Develop a standardized structure to make it searchable by different factors or combinations of factors (e.g., 777 model later than Z & decending & outside temp < X & throttle is > Y & etc.) When there's an accident, you could review similar circumstances.
From my ignorant perspective on air safety, it would seem to be a gold mine.
But what you're trying to solve, already exists without the voice recording part. It's called FOQA or Flight Operations Quality Assurance. Mandatory for airlines in Europe, not yet mandatory in the US but may be in the future.
It records hundreds of parameters from engine indications to touchdown speed, G-loading, control inputs etc. Automatically uploaded to the operator and tracked for the whole fleet. That data is de-identified and used for safety analysis and improvement.
An argument can easily be made that this extra stress will make flying less safe.
Edit: my next car will probably have mandatory spyware and unlike pilots there won't be a guaranteed no blame process if something happens. It is pretty easy to see how this will be abused by insurance companies and data harvesters.
I think I kind of understand the processes that lead to this. But I seriously wish tech people wouldn't be accepting it and even argue for it.
Tech people are arguing for accountability in a life/death scenario.
That there is no privacy in public spaces is a longstanding social/legal tradition. A cockpit is physically private for physical security reasons but the pilots in the cockpit are acting on behalf of public trust. Their social norms in that physical context are not their own to define.
If pilots want privacy they can quit and sit at home.
Just to illustrate, 5 years ago a first officer on year 2 pay would make on average 40-50k per year. In 2023 that has increased to 143k per year for all three American Airlines owned regionals (plus a 165k retention bonus). Similar for Spirit, increased to 142k standard and 145k on the Airbus. And JetBlue to 160k for the A320 and 153k for the A220.
In this market, the first airline CEO to say "well then quit and sit at home" to their union will have half their workforce walk out within months.
The law of diminishing returns very much exist, and as one of my teachers in engineering once pointed out: if you really want to use surveillance to put a dent in the crime statistics you should put it in people's living rooms and in their bedrooms.
Have you considered what the extra stress of considering ones every word during a long and stressful day can do to someones concentration?
I mean many, the thoughts about what they said earlier this morning is bad enough even if it wasn't recorded.
We already record a couple of hours or so. If you want to record more, it is up to you to come up with data for how many more air traffic accidents we can solve and also to explain how we can know that it won't make air traffic more dangerous.
This is an argument against any change that involves unknowns. I see it often, and I absolutely hate it.
Everything worked out in this case but that’s because every incident is a lesson.
This means airlines will have a smaller pool of less desirable / qualified pilots to choose from.
I get that people want their privacy, but if it saves lives, it's a workplace (like customer service and many other jobs that aren't life-threatening), that outweighs it. People get surveilled constantly in their private lives and live with the stress.
I work on larger UAS systems where we don’t have any form of mandatory recording for the FAA. We do have wireless headsets that we use for comms between the pilot, the GCS operator, the flight director, and whatever engineering support staff are on the ground. The system would allow us to record pretty trivially but we’ve debated this and explicitly decided that we get more value from being able to keep the communication as candid as possible instead of having to worry about having every word we say over comms scrutinized if there’s an incident.
If anything, the proliferation of dash cams will (and have) lead to bad drivers being appropriately charged more for insurance than good drivers. Previously, if you were cut off and collided with someone, you were always assumed to be at fault if you were behind the other driver.
Aviation is by far the safest form of transportation. In the last 10 years of data (2012-2021) there were a total of 2 passenger fatalities on US airlines across several billion passengers for that time period [1].
If you want to start recording workplaces to improve safety, there are a lot of industries to look at before aviation.
[1]. https://www.airlines.org/dataset/safety-record-of-u-s-air-ca...
Most civilians don't seem to have much sympathy.
This is irrelevant to the discussion about recording pilots.
Should all medical device software developers have the entirety of their working lives be archived in a similar manner?
First they came for, etc, but they came for me a long time ago.
The equivalent of an always-on cockpit voice recorder would be... screen recording all of your digital devices during working hours? And, turn a mic on just to be safe?
I'm a programmer on a team with other programmers, many of us remote.
We're not standing around a water-cooler talking. We're on team chats. We're reply-all'ing to email-chains. We're sharing memes. Half the time we talk across chat when we're sitting in the same room.
