# Seattle-Tacoma International Airport

Non-Punitive Program and Legal Authority

Prepared For: Federal Aviation Administration Office of Airports Airport Safety and Operations Division

Prepared By: Landry Consultants LLC, on behalf of Seattle-Tacoma International Airport and Operations Senior Manager, Mark Coates

Date: 11/25/2009A TTORNEYS AT LAW

111 HUNTINGTON AVENUE BOSTON, MASSACHUSETTS 02199
617.342.4000
617.342.4001 WWW.FOLEY.COM

dbannard@foley.com
617.342.4033

Privileged and Confidential

Attorney Client Communication



# M EMORANDUM

CLIENT-MATTER NUMBER
094694-0101

TO: Joanne Landry & Deirdre Cowden, Landry Consultants LLC

FROM: David Y. Bannard & Cheryl Wagonhurst

CC: Mark Coates & Paul Bintinger,
Port of Seattle

DATE: May 22, 2009

RE: Review of Legal Issues Relating to Implementation of an Airport Safety Management System and Recommendations

Introduction

We have been engaged by Landry Consu ltants LLC (“Landry Consultants”) to review the legal issues associated with implemen tation of an airport safety management system and make recommendations regarding minimizing a ny legal risks identified with implementation of such a safety management system. Landry C onsultants has been engaged to conduct research and develop proof of concept deliverables for a Federal Aviation Admini stration-sponsored SMS pilot study at Seattle-Tacoma Internationa l Airport (“SEA” or the “Airport”).

This memorandum begins with an introduction to Safety Management Systems (“SMS”), followed by an executive summary of the primary issues addressed by the memo and our conclusions. After the executive summary, the me mo sets forth an in-depth legal analysis of the three primary legal areas that are the subject of this memo: (1) legal issues relating to maintaining confidentiality of data collected pur suant to SMS, (2) potential liability issues arising from adoption of a SMS, a nd (3) issues relating to extension of SMS to tenants and others doing business at an airport. This is followed by a brief discussion of the concept of a “just culture” and how such an organizational concep t affects SMS. Finally, the memo includes recommendations relating to the regulations implementing SMS that the Federal Aviation Administration (“FAA”) is expect ed to promulgate within the next 12 to 18 months. Although we have attempted to include an in-depth legal analysis of the issues raised by implementation of

BOST 05-22-092

BOST 05-22-09 SMS at an airport, the legal issues presente d by SMS is a very broad and evolving subject. Further, the FAA has yet to promulgate its notice of proposed rulemaking for SMS. It is likely that additional legal issues will be raised, and additional legal advice may be required, as the regulatory process unfolds and airports begin to fully implement SMS programs.

Introduction to SMS

The FAA defines a SMS as “a systematic, proactive, and well-defined safety program” that allows an airport (or other organiza tion) “to strike a realistic and efficient balance between safety and operations.” 1 According to the FAA, a SMS is “[t]he formal, top-down business-like approach to managing safety risk. It includes systematic procedures, practices, and policies for the management of sa fety (including safety risk mana gement, safety policy, safety assurance and safety promotion).” 2 Use of SMS is expected to increase the likelihood that airport operators will detect and correct safe ty problems before those problems result in an
incident or an accident.

Why Implement a Safety Management System?

The International Civil Aviation Or ganization (“ICAO”) has adopted an
amendment to its International Standards and Recommended Practices that requires member states of ICAO, which include the United States, to require that operators of international airports implement a SMS. 3 ICAO has adopted similar requireme nts applicable to operators of commercial aircraft, aircraft maintenance organizations and air traffic services. 4 According to ICAO, a SMS is “a systematic approach to managing safety, including the necessary organizational structure, accountab ilities, policies and procedures.” 5 A SMS, at a minimum, must: (a) identify actual and potential safety hazards; (b) ensure that remedi al action necessary to maintain an acceptable level of safety is implemented; and (c) provide for continuous monitoring and regular assessment of the safety level achieved. 6 An approved SMS must clearly define the lines of safety accountability throughout the ai rport operator’s organization, including a direct accountability for safety on the part of senior management. 7 ICAO has provided guidance on

1 FAA website: www.faa.gov/airports_airtraffic/airport_safety/safety_management_systems

2 FAA Advisory Circular (“AC”) No. AC 150/52 00-37, Feb. 28, 2007, Introduction to Safety Management Systems (SMS) for Airport Operators (“AC 150/5200-37”).

3 See Annex 14 to the Convention on International Civil Aviation (“CICA”), § 1.4 (Certification of aerodromes).

4 See Annex 6, Part I, chapter 3 (aircraft), chapter 8 (aeroplane maintenance), Part III, chapter 1 (commercial air transport), and Annex 11 (air traffic services) to the CICA.

5 CICA, Annex 14, Vol. I, § 1.1.

6 Id . at § 1.5.3.

7 Id . at § 1.5.4.3

BOST 05-22-09 safety management systems in the ICAO Safety Management Manual (Doc. 9859) 8 and in the Manual on Certification of Aerodromes (Doc. 9774). 9

The FAA has issued an Advisory Circul ar stating that the FAA intends to implement a rulemaking that will require the use of SMS at U.S. airports to meet the intent of the ICAO standard in a way that complements existing airport safety regulations in 14 CFR Part 139 (“Part 139”). 1 0 Part 139 prescribes rules governing the certification and operation of almost all airport within the United States that have scheduled or unschedul ed passenger service. 1 1 Among other things, Part 139 requires th at each certificated airport develop, maintain and update an Airport Certification Manual (“ACM”) that addresse s a wide variety of issues, including specific safety-related issues, such as procedures fo r protecting persons and property during storage, dispensing and handling of fuel or procedures for airport condition reporting, as required under
Part 139. 1 2 Part 139 also addresses numerous, speci fic safety-related matters in Subpart D – Operations. 1 3 However, Part 139 does not directly address a proactive, forward looking approach to hazard identification, risk analysis and mitigation that are the hallmark of a SMS program. Accordingly, the FAA has opened a rulemaking project to consider a formal requirement for SMS at airports that are certificated under Part 139. 1 4 There are approximately
570 Part 139 certificated air ports in the United States.

In preparation for the rulemaking pro cess, the FAA sponsored a pilot SMS program at 25 airports, as well as a second pi lot phase SMS program currently underway at a number of smaller airports, a nd a SMS proof of concept study at three U.S. airports that participated in the first pilot SMS study. In addition, the FAA provided a grant to the Mitre Corporation to produce a white paper on SMS, an d the Airport Cooperative Research Program of the Transportation Research Board of the National Academies (“ACRP”) has approved a grant project for development of a SMS user guidebook for airport operators that is nearly completed.

One of the conclusions of the initial airport SMS pilo t studies was that, although Part 139 addresses safety at airpor ts in many areas, the existing sa fety regulations at Part 139 are not a comprehensive SMS. 1 5 Part 139 does not cover all areas of a commercial airport, or even

8 The second edition of the ICAO Safety Management Manual has been released in draft form, but as of the date of this memo, the ICAO Safety Management Manual has not been finalized.

9 See Annex 14 to the Convention on International Civil Aviation (“CICA”), § 1.5 (Certification of aerodromes).

10 See AC 150/5200-37.

11 14 CFR § 139.1 (applicability)

12 See, e.g. , 14 CFR §§ 139.201 (general requirements), 139.203 (contents of ACM), 139.205 (amendment of ACM).

13 See 14 CFR § 139.301, et seq

.

