A Hacker's Mind: How the Powerful Bend Society's Rules, and How to Bend them Back

by Bruce Schneier

The Boeing 737 MAX debacle provides a particularly high-profile example of the regulatory negligence that results from overly close relationships between regulators and regulated industries. In this case, FAA regulators applied insufficient scrutiny to the 737 MAX’s Maneuvering Characteristics Augmentation System (MCAS), which the company had modified. As a result of this failure of oversight, two 737 MAX airplanes crashed in Indonesia (2018) and Ethiopia (2019), killing 346 people. Let’s be explicit about the hack here. Regulatory agencies are supposed to be the expert proxy for the average person’s interest. I am not an expert in airplane safety (or automobile safety, food safety, drug efficacy, or how banks should organize their balance sheets to keep the economy stable). Government provides that expertise in the form of regulatory agencies, which make rules on my behalf to protect me. This oversight mechanism is what’s being subverted. Analysis of the failure pointed to regulatory failures. The FAA never independently scrutinized the MCAS; it relied on Boeing’s own assessments of the system. The FAA didn’t have the expertise, and its Aviation Safety Oversight Office delegated much of the work to Boeing. The engineers who worked on the planes were allowed to certify their own work. And there were instances where FAA managers took Boeing’s side when its engineers wanted safety changes. The FAA even waived several regulations to permit Boeing an abbreviated certification ...