal and certainly more capable technologically, have no erase feature, and up to two hours of voice data is recorded.

Many who are not pilots, including numerous air safety experts, consider that pilots are being unreasonably sensitive in their demands that CVR information be provided to maximum protection, but it's imperative that we understand just how much of a gut issue this remains.

In the United States, airline pilots are subject to various kinds of routine checks, plus random drug testing, random alcohol testing, random line checks, as well as frequent security screening.

Additionally, every word a pilot says in the cockpit is recorded along with a host of aircraft performance parameters, and this remains tolerable just so long as there remains that balance between individual privacy and the benefits that accrue to air safety from such monitoring.

Abuses of CVR information, including inappropriate release of the recorded information, such as Delta 191, and inclusion in transcripts of non-pertinent conversation, have been viewed by many airline pilots as violating the original compact.

There have been instances of management listening to CVR tapes in cases that have absolutely nothing to do with flight safety. Failure to treat CVR data as privileged information and afford it the security it deserves will not just alienate thousands of pilots, but will unquestionably harm the efforts of many air safety professionals.

The use of CVR tapes in criminal cases is even more disturbing, and this development is discussed later in this presentation.

Most of us in this forum take for granted that recorded information is worthy of some measure of protection. Within the air transport industry, the prevailing international view, as you've just heard in Paragraph 5.12 of ICAO, Annex 13, is that the public interest in air safety is enhanced by limiting the disclosure and use of official accident records.

However, the application of these protections is uneven at best, and there have been many violations of this concept of privileged and protected information.

Obviously the world has changed greatly since recording devices were first placed on aircraft more than 30 years ago. In this information age, it's tempting to believe that all we need to solve a given problem is more data. Access to information in our society has been broadened considerably, and legislation, such as the Freedom of Information Act, has created an information entitlement mentality.

Although there may be general areas of aviation safety information which are suitable for public consumption, access to detailed data and that would include most recorded information would in many cases be counter-productive, but you can bet that many in the media would like to get their hands on such information all the same.

The fact remains that the public and that includes most in the media have neither the background knowledge, the analytical skills nor the incentives to help us much with the painstaking, complex and usually frustrating task of furthering aviation safety.

One of the most powerful drivers of aviation safety initiatives in this country is money; in particular, the money derived from civil litigation. The vast sums involved in settling aviation disasters places enormous pressure on access to recorded information.

Although we have restrictions on how agencies, such as the NTSB, the Transportation Safety Board of Canada and the FAA may use recorded data and other air safety documents, much of this information is discoverable by civil litigants. Plaintiffs' attorneys will naturally seek any and all information that will augment their case.

In the aftermath of the Cali accident, the plaintiffs' attorneys sought access to the confidential information contained in American Airlines' ASAP or Airline Safety Action Partnership Program. In this instance, access was denied by the judge, but future cases could be decided differently.

Such disclosure would have sounded the death knell for the ASAP program at American and would likely have killed the efforts of other carriers and their pilot groups to adopt similar programs.

The family affairs or victims' relatives movement has also gained tremendous strength in recent years, witness the ValuJet and the TWA 800 investigations. Maybe I'm a little cynical, but this issue appears to be driven by politics at least as much as compassion, and the plaintiffs' attorneys, with apologies to the attorneys of the panel, may also be fanning the flames, and always we must contend with the media.

Replaying the last words of the crew, along with the video recreation of an accident, makes compelling entertainment and can be deceptively convincing. Over the years, ALPA's had to lobby forcefully to prevent indiscriminate use of the CVR by the news media for sensationalist purposes.

Although civil litigation might keep insurance companies and their clients up at night, from the perspective of pilots, other than those who are called to testify, this is not the biggest threat. Most airline labor agreements indemnify pilots from financial liability, but what's far more troubling to us is the realization that pilots throughout the world may be much more exposed to criminal litigation than we had previously supposed. This threatens to directly impact our access to recorded information.

The case that brought this issue to the fore was a 1995 accident in New Zealand, which killed a couple of passengers but the pilot survived. While the technical aspects of this investigation were quite straightforward, the legal jousting has been anything but.