14 Id

.
15 See FAA summary of initial pilot SMS studies, concluding that it is “[a]pparent that [Part] 139 is not SMS in and of itself.... Evidence that SMS is something larger, more comprehensive, than is currently found in4

BOST 05-22-09 all sterile areas (e.g., beyond the s ecurity checkpoints, where only passengers or appropriately badged employees are permitted) of a commercial airport or all aspects of safety management. In addition, Part 139 does not provide for comprehe nsively collecting and an alyzing safety data, acting on the trends identified an d conducting regular, follow up aud its and monitori ng of results
achieved.

How Does a SMS Work?

SMS is intended to be a forward-looking proactive program, rather than an analysis of past incidents. SMS co mprises the following four “Elements”:

1. Development and implementation of safety policy and objectives, including staff responsibilities.

2. Development of a safety risk management process, which describes each system or activity at an airport, identifies hazards associated with such system or activity, determines and analyzes
the risk associated with each such hazard, and treats or mitigates
and monitors the risk.

3. Assurance of safety through oversight and auditing to ensure that the safety programs are implemented and effective.

4. Promotion of safety through the development of a positive safety
culture , including training, with in the organization. 1 6

Thus, an airport that adopts SMS will generally designate a senior level safety manager who reports to senior management and is charged under the safe ty policy developed by the airport with overseeing implementation of th e SMS. The second elemnt of SMS will require most airports to undertake a significant program to describe the systems and activities at the airport and the hazards associated with such syst ems and activities, determine the level of risk associated with such hazards and then mitigate th e risks that are found to be unacceptable under
standards included in the airport’s SMS. Airports may choose to undertake this task in phases, for example, undertaking this with respect to the apron first, and th en extending it to the bagwell, and then to other areas of the airport. As pa rt of this process, as well as the monitoring component of this element and the auditing component of the third element, data will be gathered and analyzed. Initially, an airport will need to design and populate this database with the systems and activities, the hazard s identified, the degree of risk identified for each such hazard, and the mitigation activities undertaken, if any. Following the initial development of this

the act of complying with 139 requirements. Evidence that 139 compliance may eventually become part of airport SMS program ... contrary to the idea that SMS would eventually become part of 139. Reference made to the idea that SMS could be used to ensure 139 compliance ... but that 139 by itself could not ensure that SMS was functioning.” Presentation at joint FAA/Airports Council International – North America (“ACI-NA”)/American Association of Airport Executives (“AAAE”) SM S Conference, Baltimore, MD, October, 2008.

16 See AC 150/5200-37, Ch. 2 (Elements of a Safety Management System).5

BOST 05-22-09 database, an airport will need to continue to gather data on new activities, newly identified hazards, changes in the degree of risk assigned to such hazards, and the results of mitigation activities. As is discussed in detail below, it is the act of gathering and maintaining this critical database that presents many of the legal issues that are associated with SMS.

Among the critical elements of a SMS that have been identified are the ability to gather and analyze data from ma ny different sources re garding hazards at an airport. SMS is predicated upon the belief that th e analysis of data concerni ng hazards can be applied to determine the causes leading to accidents and, thus , to mitigate the personal injury and property damage resulting from such accidents by avoiding them. The more data that can be included in such an analysis, the better the likelihood that hazards can be identified and mitigated, and
accidents avoided.

SMS in Other Contexts

Other industries, notably the health care industry and the nuclear energy and oil and gas industries, have adopted practices similar to SMS. Best practices from these industries
have shown that more and better data are provided where data can be held in confidence, where there is a non-punitive reporti ng policy, and where information can be reported anonymously. 1 7 For example, the report on a r oundtable co-sponsored by Kaiser Permanente In stitute for Health Policy, NASA Aviation Safety Repo rting System and The National Quality Forum in August of 2000, concluded that proposed voluntary patient safety improvement reporting systems would build on design elements from the Aviation Safe ty Reporting System and include the following key design elements: 1 8

• Voluntary reporting to a non-regulatory entity.

• Strong confidentiality protections.

• Complement existing reporting systems.

• Public access to a de-identified da tabase (i.e., de-identified patient, provider, institution, and person reporting).

• Expert analysis of the reports is essential.

• Enable the system through federal authorizing and funding.

• Individuals and institutions sh ould be instructed to report complaints of criminal activity, gross negligence or professional

17 See, e.g., CRS Report for Congress , Health Care Quality: Improving Patient Safety by Promoting Medical Errors Reporting, updated March 24, 2005.

18 See “Design Considerations for a Patient Safety Improvement Reporting System”, sponsored by Kaiser Permanente Institute for Health Policy, NASA Av iation Safety Reporting System and The National Quality Forum, held at NASA Ames Research Center, Moffitt Field, California, August 28 - 29, 2000.6

BOST 05-22-09 misconduct to the appropriate regu latory agency and not to the voluntary reporting system.

• Individuals or institutions repor ting to the system should be guaranteed confidentiality, but s hould not be anonymous. Follow up may be necessary.

Health care, in particular, has been able to demonstrate tangible and significant reductions in medical errors, ther eby improving safety. As discusse d in this document, research
has shown that where an “ethical culture” is de veloped and encouraged, reporting of incidents
increases and costs are reduced. 1 9

SMS Operational Characteristics and Issues

As noted above, ICAO has recommended that SMS be implemented by all participants in the international air transportati on system, including airport operators, aircraft operators, aircraft maintenance organizations and air traffic c ontrol providers. The FAA has begun to implement SMS for air carriers, for its ai r traffic controllers and for airport operators. Inevitably, there will be overlap between th e functions of SMS adopt ed by each of these participants. As discussed below, we recommend that the FAA issue rules that help clarify the responsibilities of the va rious participants for various functions . In all events, however, it is likely that in order to implement SMS effectiv ely, each airport operator will be faced with the necessity of working with the air carriers, ground handlers, and air traffic control at that airport to coordinate SMS among them and ensure that all areas are covered adequately by SMS implemented by one or more of the orga nizations operating at the airport.

Thus, the proper scope of a SMS is an issue that both the FAA, through its rulemaking process, and the airports must addr ess; should the SMS program apply only to the airport’s staff and areas within the control of the airport, or should it be applied more broadly, for example, to cover all of the airs ide other than the areas under the ai r traffic control tower’s direct control, or all ar eas of the airport, including landside. Although, depending on the content of the final rule, to a certain extent, this issue may not be a legal one, if an airport operator determines to extend the scope of its SMS to areas and operations not directly within the airport operator’s control, then additional legal issues relating to the conflict between a tenant’s rights to control its employees and actions within its leased space and an airport operato r’s desire to enhance safety at the airport, are likely to arise, as noted below.

In many ways, SMS is similar to a traditional cost-benefit analysis. SMS is intended to identify hazards, quantify the risk – both in terms of likelihood and in terms of severity – of the hazard occurring, and then mitigate those risks f ound to lie within an unacceptable range of severity and/or likelihood. SMS recognizes that risk cannot be eliminated, and that the costs of mitigating certain risks cannot be justified, either becau se the risk is so remote or because the cost to mitigate cert ain risks is unreasonable. But by moving from a

19 CRS Report for Congress , Health Care Quality: Improving Patient Safety by Promoting Medical Errors Reporting, updated March 24, 2005.7

BOST 05-22-09 reactive mode of managing safety in which safety advances typically follow accident investigations and toward the more predictive m ode of managing safety in which data collection and analysis enable risks to be identified and ad dressed before they cause an accident, SMS has the potential for leading to a majo r improvement in aviation safety. 2 0

Executive Summary

Set forth below is a summary of the legal issues that we have identified to date arising from the proposed promulgation of regulations mandating adopti on of SMS at Part 139- certificated airports, and a su mmary of recommendations arising from our analysis. For example, the data-driven nature of SMS and th e fact that studies have demonstrated that maintaining confidentiality of information and thos e reporting such informa tion can be a critical factor in development of safety systems conflicts with the fact that the vast majority of U.S. airports are subject to freedom of information laws that require disclosure of most information gathered by such airports. Thus, several of our recommendations relate to means and methods to protect SMS data from disclosure. In summary, we find or recommend that:

• The implementation of SMS ha s the potential to be a signi ficant step forward in promotion of aviation safety and is likely to result in lives saved, fewer personal injuries and reduced property damage. However, SMS also has the potential for increasing legal liability e xposure for those entities forced to adopt SMS.