These aren't formal design docs or code output [the analogy to flight controls], this is our water-cooler talk, and it can all be subpoenaed in a variety of situations, to be read into court record and taken out of context for the rest of time.
Would you be okay with a recorder being beside your desk at all times? Catching every conversation, even personal ones?
Currently it's your choice to participate in sending memes over email. You also have the choice to walk over and have a private conversation.
But are all zoom calls required to be archived, specifically in the medical device industry?
Certainly you have the option to make a phone call to a teammate, or walk over to someone if not remote, and say something without any record. Don't you?
Mind you, that is how people mostly work anyway. Even if I generally trust an employer to not be intrusively monitoring my communications, for anything sensitive I'm ideally going to talk in person or failing that, at least go with a personal cell call.
But we aren't talking about how to circumvent monitoring. We're talking about working when your idle socializing (while working) is monitored and logged.
I could deal with it if my laptop did that.
[Edit: I mean, voice chit-chat. Just talking to each other. That gets recorded for pilots, and not for software engineers, no matter how long they keep our (text) chats for. Stuff gets said in person, by voice, that would never get typed out in a chat.]
Chat logs are tiny.
As such, it's a large liability, and most companies retain those sorts of records for the minimum amount of time acceptable by law/regulation/customary expectations.
If this is true your legal team is committing malpractice.
Will you too?
How about instead of that nonsense we just have a reasonable conversation and assume best intentions?
But seriously, why did you skip over the software devs? Their errors could kill many more people than a bad doctor.
Right now tons of public activity is monitored already but almost in all cases it's to catch customer abuse and never for business abuse. Monitoring everything 100% will become one of the greatest equalisers. Only people rejecting this are people in abusive power.
I have looked at my kids’ pediatrician visit summaries, and they will state “doctor did this and that”, when I know for a fact the doctor did not. So I have to send a mychart message to document that the doctor did not do those things.
Now, I understand that excessive liability is probably driving doctors to do unnecessary things and so 95% of the time, there is no ill intent, but rather shrewd judgment of not wasting time, however writing (or copy pasting) a false visit summary is not the answer.
Note: All of this is U.S. perspective, I have no idea about healthcare anywhere else.
Given how hard it is to even find half-decent doctors even taking new patients, or having appointments available this quarter let alone soon, the doctor likely doesn't need you nearly as much as you probably need a doctor. They're going to be fully booked even if they ask you to leave and decline to be filmed, so they don't have any reason to consent to it. This is one place where the "try to make the customer happy" conventional wisdom about transactional relationships seems to not apply one iota.
I'd like to point out that one thing the tech industry is bad about is figuring out which technology to definitely not build. In fact, we've collectively resisted any attempt at so doing.
But joking aside, in most places there are checks and balances between privacy impact and benefit. We all accept that some government agencies know some of our data, because the net benefit to society is bigger than the loss of privacy. And you would normally try to do such things in the least invasive way possible while achieving the benefit.
Where you go wrong in your passenger rant, is in assuming there is a big safety benefit in more recording of pilots. There were a total of 2 fatalities on US airlines in the last 10 years [1], while billions of passengers were transported. The safety record of airline transport is stellar, without more recording. So yes, I believe it is very reasonable to consider what is and isn't acceptable to the crew being recorded.
[1] https://www.airlines.org/dataset/safety-record-of-u-s-air-ca...
The recording should anyway only be retrieved under specific conditions and in a controlled environment.
In this specific case the longer recording duration may have actually aided the investigation and thus further improve airline safety.
There is also more nuance to the debate around the 25 hours change. Like you say it should only be used under specific conditions and in a controlled environment, but in the US unfortunately recordings have been leaked and have been used for disciplinary purposes instead of a blame-less investigation for safety.
Europe has had rules for 25 hour recording since 2021, as far as I know without any opposition. But European recordings have also not been misused before.
If ICAO can require keeping 25 hours why should a crew get to choose 2?
- They need to work well together, and the better rapport they have with each other the better they're likely to perform in an actual incident. Regular interaction on the job is a part of that.
- They work a job that is often remarkably boring for much of the time. Drowsiness setting in is a real concern - a degree of social interaction is good at both keeping people engaged, and at helping them gauge how alert the other crew members are.
https://en.wikipedia.org/wiki/Sterile_flight_deck_rule
I agree that the crew should feel free to chat. And when there is an accident, they should expect that the recordings are kept.