The police demanded access to the cockpit voice recorder, not just a transcript but the actual tape, in order to discharge their responsibilities. Now, the intent of ICAO and X-13 notwithstanding, the court held that the police did indeed have the right to obtain the actual CVR tape as part of a criminal inquiry, and, incidentally, at the time of this accident, New Zealand, like many other states covered by the Chicago Convention, had no legislation at all mandating installation of CVRs in passenger aircraft.

Many states, such as New Zealand, Canada and the United States, have legal systems which have evolved from English common law, although each country has implemented different legislation to address the intent of the data protection provisions of the Chicago Convention.

For countries in which disclosure safeguards are not explicit or enforced, it's reasonable to assume that police could access recorded information in order to criminally prosecute pilots. In fact, numerous European, African and Asian countries have a history of criminally prosecuting pilots, and recorded data has been used to aid the prosecution.

Now, the point here is not that airline pilots should be immune from prosecution, although that would be kind of nice, but that certain forms of recorded information, especially the CVR, have been used in our view improperly and unwisely to aid the prosecution.

It's worth reiterating that the only argument ever advanced for the mandatory installation and use of cockpit voice recorders is to assist accident investigation for aviation safety purposes.

Although we in North America are not accustomed to criminal prosecution of pilots in the wake of accidents, our attorneys tell us that we are not immune. You might recall after the USAir 5050 runway overrun at LaGuardia many years back, the Long Island D.A. for a time intended to prosecute the flight crew. So, it's theoretically possible that the police in building their criminal case would seek access to recorder data, and that could include CVR, DFDR, radar data, ACARS messages, electronically-filed confidential safety reports, and more.

In the United States, such a development would surely be met with strong opposition by pilot groups. Interestingly, and it's encouraging for both pilots and air safety investigators, the Canadians recently upgraded their legislation on recorded data.

The Canadian Safety Board Act now states that every on-board recording is privileged, and with very limited exception, no persons shall knowingly communicate or be required to product an on-board recording or give evidence relating to it in any legal, disciplinary or other proceeding.

In the view of the Airline Pilots Association, this is model legislation and complies fully with the intent of ICAO, Annex 13. We are hopeful that other countries will follow suit and enact legislation that provides a similar level of recorded data protection.

For the present, how has access to recorded data been impeded? We understand that of aircraft in New Zealand which have cockpit voice recorders installed, many are no longer recording anything. The same goes for numerous foreign aircraft entering New Zealand's air space.

Obviously this does not help the cause of air safety investigators, but it does reflect the volatility of the CVR issue and highlight the need for us to do what we can to ensure that recorded data is there when we need it.

The fact that this is occurring in a distant country should give us no solace. Air transportation is a global enterprise. There are no longer any domestic accidents. An unresolved accident, no matter where it occurs, has consequences for all of us who travel.

For this reason, ALPA strongly advocates the installation of cockpit voice recorders and continues to lobby worldwide for the enactment of adequate data protection legislation.

Line pilots are probably the most sensitive to CVR recordings, but many are also leery of routine monitoring of flight operations through digital flight data recorders. As many of you are aware by now from the previous presentations, DFDR monitoring has been commonplace with numerous non-U.S. carriers for many years.

The reluctance of U.S. carriers to follow the lead of airlines, such as British Airways, is based partly on the punitive and litigious environment in this country, and there's also a healthy measure of skepticism and distrust amongst the pilots. Always we have that fear of Big Brother watching.

Today's FOQA Program, such as those at United, Delta and USAirways, benefit from much more sophisticated technology than was previously available, but where DFDR analysis has been implemented, it's the human elements of trust and cooperation rather than advances in technology which have made these programs workable, and as Mr. Davis indicated, the rulemaking process for FOQA continues, and we applaud them.

Glass cockpits and advances in video recording technology have spurred interest in the use of cockpit view video recorders, also known as CVVRs. These devices may help us determine what the crew actually saw or could have seen. Because digital recordings from signal generators may be too far upstream to accurately reflect the information presented to the flight crew, video recorders could preserve information which would otherwise not be recorded.

Not surprisingly, given our experience with cockpit voice recorders, ALPA has insisted that protective provisions be in place prior to installation of video recorders. Such protective provisions must preclude the release of information obtained from the video recorder to anyone outside the accident investigation and must ensure that the information obtained from the CVVR cannot be used as a basis for punitive action against the flight crew by either the airline or any government agency.