• Careful consideration should be given to the design and implementation of the regulations and related systems that will comprise the FAA’s integrated SMS for airport operators, air carriers and air traffi c control, so that the objectives of SMS can be achieved while minimizing add itional legal liability exposure and unnecessary costs.

• SMS will be most beneficial when a wide range of information and data are reported and made available, so that all applicable hazards are identified, risks analyzed and appropriate corrective action is taken so as to mitigate future risk.

• In order to encourage identif ication of potential safety issues and proper reporting, the FAA should implement regulations that protect data from disclosure, to the greatest extent possible, and permit data to be de-identified a nd aggregated in a manner that allows airports as well as other participants in the national aviation system, including air carriers, air traffi c control, the FAA and ground service providers, to access such data for appropria te analysis. 49 U.S.C. Section 40123 should be amended to protect SMS inform ation from disclosure under state and
federal FOIA.

• Because implementation of SMS programs will heighten awar eness of certain risks related to aviation safety, those en tities participating in SMS programs will likely face increased legal liability exposur e for negligence claims, or even claims

20 See Aerosafety World , “Into the Mainstream”, January 2009, p. 25.8

BOST 05-22-09 arising under related theories, such as recklessness, in the event of an accident. Failure to adhere to SMS regulatory re quirements could also give rise to
“whistleblower” actions arising under the federal False Claims Act.

• The FAA should adopt comprehensiv e SMS regulations addressing all participants in the national aviation sy stem that, among other things, clearly divide responsibilities among the various SM S participants; air ca rriers, air traffic control and airport operators.

• The FAA should provide clear guidance fo r risk analysis and standards for requisite undertaking of mitigation. Wher e SMS participants carefully adhere to the FAA’s guidance, such participants should be able to establish the
reasonableness of the actions taken or not taken.

• Rather than require airport operators to assert control over third parties operating at airports in order to u ndertake a SMS program applicab le to the entire airport, The FAA should issue guidance requiring al l parties operating at an airport to participate in or undertake SMS, and cl early divide SMS re sponsibility among
them.

• Airports should be permitted to implement SMS in a phased approach, so that the operational and financial consequences of adoption of a SMS program do not impact airport operators (and rates) all at once, and the airpor t operators have the opportunity to develop an SMS program rationally.

• To the extent possible, FAA should expand the permitted uses of AIP grant funds and PFCs through regulation to cover mitigation of risks identified in SMS analyses, and FAA should work with Congress to amend AIP and PFC eligibility requirements under current law to permit us e of such funds to mitigate risks identified in SMS analyses.

• FAA should work with Congress to provide additional funding throught the AIP (and, if necessary, PFC) programs for mitig ation of risks identified through SMS analyses.

Discussion

A. Legal Issues

Based on our review to date of the legal issues presented by SMS, we have identified three primary areas: (1) the ability to maintain conf identiality of information; (2) potential for a heightened duty of care for airport operators; and (3) depending on the scope of the FAA’s final rulemaking, constraints upon an airport operator’s ability to require its tenants and others doing business at the airport to comply with the SMS program adopted at the airport.

1. Maintaining Confidentiality9

BOST 05-22-09 It has been demonstrated that where data provided is held in confidence, reporting is improved. 2 1 The United States Congress recognized this when it enacted legislation that protects certain voluntarily submitted aviation sa fety or security related information from
disclosure. 2 2 The FAA has implemented Section 40123 through regulations 2 3 and under those regulations, FAA has adopted se veral safety programs, notably including the Aviation Safety Action Program (“ASAP”) 2 4 for air carriers and their em ployees, as discussed below.

ICAO has clearly noted the distinction between what it terms “error reporting” and “hazard reporting”, stating that “error reporting is self-incriminatory and may thus lead to blame and punishment, while hazard reporting is objective and neutral. 2 5 ICAO goes on to note that because of the early emphasis on erro r reporting as opposed to hazard reporting, the protection of reporters has been a hot topi c since the inception of reporting systems. 2 6 ICAO distinguishes between records relating to accident s and serious incidents, where there may be overriding considerations that requi re disclosure of the records for judicial investigations, and records related to voluntary hazard reporting, wh ere there is strong just ification for protection. 2 7 ICAO concludes that a consequence of effective safety reporting “... is that key data is properly safeguarded, and the promotion of a system of checks and balances that ensures that reporters of hazards feel confident that hazard reporting will not be put to uses other than for which it was implemented, operational personnel are encouraged (and rewarded) for provi ding essential safety information related to hazards. However, ther e is a clear line that differentiates between acceptable and unacceptable ope rational performance.” 2 8

21 See, e.g., Aerosafety World , “Rebuilding ASAP”, Feb. 2009, at 42 (“the majority of the information on which such [safety] enhancements now depend would not surface at all if not voluntarily disclosed.” Quoting Independent Review Team, Managing Risks in Civil Aviation: A R eview of the FAA’s Approach to Safety

. Sept. 2, 2008); Id . at 43 (“The [Flight Safety] Foundation and others have estimated that about 98 percent of the safety information obtained from voluntary disclosure prog rams would no longer be available if participants were subject to prosecution and penalties.”)

22 See 49 U.S.C. § 40123(a) (“Notwithstanding any other provision of law, neither the Administrator of the Federal Aviation Administration, nor any agency rece iving information from the Administrator, shall disclose voluntarily-provided safety or security related information if the Administrator finds that – (1) the disclosure of the information would inhibit the voluntary pr ovision of that type of information and that the r eceipt of that type of information aids in fulfilling the Administrator’s safety and security responsibilities; and (2) withholding such
information from disclosure would be consistent with the Administrator’s safety and security responsibilities.”) (“Section 40123”)

23 See 14 CFR Part 193 (Protection of Voluntar ily Submitted Information) (“Part 193”).

24 See FAA Order 8000.82 Designation of Aviation Safety Action Program (ASAP) Information as Protected from Public Disclosure Under 14 CFR Part 193 (“Order 8000.82”)

25 ICAO Safety Management Manual (“SMM”), 2d ed. (draft), § 2.8.23.

26 Id

.