It's also unfathomably unreasonable to call for storage of all voice recordings of the flight deck in perpetuity. That's ridiculous and is privacy invading. If you want to improve the state of this industry, you are looking in the wrong place.
My workplace is my laptop, and I’m fairly certain that it records more than the airplane does. I certainly have no expectation of privacy while using it. Any meeting is recorded regardless of what is being said.
I’m sure my casual conversations would be if anyone felt I said anything valuable while muttering at my screen.
Not saying that’s great. Just saying that airline staff may currently have more privacy than most.
So long as the recording is properly encrypted, and the access is properly managed, privacy will be preserved.
If those things aren't true, then there is a privacy violation, regardless of the 2 hour time constraint.
For one police officers are often able to turn on and off recording themselves, so it becomes as much of a protection for them as for everyone else. That is: if they are good police officers.
Secondly, unlike pilots, the police force in many countries does not have a stellar track record.
Edit: I do have some concerns. Yes, police brutality absolutely exists. But there also seems to exist a subset of the population - also represented here - who think police can be like superman and whenever they aren't that's because they are evil and enjoy harming innocents.
So I guess they had similar objections to being recorded 24x7 and that was accommodated in the rules around body cams.
Storing something for two hours is still storing it. The point was why is it bad if it is listen to for X minutes in a month, but okay if it is listen to for X minutes today? I can see no reason at all why two hours is okay if five isn't. I could understand if the argument was that nothing should be stored at all.
> The point was why is it bad if it is listen to for X minutes in a month, but okay if it is listen to for X minutes today?
That wasn't the point and the problem is who is listening, why, and what they may do with the information.
What can you say that I can hear on a recording that would stress you out if I listen in 3 hours but not if I listen after 1 hour? Is 2 hours okay but 2,5 is perpetual suddenly? That's a strange hill to die on. Zero hours make sense. 2 and no more or less seems ... strange. Why 2 and not 3? 33? 0,3?
Actually yes, it is the point. As has already been exhaustively pointed out in this thread the issue is the difference between two hours on the airplane that auto-erase and perpetual recording available to the company for whatever purpose they can dream up.
> Is 2 hours okay but 2,5 is perpetual suddenly?
That's not what the word "perpetual" means. "Perpetual" means "forever" as in "we never delete these recordings".
>"This is a proposal from the NTSB to the FAA to raise the CVR recording time from 2 hours to 25 hours, in line with ICAO."
You are arguing two hours is fine, but 25 hours is "perpetual recording". That is a strawman.
When I go into the office to meet with customers or whatever, there aren't cameras and microphones everywhere. I can use a personal cell phone (which is all I have these days anyway). And, honestly, for something personal but not in any way getting into legal issues, I have no problem communicating over chat or a video call.
And while we're at it, why stop with CVRs? Software is a key component of all engineering domains today, and thus a critical safety factor.
All MacBooks (the most popular developer machine today) have built-in microphones. We should using them to record all dev conversations (after all, there's zero incremental hardware cost to doing so), as well as all keystrokes of anyone who writes software, 24/7, so that we can retrospectively analyze why they failed to avoid writing buggy code and the decisions that led to it.
Everyone who has had their PII leaked will rejoice, knowing that we can finally "get" those nasty open- and closed-source developers who created CVEs.
"B-b-but, that's different!"
There's a clear and obvious difference between a self-important person who writes software and a person who pilots hundreds of folks over top of thousands of other folks in a slow and only mildly explosive missile.
If we record every action of the pilot of a plane, why wouldn’t we also record every action of the developers who wrote the autopilot software, or the fly-by-wire software?
As a developer, every final action is also recorded in the performance of their job. That's what Git is for, and that history lasts for quite a lot longer than 2 hours.
The original comment suggested recording every action from the cockpit and using it for analytical data. The final action isn’t the goal. The steps and discussion that got them to the final action is. Hence recording every step the pilot takes, and the equivalent would be also recording every discussion that the software developer made that influenced them to write the code the way they did.
Saying “the git commit is there, that should be good enough to know the result” is like saying “the pilot landed the plane, that should be good enough to know the result”. Why do we even need CVRs at all? The final action is right there, right?
