There have been a number of recent aircraft disasters in which all souls on board have been, or appear to have been, lost: the unexplained disappearance of MH370, the shooting down of MH17 and, most recently, the probable actions of Andreas Lubitz at the controls of 4U9525. In all cases, security procedures have come under the spotlight and in the inevitable aftermath of a disaster assessing liability has become the focus for the insurers, the airlines and, above all, the relatives of those who perished. Joanna Kolatsis explores the legal minefield which has to be traversed in order to settle claims.

Aircraft safety and aircraft security have long been linked. Many of us remember the spate of airline hijackings throughout the 1960s and 70s, where cockpits were stormed and pilots forced to divert aircraft to unplanned destinations for political or terrorist reasons. Increased vigilance and security lead to a significant decrease in this type of criminal activity, such that by 2001, we had all become far more blasé about the possibility of terrorist attacks on flights. Clearly 9/11 changed everything.

As a result of 9/11, and subsequent (thankfully unsuccessful) terrorist attempts, airlines and airports have made major changes in aviation security measures. Ironically, one of the changes following 9/11 has been a significant factor in the most significant accident in Europe for many years – the loss of Germanwings flight 4U9525. The increased cockpit door security designed to keep a terrorist out of the cockpit, also apparently kept out a Captain seeking to stop a suicidal pilot from flying the aircraft into a mountain.

From a liability perspective, should one hold an airline and/or its personnel who take steps to prevent terrorism liable for not having the foresight to predict this type of incident?

Liability following air accidents is an ever-present concern for airlines, their directors and employees. Principally, this is not so much as a result of the damages due to families, which are governed by the Warsaw and Montreal Conventionsi, but rather because airline personnel themselves face the threat of possible criminal proceedings.

2014 was the safest year on record for air accidents. This is good news and testament to the continued work airlines carry out every day to remain safe; their business depends on it. However, over the last 18 months we have seen two distinct types of accident which have entered rare and sometimes unchartered territory: unexplained loss of aircraft (Malaysian Airlines MH370) and possible pilot suicide (Germanwings 4U9525). These incidents present various hurdles for the airlines and their insurers to overcome, but more importantly, they bring into sharp focus the issues regarding both liability and security.

MH370: Technical or Security Issue?

The loss of MH370 remains a mystery, and one questions whether we might ever learn the true fate of the aircraft. Under ordinary circumstances, the outcome of an accident report will determine the cause of the accident, whether any safety recommendations are to be made, and if any operational/manual amendments are to follow. A discussion then ensues between insurers of the airline and manufacturer (if there is a degree of cause on both sides), in order to establish apportionment of damages payable to the passengers and their families as a result of the accident. However, in a scenario such as that in MH370, the difficulty arises where the reasons for the accident are unknown. Various theories abound regarding what brought the aircraft down; all that is certain for now is that the aircraft is lost and the families of the passengers have been informed accordingly.

In the background, the insurance market responds regardless of cause. In aviation insurance, the hull and liability policies are generally placed in the all-risks market. In terms of liability, the all-risks market responds regardless of whether the cause was accidental or intentional. The hull is, however, separately insured in the event of war – and in cases such as this, the two markets come together and pay the loss to the insured in equal parts, before arguing amongst themselves about who should ultimately be responsible for the entire amount.

To an outsider, the loss of MH370 is a mystery. It is, perhaps, a credit to the aviation insurance industry that it does not use the fact of an unknown cause to avoid paying the claim.

Germanwings: Security Flaw?

In Germanwings, the industry within Europe faced a new challenge: the concept of pilot suicide. This was not by any means the first case of alleged pilot suicide for the airline industry, but certainly the first within the EU. We have seen such allegations within the Asia Pacific and Middle East regions in the past but they are always unexpected and garner a sense of public questioning of how this could be allowed to happen.

It is still early days in relation to the Germanwings investigation, but a number of issues were raised both in respect of possible security flaws for airlines to consider and potential criminal liability.

Perhaps, the most controversial topic to emerge was that of the cockpit door and the ability of the flight crew to lock this from the inside. Based on reports following the incident, it appears that this is what the first officer, Andreas Lubitz, did and, in doing so, locked the Captain out of the flight deck while deliberately putting the aircraft into a descent.

Looking back, following 9/11, cockpit security became a major issue for the industry. Aviation regulations changed worldwide to provide for cockpit doors to be locked while in flight in order to prevent terrorists from entering the flight deck. There are now three modes of operation for the cockpit door: normal (locked but can be accessed via a keypad on the outside with a 30 second delay), unlocked (used by the flight crew if one of them leaves/returns from a bathroom break) and locked (this overrides the touchpad on the outside and permits the flight crew to keep the door locked).

When reviewing these regulations against the circumstances surrounding the Germanwings incident, it gives rise to a number of questions about the future of aviation security, liability and what this means for airline professionals going forward.

Procedurally, the action Lubitz carried out was ‘permissible’ in that the flight crew are capable of carrying out this step if required. The fact that this procedure could have been used deliberately to compromise the safety of the aircraft, when its original purpose was to protect the crew and passengers, was not an instance foreseen by aviation regulators. It is essential to point out that while 9/11 was a truly devastating example of terrorism, it remains the only one of its kind. Pilot suicides, however, are not a new phenomenon to the aviation world, although thankfully they are still a rare occurrence. Is the Germanwings incident, therefore, an example of security measures taken a step too far?

Liability for a Deliberate Abuse of Operational Procedures?

Much has been made of Lubitz’s state of mind and his medical history, leading to allegations that Germanwings (and its holding company Lufthansa) should in some way bear responsibility for the incident. More importantly, it has been suggested that if, as has been alleged, Lufthansa was aware of his medical history, it should have grounded Lubitz due to his delicate mental state.