27 Id . at 2.8.24 – 2.8.26.

28 Id . at § 2.8.15(e).10

BOST 05-22-09 It is important to note that there are se veral different types of disclosure of information that may be mandated. As discu ssed below, state and the federal freedom of information acts (“FOIA”) generally mandate th at all information, data, documents and other materials (collectively, “informa tion”) held by a governmental en tity be disclosed upon request,
unless such information falls within one of a very few statutorily enumerated exceptions. 2 9 The other is the legal discovery process. The ASAP program appears to be exempt from disclosure under both the federal FOIA and through discovery, although a federal court in a case involving the August 27, 2006, crash during an attempted takeo ff from a taxiway at Bl ue Grass Airport in Lexington, Kentucky, has passed until trial the question of whether ASAP data submitted before the crash may be admitted at trial. 3 0 In that case, a federal district court judge defe rred until trial a motion calling for the release of the airline’s ASAP reports. 3 1

In addition, the controversy over the recen tly initiated FAA ac tion to protect its
Wildlife Strike Database 3 2 from disclosure pursuant to Sect ion 40123 points out the very real difficulties that lie ahead for any effort to exempt aviation safety information from disclosure. 3 3 The FAA initially sought to make the informa tion submitted to the Wildlife Strike Database confidential, but in the face of significant media and public attention, the FAA elected to make such information public. 3 4 In its comments on the proposa l, Airports Council International concluded that it could not take a position e ither supporting or opposing the FAA’s proposed order, but it noted that if such data are made public, th e FAA should “... pr ovide explanatory information to assist the public and media to use the data responsibly....” 3 5 Interestingly, one reason that many ACI-NA member airports were ambivalent regarding the proposed order was

29 See, e.g. , 5 U.S.C. § 552(a)(3)(A) “... except as prov ided in subparagraph (E), [relating to intelligence agencies] each agency , upon request for records which (i) reasonably describes such records and (ii) is
made in accordance with published rules stating the time, place, fees (if any), and procedur es to be followed, shall make the records available to any person .” (emphasis added). Section 552(b) goes on to state that section 552 does not apply to matters that are listed und er 9 separate listed exceptions, most of which are narrowly drawn, including matters that are “specifically exempted fr om disclosure by statute ... provided th at such statute (A) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld.” (§ 552(b)(3).) Safety information in general is not a specific exception to the federal FOIA, but Section 40123 provides for exceptions to
FOIA.

30 See In re: Air Crash at Lexington, KY , Slip Opinion at 12, July 17, 2008 (E.D. KY) (granting motion to exclude all reference or evidence concerning ASAP reports filed after the crash of Flight No. 5191; passing until trial Comair’s request to exclude all AS AP reports, both before and after the crash.)

31 See Aerosafety World , “Rebuilding ASAP”. Feb. 2009 at 40, 43.

32 See 74 Fed. Reg. at 11698, March 19, 2009.

33 See, e.g.

, USA Today editorial, April 3, 2009; USA Today , “Aircraft hit birds 62% more strikes since ‘90’s”, April 7, 2009.

34 See The Washington Post, April 23, 2009, “LaHood Snubs Plan to Keep Data on Bird Strikes
Secret”.

35 Comments of Airports Council International – North America (“ACI-NA”) -- In the Matter of Notice of Proposed Order Designating Information as Protected from Disclosure, Docket FAA-2009-0245, at p. 7, April 20, 2009.11

BOST 05-22-09 that such airports “... are subject to state and lo cal sunshine laws that require them to provide their locally-coll ected wildlife strike reports to the public already.” 3 6 This example demonstrates both the difficulty in protecting safety data from disclosure and the need for a solution that
addresses both federal and state FOIAs. In orde r to protect any such safety information from disclosure, it is likely that the FAA and other stakeholders, such as airports, air carriers and ground handlers, will need to make a compelling case for such treatment.

The vast majority of commercial servic e airports in the United States must disclose most information (including safety in formation) held by those airports upon request. Almost all commercial service airports in th e United States, including SEA, are owned and operated by municipal or state gove rnmental entities, including inde pendent authorities, that are subject to their state’s FOIA. Furthermore, the FAA is subject to the federal FOIA. 3 7 State
FOIAs are modeled on the federal FO IA, although each state’s act diffe rs in certain particulars. In general, aviation safety information is not an exception to disclosure under state and federal FOIAs, other than the statutorily created exception noted a bove for voluntarily disclosed
information under Section 40123.

The requirement that public airport ope rators provide information on request pursuant to FOIA significantly inhibits most priv ate entities from par ticipation in a voluntary program of self-repo rting safety-related information. In a draft report prepared for the Airport concerning ramp procedure reporti ng, it was noted that both the majority of the airlines and service vendors/ramp operators indicated that th ey had concerns that “any incident that is reported to the Port immediately b ecomes a matters of public record.” 3 8 The purpose of this section is to consider legal means that may be us ed to report and record information in ways that may help protect it from disclosure.

a. Federal Preemption . The ideal resolution of this issue would be for Congress to extend the ambit of Section 40123 to exempt all information gathered under an FAA-approved SMS from disclosure under the federal FOIA, and through preemption, protect
SMS data from disclosure under state FOIAs as we ll. Where a federal st atute or regulation is intended to preempt state law and the agency that promulgated that regul ation acted within the scope of its delegated authority in doing so, a federal statute or regulation can preempt a state’s laws on the same subject. If the FAA is granted the authority to adopt regulations protecting
certain information from disclosure in order to promote safety, and the FAA adopts a regulation that designates SMS data as exempt from disclosure because of the concern that public disclosure may inhibit the prov ision of important safety-relat ed information, such regulation likely would preempt a contrary state FOIA requirement to di sclose that information.

36 Id . at 4.

37 See 5 U.S.C. § 552 (federal FOIA)

38 See Seattle International Airport Ramp Procedur e Reporting prepared by Harold N. Handke, Airport Design & Operations, at Appendix 1.12

BOST 05-22-09 nformation. The information that is made confid ential under Section 40123 is exempt from
disclosure under federal FOIA because it constitute s matters that are “specifically exempted from disclosure by a statute that requires that the ma tters be withheld from the public in such a manner as to leave no discretion on the issue,” and Sec tion 40123 “establishes part icular criteria for withholding or refers to particular types of matters to be withheld.” As Section 40123 only applies to information voluntarily provided to the FAA, however, it is not of much utility to an airport seeking to establish a SMS that is exem pt from the requirements of its state’s FOIA. Similarly, if FAA adopts a requirement that all Part 139 airports implement SMS, as FAA is expected to do, it may not be possible to withho ld SMS data under a state FOIA under Section 40123, as the information arguably is not “volunt arily” provided if it is mandated by federal regulation.

We recommend that airports seek action from Congress to amend Section 40123 to eliminate the requirement that such informati on be voluntarily provided and to expressly limit the information that is subject to disclosure through discovery. Further, we recommend that when the FAA subsequently adop ts regulations promulgating the requirement that airports certificated under Part 139 implement an SMS, th at such regulations expressly exempt SMS data, other than certain narrowly defined data demonstrating violations of law or regulation similar to the ASAP, from disclosure under all st ate and federal FOIAs. However, we are also quite aware that this approach is likely to be met with resistance from several sectors, including the media. In order for such an exemption from disclosure to be approved, it will take strong efforts by multiple stakeholders, demonstrating th e tangible safety benefits that should accrue from a robust SMS program, to convince policy makers that the bene fits of nondisclosure outweigh the desire for transparency. In such an event, there is a strong argument that such federal action would preempt all state laws, incl uding state FOIAs, and protect SMS data from
disclosure.