So again, why record everything the pilot says but not everything the developer that wrote the autopilot says?
For a pilot that just flew a 12 hour flight with a malfunction that would be of obvious benefit.
For a developer that introduced a bug 8 months ago, maybe not so much. Even if you recorded every interaction the dev had over that time period nobody would be able to go through everything and get sensible information.
If ‘directly responsible for lives’ is the rationale for voice recording pilots in the course of their jobs, and not developers, since developers are not directly responsible, but indirectly responsible, can we also expand the list of professions to include always recording police, firemen, and all medical professionals all the time.
I suspect making sure that surgeons know that anything they say during the course of their job, can and will be held against them in a court of law, will not serve to improve the quality of the work they do.
As you can imagine, this is not a situation that US pilots want to be subject to and they are probably right that safety would actually be made worse.
For audio recordings, in the absence of an incident, I see no reason to do it.
And note that the real problem is with authentication (MACs, or digital signatures), not encryption. Public availability of those records is actually probably beneficial. It's a common misconception to think that you need to encrypt while in reality you perhaps need to encrypt, but first you absolutely must authenticate.
On top of that, almost everyone in the US also has some form of collision avoidance technology now, as well (either TCAS or ADS-B).
And there's plenty of times where the only time I could hear ATC was with the squelch full open, trying to pick a faint signal out through the static. Digital modes are terrible for this.
We're talking about something like a landing clearance. It doesn't have to be completely off the chart. And yes you can inject a message like that successfully, without the ATC ever knowing.
TCAS is equally broken - doesn't have authentication codes / signatures. It's actually more vulnerable since it has higher priority than ATC.
Digital modes can encode speech more efficiently than analog modes, thus reaching further on the same link budget. For example ADS-B is "audible" as far as the curvature of the planet allows - my own antenna can hear messages from up to 200mi away.
It really is a serious problem.
See: https://en.m.wikipedia.org/wiki/Cliff_effect
https://www.selby.com.au/blog/what-is-the-digital-cliff-2
Up in the air, I can also hear AM analog voice transmissions from 200 miles away, so that's not really a good measure of performance. Both modes already do that. Benefit of having an unobstructed line of sight from several miles of altitude. :)
https://cybernews.com/news/century-old-technology-hack-broug...
It's only a matter of time before this happens in aviation, but unlike in the trains case it doesn't have to be just an availability problem (all trains stopped safely), it can be a "remote code execution" problem.
It took 6 months to find him, and mind you that that guy was the opposite of clever (he was talking from his bathtub, from what I remember, and he started out not even knowing the ATC language).
Also, it really makes sense to think ahead just a bit, you know. Not everything has to be triggered with an accident, and in this case we're likely talking about terrorism, since no one would do this without realising just how bad the legal consequences are.
And if another voice comes over the freq giving you instructions that don't make sense, the response is going to be a polite version of "WTF?"
There really is no way to do it safe without authentication codes or digital signatures.
PS. And the readback can be just jammed.
Every modern airliner has dual-redundant or better GPS-aided inertial navigation systems, and every professional pilot is trained on procedures for flying in the airspace system after losing all their (multiple) radios. This is literally not a risk worth spending the millions/billions it would cost to mitigate, any more than Joe Average Internet User needs to hire a professional cybersecurity firm to secure his home Wi-Fi router.
https://arstechnica.com/information-technology/2019/05/the-r...
On a foggy day when the visibility is right at minimums, I can imagine a huge risk of aircraft being sent off-course right before landing. Hopefully the pilots would still be able to recover the situation - the TOGA button is right there on the thrust levers on most aircraft - but nobody is infallible.
I would imagine that some military transport aircraft have backup, INS-based navigation systems that create a synthetic glidepath without external radio signals. Airbus have been trying to introduce such systems on commercial airliners for quite a while, although that is intended to allow landing on more remote runways rather than specifically to improve security against malicious interference.
All that is to say that the lack of fatal aviation accidents that we know were caused by malicious radio interference doesn't in any way make the attack less feasible.
Digital signatures, even with conventional X509 certificates straight out of the OpenSSL library, would go a long way to mitigate this risk. What about the risk of the signatures failing? The worst-case scenario is that the pilots get a warning on their ECAM display: "Comms not secure". That should at least alert them to the possibility of false readings even if it can't correct them.