It is somewhat telling that in the Germanwings case the initial announcements and press conferences post-accident were made by the French criminal prosecutor rather than the air accident investigator. In terms of criminal liability, it is commonly known that in most civil law jurisdictions, a criminal investigation is opened at the same time an air accident investigation is instigated. While the two are never meant to converge, it is a sad reality that the two streams of investigation regularly overlap.

Annex 13 of the Chicago Convention 1944 states that the sole purpose of an air accident investigation is to prevent future accidents and not to apportion blame or liability. Most recently, EC Regulation 996/2010 was brought into effect in order to provide a framework for air accident investigation within the EU and reiterated the statement made within Annex 13.

However, the ideals of Annex 13 and Regulation 996 are generally at odds with the society we live in today; a ‘blame culture’ where someone has to be made responsible. The criminal investigations and prosecutions following air incidents that have ensued over the last few years corroborate this school of thought. The Air France Concorde accident in 2000 is an example of this when police cordoned off the accident site as a crime scene and air accident investigators could not gain access. No one would suggest that passengers and their families should not be adequately compensated when a tragedy occurs, but the current status has led to a ‘them and us’ situation. Most airline employees and officials live with the fear that one day their operation could be affected by such a tragedy which may have further impact on their own personal lives if they are accused or found to be criminally liable for an incident.

Airlines are complex operational organisations that are heavily regulated and rightly so. They carry millions of passengers around the world, and therefore, regulation is required to ensure the safety of passengers and crew at all times. Where an airline suffers an accident following the deliberate abuse of a procedure that exists to protect the passengers and crew, such as that of Germanwings, it is important to analyse the potential impact on the airline personnel who may face subsequent criminal proceedings.

It cannot be right that personnel (regardless of status within the company) should face action because the fail safe that exists to keep the ‘bad guys’ out of the flight deck did not foresee a situation where one of the pilots could be the ‘bad guy’. What if the cockpit doors of old were still in situ and the Captain could have re-entered the cockpit? There is an argument to suggest that the whole incident could have been avoided even if Lubitz was determined to deliberately bring the aircraft down yet could have been overpowered and restrained by the crew. If the Captain was purposely kept out of the cockpit due to a valid procedural action, regardless of Lubitz’s intentions and mental state, surely the airline has a defence in respect of any possible criminal action?

One would assume so, but this is not necessarily the case. As with any criminal investigation, the case will turn on the facts. The prosecutor will undoubtedly be reviewing what Germanwings knew about Lubitz’s medical health, whether they should have grounded him, and whether the knowledge about his mental health was known to the powers that be within the airline but yet they still let him fly. In an airline the size of Germanwings, which is part of a much larger group, it is highly unlikely that anyone within the organisation, much less the more senior members of the team, would have known about Lubitz’s symptoms. It is suggested that Lubitz went out of his way to hide his medical condition from his employer, but in fact personal medical records do not form part of the health checks that are conducted. It is evident that the French criminal authorities are taking an extreme interest in the Germanwings incident, particularly as all the early announcements were made by the Prosecutor. This is unusual in itself, but indicative of the potential criminal process to follow.

If the disclosure of personal medical information is examined further, it must be said that there is a danger in making a ruling that mandates all personal records should be disclosed; this could have the opposite of the desired effect. Pilots could ultimately avoid seeking assistance for mental health issues for fear of being grounded. One of the reasons air safety is at an all-time high is as a result of the immense efforts the aviation industry puts into safety management and the open, non-judgemental culture of disclosure of reporting that exists in respect of safety issues. If this is compromised, airline personnel may refrain or, hesitate, to cooperate with their employers and regulators for fear of reprisal.

In terms of aviation liability insurance, there is also an issue as to whether (if it is proved that Germanwings knew Lubitz was a threat) insurers should refuse coverage for the accident. In reality this seems highly unlikely. Most, if not all, airline policies contain clauses which are known as ‘conditions precedent’. These are clauses whose conditions need to be fulfilled for the insurance policy to remain valid. In the case of an airline, the most pertinent would be that the airline had to maintain its relevant certificates of airworthiness and that their pilots had the correct licences and medical certificates. Whilst it may be questionable whether Lubitz should have been found to be fit to fly, there is no allegation that he did not hold a valid medical certificate. Moreover, the aviation insurance market (as in the MH370 instance above) works hard to provide cover rather than deny claims. It is not to say that cover has never been denied on a major loss (the author of this article is aware of only one such loss some 10 years ago).

Liability for Aviation Security Flaws in the Future

It is apparent that while air accidents are far less frequent, they do appear to be more complex in nature. Airlines face an increasingly well-educated and trained aviation community who are ready to question each and every fact following an incident; indeed, it is their duty to question whether there has been any wrongdoing. This becomes a grey area where possible security breaches are concerned. Security issues have been at the top of the aviation agenda for some time, and particularly since 9/11. It is evident that aircraft have become an attractive medium for would-be terrorists or suicidal pilots and the industry is trying to stay one step ahead in this respect. Liability for such incidents is not straightforward, and while insurers are unlikely to refuse cover for the deliberate abuse of a procedure leading to an incident, the threat of criminal liability remains.

Ultimately, when considering possible criminal charges, prosecutors are generally looking for systemic failure of management. It is not uncommon, however, for those who have had little involvement in the accident to face criminal charges in order to hold someone accountable rather than for due cause. It is important for airlines to bear in mind that insurance cover for any criminal proceedings can be limited (and is generally not part of the main aviation insurance policies). Funding a personal defence is a particularly expensive (and worrying) burden if you have been suspended from your role following an accident. It is, therefore, imperative that airlines take measures to ensure their organisation and personnel (at all levels) are protected in so far as possible.