The FAA is expressly charged by Congress with overseeing aviation safety within
the United States. 3 9 If the FAA adopts regulations pr otecting certain information from disclosure in order to promote safety because of the concern that public disclosure may inhibit the provision of important safety-related inform ation, such regulations likely would preempt a contrary state FOIA requirement to disclose that i

For example, under Section 40123 and Part 193, the FAA has adopted Order 8000.82 exempting ASAP data from disclosure. The FAA found that “disclosure of the information would inhibit the voluntary provision of that type of informa tion. Certificate holders and their employees are reluctant to share sensitiv e safety information with the FAA, including employee self-reports of alleged violations, if such submissions might be subject to public
disclosure.” 4 0 Order 8000.82 continues “A significant impediment to the sharing of ASAP information with the FAA is the aviation industry’s concern over public disclosure of the

39 See, e.g. , 49 U.S.C. § 40101(a) (“... the Secretary of Transportation shall consider the following matters, among others, as being in the public interest and consistent with public convenience and necessity: (1) assigning and maintaining safety as the highest priority in air commerce....”)

40 Order 8000.82 at ¶ 6(c).13

BOST 05-22-09 mandate. There, the court ruled that the federal FOIA and two exemptions thereunder, coupled information and, if disclosed, the potential for it to be used for other than the safety enhancement purposes for which the ASAP was created.” 4 1 Thus, with the excep tion of reports involving possible criminal activity, subs tance abuse, controlled substa nces, alcohol, or intentional falsification, the FAA withhol ds significant amounts of information provided under ASAP, including the employee’s ASAP re port and the content of that re port and the identity of the
certificate holder associ ated with such report. 4 2

In determining whether a federal regulation preempts conflicting state law, courts must determine (1) whether the federal regula tion was intended to preempt state law and (2) whether the agency that promulgated the rule acted within the scope of its delegated authority in doing so. Where a clear conflict between state law and federal regulation exists, such that compliance with both is impossible, courts will analyze the nature and scope of the authority granted to the agency to determine wh ether preemption is appropriate. In ACLU of New Jersey
v. Hudson , a court ruled that an Immigration and Nationalization Service (“INS”) regulation preempted a conflicting New Jersey sunshine law because the INS Commissioner was acting under properly delegated authority in promulgating the rule based on Congress’ plenary power over matters concerning immigration. 4 3 The same result occurred in Brady-Lunny v. Massey

, where the delegated authority to promulgate the rule at issue was based on a less clear

44

41 ).

42

he validity of the regul ation, and it accordingly ruled that the federal regulation m Id . at ¶ 6(c)(1

Id . at ¶ 5(b).

43 ACLU of New Jersey, Inc. v. County of Hudson , 799 A.2d 629, 635 (N.J. Super. Ct. App. Div. 2002). This case involved the United States, who acted as an intervener and appealed a trial court’s order requiring two counties to disclose pedigree data and other specified information pertaining to certain inmates, including those in county care pursuant to cont racts with the INS. The plaintiffs sued alleging that the counties unlawfully refused to make available public records as required by New Jersey’s Right-to-Know Law. Id . The United States argued that an INS “interim rule” barring th e disclosure of the information soug ht preempts state law and forbids the disclosure of the requested information. Id. at 638-39. In overturning the trial court’s decision, the court noted that “federal regulations have the same pre-emptive effect as federal statutes as long as the agency (1) intended to preempt state law and (2) acted within the scope of its delegated authority.” Id. at 646 (internal citations and quotations omitted). The court found a clear conflict between state laws that mandated disclosure of the information and the federal regulation that prohibited its disclosure, warranting a preemption analysis. Id. at 646-47. The court next noted that “a federal agency may preempt state law only when and if it is acting within the scope of its congressionally delegated authority.” Id. at 647. To make this determination, courts must “examine the nature and scope of the authority granted by Congress.” Id. “Where Congress has directed an administrator to exercise his discretion, his judgments are subject to judicial review only to determine whether he ha s exceeded his statutory authority or acted arbitrarily.” Id. (internal quotations and citations omitted). Using these principles, the court found that Congress has exclusive jurisdiction over immigration and that the regulation was promulgated by the Commissioner of the INS under appropriately delegated authority. Id. at 650. The court concluded that none of the arguments advanced by the plaintiffs detracted from t ust preempt state law. Id. at 655.

44 Brady-Lunny v. Massey , 185 F.Supp.2d 928, 929-30 (C.D. Ill. 2002). In this case, a reporter from an Illinois newspaper sent an Illinois Freedom of Information Act (“Illinois FOIA”) request to the county sheriff asking for various information about prisoners in the sheriff’s custody. The sheriff provided the information with respect to state inmates, but not as to federal inmates. Id. at 930. The United States th en intervened and also refused to accede to the Illinois FOIA request because the Federal Bureau of Prisons ha s a prohibition on di sclosing lists of
federal inmates. Id. The court noted that the Illinois FOIA speci fically exempts from disclosure information14

BOST 05-22-09 b. Working Within FOIA with a regulation validly promulga ted by the Federal Bureau of Pr isons prohibiting disclosure of certain information, preempted an Illinois sunshine law. Like the INS and Bureau of Prisons regulations, an FAA regulation prohibiting the disclosure of certain safety and security information collected by airport operators in connection with a mandatory safety program should
be deemed to be a valid exercise of authority.

. Without obtaining statutor y authority that protects
SMS data f

i. Reporting ro m disclosure under federal and state FOIAs, there are steps that an airport that adopts a SMS can take to encourage reporting and protect certain information from disclosure. Generally, these steps are taken in the way that information is reported, and in the way that information is recorded. Each airport shou ld develop clear standa rds for both reporting and recording SMS data in a manner that will protect su ch data from disclosure to the greatest extent possible.

. The manner in which inform ation is gathered for an airport’s SMS

One method of reporting that serves to reduce disclosure is providing for

(1) Anonymous Reporting da tabase can be established both to minimize the information gathered – so that certain information that parties would prefer not be disclosed is not gathered and thus cannot be subject to disclosure – as well as to encour age reporting. We recomm end that reporting of safety-related information under an airport’s SMS be standardized pursuant to policies and procedures adopted by the airp ort operator as part of its SM S program. Those standards can address both the types of information that sh ould be provided and the manner in which the information is provided. Just as importantly, the policies and pr ocedures should clearly state the types of information that should not be reported.

anonymous reporting. Another is to set up reporting processes that do not require that certain types of identifying data be provided. The cr ucial issue is that unde r FOIA, it is only the information held by the governmental entity that must be disclose d. Thus, if certain information is intentionally not obtained, it will not be available for disclosure.

. A system that permits information to be reported anonym

One drawback to anonymous reporting is that it can be difficult to investigate the
issue and follo ous ly, such as through a telephone “tip line” or by other anonymous communication, can lead both to increased partic ipation and will avoid identification of the reporting person. It has been shown, as discusse d below, that where a reporting program is nonpunitive, participants are more likely to provide more and better information. Similarly, where persons are concerned a bout protecting their identity, an a nonymous tip line can provide the ability to report safety-related in formation, without the identity of the reporter being disclosable.

w up with those submitting reports. However, many health care institutions have implemented anonymous reporting systems that have been integrated within the institution’s

prohibited from disclosure by federal or state law or rules and regulations. Id. at 931. The court’s analysis then turned on the validity of the Bureau’s regulation that prohibits disclosure of federal inmates. Id. Without much analysis, the court ruled that the federal FOIA and two exem ptions thereunder applied to the information and that the Bureau’s regulation was valid; therefore, the information was protected from disclosure. Id. at 932.15

BOST 05-22-09 ethics and compliance program st ructure, thus creating a framework for improved reporting and accountability.