In addition, ALPA believes that the statutory protections which are in place for the cockpit voice recorder should be strengthened in terms of access of information to litigants, and that these strengthened protections should also apply to the cockpit video recorder.

The ALPA provisions further state that cockpit video recorders should focus on and record only the instrument panel of the cockpit and not record flight crew activity.

With respect to video recorders, the NTSB and others would presumably prefer a more liberal approach, with the goal of recording the complete cockpit environment, including the behavior of the occupants. Again, we need to balance what is technologically feasible and what investigators would like with the fundamental privacy issues. No where is it written that pilots, when they close the cockpit door, should forfeit all rights to privacy.

As with many potential advances in aviation safety, the technological challenges of the video recorder will be much more easily solved than the regulatory issues.

ACARS and other forms of datalink are considerably less controversial than the other recording devices I have mentioned, but they, too, present security challenges.

It's not just the pilots who are exposed. Recently, a selection of ACARS messages from an air carrier were intercepted and published on the Internet. You might assume that this method of data and transmission would be slightly more secure than open VHF voice communications, but we have to work on the presumption that if a system is vulnerable to hackers, the information is going to be compromised.

In some instances, ACARS messages do contain operationally-sensitive information that should not be made public. Perhaps encryption of ACARS messages will be the solution.

An intangible but crucial aspect of recorded information security is that of trust. Most aviation safety experts agree that if we would have reached the Holy Grail, which is the next level of aviation safety, then there needs to be information sharing and trust among those who are directly involved with flight operations. This network would include manufacturers, operators, regulators, air traffic controllers, mechanics, and, of course, pilots.

ALPA and other pilot groups endorse wholeheartedly the premise of working together to advance safety within the industry. Programs built on trust, such as American's Airline Action Safety Partnership and the FOQA Programs, such as those at United, USAirways and Delta, have already shown that objective assessment of aircraft and crew performance and line operations can indeed improve aviation safety.

A characteristic of these partnership programs, as explained earlier by Captain Holtom, is that pilot representatives play an equal role in evaluating the information and deciding on the appropriate course of action. The knowledge that their interests are being protected is of overwhelming importance to line pilots everywhere.

Encouragingly, the present FAA Administrator has advocated safety partnership programs, such as ASAP, FOQA and other forms of self-disclosure. Unfortunately, and it seems typical, some of these initiatives do tend to get stalled in Washington. The boarder quick-ticket program and the painful birth of legislation to enable partnership programs which incorporate data protection provisions demonstrate the gulf that separates the regulatory and punitive side of the FAA from all those, and there are a great many, within the agency who are totally dedicated to advancing aviation safety.

As if we needed reminding, it's unrealistic for us to expect that the regulators alone can bring us to the next level of safety. This means that the rest of the air transport industry, and that includes pilot groups along with manufacturers and air carriers, will have to take up the challenge.

To reiterate, pilots do not consider themselves above the law or expect to be held blameless when they make mistakes. Pilots are not only self-critical but also tend to be very harsh with their peers who have not measured up, but they do expect to be treated fairly.

When pilots do make errors, they expect that the system will balance their shortcomings against the myriad other factors that came into play on that particular day. Pilots have no problem with accountability and are willing to be judged by their peers who have a gut feel for the issues because they've been there and done that for/by those air safety professionals who've accepted the challenge of performing a thorough investigation.

Justice demands accountability, but fairness dictates that not all recorded information will be available to aid the prosecution. Remember, the only rationale ever advocated for the mandatory installation of cockpit voice recorders was to aid in accident investigation for air safety purposes.

Summing up, adequate security for recorded information is critical if air safety investigators are to have access to the tools necessary to craft the next level of safety. We cannot take the security for granted. Assaults on sensitive and privileged information are inevitable.

Because air transportation is a global enterprise, we must make it our business to see that the intent of the recorded data protective provisions of ICAO, Annex 13, are applied not just in North America but universally. By suitably protecting recorded data, it will be readily available to those who really can make a difference.

Pilots are a crucial component of our air safety system, the integrity of which depends on cooperation and trust. Pilots ask that their rights as individuals not be neglected as technology makes even more extensive monitoring and recording feasible because if we lose the trust of line pilots, it will not easily be regained. The tasks of air safety investigators will be made much more difficult, and the traveling public will have been done a disservice.

Thank you.