(2) De-Identification of Information . Another method of reporting and recording information that avoids FOIA requirements is to “de-identify” certain information when it is reported. For example, rath er than requiring that the name of an airline
whose aircraft was involved in an incident be reported, the SMS program would simply require that the incident be described, wi thout specifying names of participants. A drawback to such a system is that it is harder to develop trend analys es tied to a specific identifier, such as the name of an airline or fixed base operator. As a co mpromise, certain neutral identifiers can be used, such as the area of the airport the incident occu rred (either on a grid basi s or by gate or other similar basis), but these identifiers are themselv es disclosable and can lead to identifying the parties involved in at least some incidents.

ii. Recording . As noted above, not only can the manner in which information is reported be set up so as to protect certain information from disclosure, the way
information is recorded can also be established in such a manner as to protect information. As described above, “de-identification” of information when it is repo rted or when it is recorded will prevent collection of and maintaining certain identifying information. Similarly, it may be possible to arrange for information to be held by a third party not subj ect under the applicable FOIA. Such third party hosting of information is often performed for health care institutions, not because of FOIA concerns, but to maximize efficienc y. In the airport context, however, if data is provided directly to a third part y not subject to FOIA, in certa in cases it may be possible to prevent the disclosure of that information unde r FOIA. There are seve ral drawbacks to this approach, however. The first is that the federal FOIA was recently amended to include information gathered on behalf of a federal ag ency by a third party as information subject to
FOIA. 4 5 It is likely that many, if not all, state FO IAs will follow this lead at some point, thereby mooting this potential means for avoiding disclosu re. Second, once the airport accesses the third party’s database, the information that is delivered to the airport becomes subject to applicable FOIA. Thus, it may be desirable to establish de-i dentification protocols fo r all data provided to or drawn from such a third party host.

iii. Privilege . A final source of confidentia lity is privileges and other legal requirements prohibiting disc losure. For example, materials subject to the attorney-client privilege are generally not subject to disclosure under state and federal FO IA. Similarly, security sensitive information, or “SSI,” as defined in 49 U.S.C. § 1500, et seq ., may not be disseminated except to those with a need to know without permission of the Transportation Security Administration (“TSA”). However, these sources of confidentiality will apply only to a limited

45 See 5 U.S.C. § 552(f)(2) (“ ‘record’ and any other term used in this section in reference to information includes – (A) any information that would be an agency record subject to the requirements of this section when maintained by an agency in any format, including an electronic format; and (B) any information described under subparagraph (A) that is maintained for an agency by an entity under Government contract, for the purposes of records management.”) added by Pub. L. 110-175, Sec. 9 (Dec. 31, 2007).16

BOST 05-22-09 range of data, and courts often read these exceptions narrowly in favor of disclosing materials, with privileged or prohib ited materials redacted.

c. Alternatives to Reporting . Instead of gathering data from third parties such as airlines and fixed base operators (“FB Os”), we recommend that the FAA instead require that these third parties also be required to undertake SMS programs (or that airline programs include third party providers of se rvice to the airlines). In such an event, the data reported by such other parties ideally would be de-iden tified, aggregated, and ma de available to all participants in the FAA’s SMS programs, so that airport operators, among others, could access safety hazard data relating to their airport, as well as generally, to assist in risk analysis and mitigation.

In the alternative, another option ma y be to rely on programs established by others, such as the International Air Transport Association (“IATA”), which has established the International Air Transport Asso ciation Operational Safety Aud it (“IOSA”) program for member airlines and the ICAO Safety Audit Guidelines (“ISAGO”) for FBOs and other ground handlers. While all air carriers and third pa rty handlers are not required to comply with IOSA or ISAGO, respectively, it would likely be reasonable for airport operators to require FBOs to comply with ISAGO as part of the minimum standards for opera tion at an airport, and to provide certain benefits, such as reduced fees or other “carrots” for airlines that are IOSA certified. 4 6

2. Potential Liability Issues

.
Airports that implement a SMS may height en their risk of lia bility. Through the process of developing a gap analysis and ranki ng potential safety threats, airports may be increasing their risk of liability for negligence – or even recklessness - where a threat to safety is identified, but not promptly mitigated. This issue is of lesser concern to an airport operator where a substantial safety threat is located within an area not subject to the control of the airport operator, but even in that case, there may be a du ty to warn the entity controlling such space and, as landlord, the airport operator may have a duty to attempt to mitigate any such identified threats. Further, failure to comply with th e SMS regulations, when promulgated by FAA, could give rise to a federal Tort Cl aims Act whistleblower action.

a. Negligence . Liability for negligence arises when a party owes others a duty to conform to a standard of conduct for the protection of others from unreasonable risk, and that party breaches that duty, resulti ng in injury or damage to another. 4 7 In addition, negligence
has been found where a risk has been identified a nd where there is an unr easonably great risk of causing damage or injury, and the identified risk is not mitigated. 4 8 In such cases, the general

46 Note that under FAA regulations, it is unlikely that an airport may prevent an air carrier from operating at the airport without a SMS in place. However, an airport may jus tly discriminate between those carriers with SMS and those without by providing certain incentives.

47 See Prosser & Keeton on Torts , 5 th ed., § 30, pp. 164-165 (1984).

48 Id . at § 31, pp. 169.17

BOST 05-22-09 legal standard is whether a reasonable pers on would have mitigated the identified risk. 4 9 If a reasonable person, as determined by the fact find er (generally, the jury ) would have undertaken steps to mitigate the identified risk, then the party that failed to mitigate such a risk will generally
be found liable to the person injured.

Thus, implementation of SMS could lead to increased like lihood of liability because the process identifies otherwise unknown risks and quantifies the potential impact of such incidents. By being on notice of these ri sks through a SMS analysis, an airport operator arguably has a duty to persons at the airport (including, for example, airport tenants, those doing business at the airport and travelers) to take all reasonable steps to mitigate the identified risk. If the SMS analysis had not been performed, the lack of knowledge of a risk, and thus failure to mitigate it, could be a defense.

The obvious response to this concern is for airports to mitigate risks as they are identified through SMS, and that is certainly one of the goals of SMS. Howeve r, inherent in the SMS process is judgment regarding th e likelihood that a given risk wi ll result in an incident and regarding the potential seriousness of the consequences of such an incident. Further, many mitigation alternatives will require a cost-benefit analysis. If the risk is remote, the potential for injury low and/or the cost to mitigate the risk is high, an air port may choose not to mitigate a given risk. In such a case, in the unfortunate ev ent that the identified ri sk leads to an accident, there will inevitably be second guessing of the decision not to mitigate that risk, and evidence will exist that the airport was both aware of the risk and chose not to correct it.

As noted above, the simple solution is for an airport operator to mitigate all risks that are identified. However, that alternative will not always be po ssible. It is also likely that over time, the identified risks that have not b een mitigated will become fewer as the airport operator undertakes mitigation measures. Accord ingly, it is likely that the greatest costs associated with undertaking mitigation measures w ill be in the early years of implementation of a SMS (or application of a SMS to a new area of an airport, if the program is phased in). Thus, airports that adopt SMS (and onc e FAA requires implementation of SMS, this will be universal) will need to commit adequate resources not only to undertake the SMS program itself, but to mitigate the more significant risks that are identified.

To the extent that the FAA provides gui dance regarding which risks must be mitigated and which risks may be addressed through other means, the FAA’s standards will provide strong evidence of reasonableness. Furthermore, to the extent that the FAA develops consistent standards for rating risks and quantifyi ng those risks that must be mitigated versus those risks that are acceptable, ai rports will be able to obtain some protection from liability where the airport acts consistently in accord w ith the FAA’s guidance. As noted above, SMS is not intended to lead to mitigation of all identified risks, it is intended to be used in a manner similar to a cost – benefit analysis. Risk cannot be eliminated, onl y managed. Accordingly, ICAO defines “safety” as “... the state in which the possibility of harm to persons or of property

49 Id

.18

BOST 05-22-09 damage is reduced to, and maintained at or be low, an acceptable level through a continuing process of hazard identifica tion and safety risk management .” 5 0

With respect to risks that are determined to be remote or that present low risk of harm, airports will need to be rigorous in their analysis and maintain careful records regarding their analysis and any changes in the determination that may be warranted, in order to
demonstrate the reasonableness of the decisi on not to undertake mitigation measures. In addition, to the extent that the airport’s SMS includes a clear process for categorizing risks and the airport operator demonstrates a clear practice of mitigating risks determined to be above the threshold established in the SMS, the airport operator will help demonstrate its reasonableness. Conversely, where an airport op erator demonstrably fails to mitigate identified risks in
accordance with its SMS or otherwise fails to adhe re to the policies and provisions adopted in its implemented SMS, it is much more likely that such an operator will be found to have acted unreasonably and be held liable where an identified risk results in injury.

Mitigation of hazards in areas not subject to an airport operator’s direct control can be addressed through strong lease (or other agreement) provisions that mandate that if a hazard is identified by the airport operator or th rough SMS within an area subject to a tenant’s control, the tenant must promptly mitigate that h azard if directed to do so by the airport operator. Such an agreement should also contain a st rong self-help provision permitting the airport operator to take such steps as may be necessary in the judgment of the operator to mitigate any
such hazard if the tenant does not do so in a reasonable period of time, and allowing the airport operator to charge the cost of su ch measures back to the tenant.

b. Recklessness . A heightened form of liability for negligent acts is so-called
“reckless” or “willful or wanton” conduct, which is action that “is so far from a proper state of mind that it is treated in many re spects as if it were so intended.” 5 1 The usual meaning of these
terms is that an actor has inten tionally done an act of an unreasonable character in disregard of a known or obvious risk that was so great as to make it highly probable that harm would follow, usually coupled with a conscious indifference to the consequences. 5 2 This can also be stated as an extreme departure from ordinary care in a situation where a high degree of danger is apparent. 5 3

One of the hallmarks of the commercial aviation industry is that, despite the potential dangers of flight, the industry has adopted a safety cu lture that has resulted in an outstanding safety record. Ne vertheless, the conseq uences of failure to maintain a safe environment at an airport ca n be catastrophic. By adopti ng a SMS program, claims for recklessness could arise where a risk analysis demonstrates that a ha zard had a significant potential for occurring and for causing serious in jury or death, and the airport operator chooses

50 See ICAO SMM (draft), § 2.2.4.

51 Prosser & Keeton on Torts , 5 th ed., § 34, p. 213.

52 Id

.
53 Id . at 214.19

BOST 05-22-09 not to undertake measures to remedy such hazar d, or potentially, where the operator postpones taking remedial action, and the foreseen hazard o ccurs, resulting in serious injury or death. To the extent that failure to remedy such a hazard was an extreme departure from ordinary care and the risk analysis demonstrated that it was hi ghly probable that harm would follow from such a hazard, an airport operator could be faced with an action alle ging reckless conduct. Where a fact-finder finds that such conduct was, in fact, reckless, the consequences to the airport operator can much more severe, resulting in higher fi nancial judgments and, depending on the terms of the policy, lack of insurance cove rage. As suggested above, airports will need to closely monitor the SMS risk analysis process and, when significant risks are identified, air ports will need to act promptly to mitigate those risks.

c. False Claims Act Actions . The vast majority of U.S. airports receive federal grant funding under the Airport Improvement Program (“AIP”). All recipients of AIP grant funds must enter into a grant agreement w ith the FAA that includes a long list of grant assurances, including assuranc e numbers 19 (operation and maintenance) and 20 (hazard removal and mitigation). If an airport operator fails to undertake a SMS program or otherwise comply with the regulations promulgated by FAA relating to SMS, it is possible, especially where an incident or accident gives rise to personal injury, death or property damage, that a claim could be asserted against the airport opera tor under the federal False Claims Act for breach of the AIP grant agreement through failure to comp ly with the airport’s grant assurances. In contrast, demonstrated compliance with the FAA’ s regulatory requirements and adherence to an airport’s adopted SMS should help an airport operator demonstrate full compliance with these

assurances.

3. Regulation of Tenants and Others Doing Business at the Airport

.
As is discussed briefly above, one of the f undamental issues that will confront an airport implementing an SMS is how broad its scope will be. If the FAA implements regulations requiring that all participants in the commercia l aviation system, including airlines, air traffic control and airport operators, unde rtake separate, integrated SMS programs, and if the FAA also provides concrete guidance that identifies the boundaries of each of the participants’ responsibilities, it is lik ely that it will be signi ficantly simpler for airport operators to regulate their tenants and others engage d in operations at their airpor t. However, absent such a comprehensive approach to SMS or the FAA’s failure to adequately separate SMS responsibilities, airport operator s will have to determine the pr oper scope of their SMS program, including determining whether to require that tenants and others participate in some way. Thus, the breadth of an airport’s SMS may include both its geographic reach (i.e., whether or not to
include landside as well as airsid e operations, and with respect to airside, whether all operations or only selected areas will be included within the ambit of the SMS), and the scope of those persons and entities that will be expect or encour aged to provide information for inclusion in the airport’s SMS database. This section of the me morandum considers issues related to an airport operator’s decision to extend its SMS to include its tenants and their operations, and the legal issues presented by such a decision.

In general, the airport operator owns a nd controls the airport and thus has the ability to order its relationship with its tenant s and others permitted to operate on the airport20

BOST 05-22-09 through several different means, including agr eements voluntarily entered into between the operator and its tenants and service providers, as well as through adoption of minimum standards and/or airport-wide rules, regula tions and directives. However, there are certain legal limits to the requirements that an ai rport operator may impose upon such entities. These include constitutional limits on the impairment of existing contracts, limitations on the ability of a third party to regulate labor arrange ments, and FAA requirements that prohibit unjust discrimination.

a. Agreements . In general, two parties are fr ee to enter into a contract that would include all of the terms of a SMS, such as analyzing systems or activities of the tenant, identifying hazards and risks relating to such systems and activities, including requiring reporting by airline employees, and mitigating the risks identified. Thus, use of agreements, such as an airport use and lease agreement or st andardized agreements with ground handlers, is likely the best way to achieve c onsistent and full compliance with an airport’s SMS as it relates to third parties. In addition, an agreement can provide for the recurring follow up reporting and analysis that is necessarily a significant part of SMS. Only where an agreement breaches a provision of law could it be voi ded. A final benefit of using agreements for establishing the terms of SMS interactions with third parties is th e ability to use incentives as well as penalties to encourage cooperation with contract ual provisions. As long as su ch incentives are offered in a not unjustly discriminatory manner, airports may use “carrots”, such as reduced fees or more liberal terms, in conjunction with traditional “s ticks”, such as events of default or monetary penalties, to encourage tenants and other third parties to comply with contractual terms or to achieve other goals, such as b ecome IOSA or ISAGO-certified.

Nevertheless, certain provisions of an ag reement may not be easily enforced or monitored, such as requiring repo rting of hazards or incidents that occur only between tenant employees within a tenant’s leasehold. There are several additional dr awbacks to the use of agreements as the primary way to implement a wide-ranging SMS program, however. The first is that many, if not most, airports enter into agre ements with a term of years. Thus, at any given time, the airport may be in a position to negotiate a new agreement with certain of its tenants, but it is often difficult to negotiate all of the relevant agreements within a short period of time. The second is that agreements are generally the su bject of negotiation, rather than imposed upon, the counterparty. Thus, achieving consistent terms can often be difficult, especi ally in the context of an issue that can be as sensitive as SMS, as di fferent parties will have different concerns, and leverage, and likely seek to address cert ain key issues in different ways.

b. Minimum Standards . The FAA recommends th at all airport operators adopt minimum standards that se t a threshold for the requiremen ts for operating at the subject airport. Often, different mini mum standards are adopted that apply to different types of operations, such as commercial service air carrier s, all-cargo carriers, FBOs, limited service providers and the like. Generally, minimum standa rds are applied either as a regulation adopted by the airport operator, or as a pre-condition to operation at the airport. For parties other than airlines, minimum standards can be an effective way to provide for a unif orm set of requirements and standards that must be met in order to be gr anted the privilege of operating at an airport. Where, however, a pre-existing agreement incorpor ates minimum standards, as modified from time to time, into the agreement, problems can arise if such minimum standards seek to impose requirements that may interfere with a third part y’s other obligations, su ch as the terms of a21

BOST 05-22-09 collective bargaining agreement. Thus, minimum standards are often most effectively used as a floor, with which a service provider must comply in order to commence operations at an airport. Application of minimum standards to an entity already operating at an airport can create problems, either where the current operating agreement does not expressly incorporate
amendments to the minimum standards in effect at the time the agreement was entered into, or where, even if incorporated, such amendments conflict with other re quirements binding upon the operator. In addition, it can be difficult, if not impossible, under federal aviation law and regulations to justify applicatio n of minimum standards to exclude an air carrier from operating at an airport, although the manner in which a ca rrier operates may be re gulated though minimum
standards.

c. Regulations . The third common means of regulating tenants and others operating at an airport is the adoption of regula tions. The primary advantages of the use of regulations to order behavior are that the te rms and conditions will be uniform among all regulated entities, and the airport operator, whic h is a generally a governmental entity, often has punitive power to enforce such regulations, such as the imposition of fines or, in some cases, even criminal penalties for violations. The disa dvantages to the use of regulations are that the process for adopting a regulation can often be cumbersome and time-consuming (although negotiating multiple agreements can be even more difficult), and the prohibition under the United States Constitution of the adoption of la ws and regulations that would abrogate an existing contract. Thus, regulati ons may not be enforced which w ould retroactively seek to alter certain contractual provisions already in force be tween an airport tenant or service provider and another party, such as collectiv e bargaining provisions. One wa y to avoid the time-consuming regulatory process may be for an airport to issue an “airport di rective”, which is often a short term mandate issued by the air port’s Director of Aviation to a ddress an operational, safety or security issue.

B. Just Culture and Safety Management Systems

.

1. Nonpunitive Environment and a Just Culture

A critical and fundamental co mponent of any safety plan is the expectation that errors will be reported so that the organi zation can compile information, analyze data, communicate trends, and develop tools for resolvi ng events and ultimately implement procedural and systematic change. It is therefore imperativ e to the success of any safety program that the organization’s management style in dealing with error ensures that there are no reprisals and no impediments to information flowing freely to management and leadership. 5 4 Reporting will not occur if staff believes they will be punished for doing so. In fact, punishing employees for making a mistake emanates from the misconception that the individual is to “blame” for his or her mistake and that punishment will lead both to improved performance in that individual and
serve as a deterrent to error in others. Abundant evidence in human factors and cognitive

54 See, e.g ., M. Meaney, Error Reduction, Patient Safety and Institutional Ethics Committees , 32 Jour. of Law, Medicine & Ethics, No. 2, pp. 358 – 362 (comparing “Safety Culture” to a Culture of Blame”).22

BOST 05-22-09 psychology literature recognizes that most human errors are symptoms of underlying system failures, not personal failures.

The healthcare industry looked to aviati on safety models in order to improve patient safety and found that av iation industry leaders “consider safety to be the dominant characteristic of organizational culture”. 5 5 Over the past decade, the healthcare industry has diligently worked to transform its organizational cu lture to shift toward a patient safety culture. Just as the healthcare industry studied the aviation and energy industries to improve patient safety, airports and other participants in the avia tion industry can learn from the great strides that the healthcare industry has made in successfully adopting a widespread patient safety culture.

In the healthcare industry, patient safety necessitates that orga nizations attain a “just culture,” which is an atmo sphere of trust where people are encouraged and even rewarded for providing safety-related information, but which is also clear about where the line must be drawn between acceptable and unacceptable behavior. 5 6

With the significant emphasis on patient safety, the healthcare industry can now provide models for the aviation industry. In orde r to develop an effective patient safety culture, healthcare organizations strive to achieve th e following characteristics of a blame-free environment, wherein the organization:

● embraces the concept that those under its employ or who practice in its facility do not purposely seek to create errors, rather, that most errors
occur as a result of ine ffective, improperly design ed, or flawed systems;

● seeks to develop human resource pol icies and procedures that support the
realization that most errors are not the result of indi vidual failure, but system failure;

● develops ways to rewar d, rather than discourage, reporting of errors or patient-safety concerns;

● celebrates success at improvement in the reporting of patient-safety concerns and errors, as we ll as how such disclosure has been used to make improvements in systems to prevent the future possibility of error;

● purposely works to alter its mindset about errors and its behavior with respect to errors, possibly by changing the language it uses to talk about patient safety and errors;

● seeks to engender an environment wher e reporting about errors and patient safety is the norm, by actively creatin g an environment where practitioners

55 Id . at 361.

56 J. Reason, Managing the Risks of Organizational Accidents (Ashgate Publishing Ltd., 1997).23

BOST 05-22-09 and employees do not fear retribution for raising concerns or reporting errors; and

● implements methods of feedback to learn from error.

In the healthcare industry, it is ideal th at error reporting ta kes place through an established reporting system suppor ted by policies and procedures that are endorsed by the governing board and communicated to staff. The reporting system adopted should be clearly articulated to staff and include a description of which events are reportable, the time frame within which they are to be reported, and a readily available, easy-to-use format/form that is universal throughout the organization. The reporti ng system also should allow for feedback to
clinicians and staff on the risk-r eduction efforts made by the organization in response to reported

events.

JCAHO, the hospital accreditation agency, expressly recognizes that the leaders of an organization are responsible for setting the t one such that internal reporting occurs within a system where there is “minimalization of indivi dual blame or retribution for involvement in a
medical/health care error.” 5 7 While JCAHO does not require an amnesty policy for accredited providers, many patient-safety experts recommend a policy that allows staff to come forward and report errors as required by the organization and face no direct impact on their employment for doing so.

This is not to say that an organizati on that adopts a just culture eliminates individual or organizational acc ountability. Organizations can and should adopt a disciplinary
model that centers on accountabil ity and integrates the notions of individual and organizational culpability (e.g., human error, negligence, recklessn ess, and intentional act s) with the type of error (e.g., rule-based, skill-based, or knowledge-based). 5 8 To determine whether a particular behavior is culpable enough to involve disciplinary action, the di sciplinary policy should require that each safety event be assessed individua lly. The disciplinary decision-making model many healthcare providers select is base d on staff risk-based behavior th at incorporates the concepts of the civil tort liability system (i.e., negligence, gross neglig ence or recklessness). The threshold for discipline is generally determined to be ne gligence where the staff member had no conscious disregard of a known risk; instead, the staff me mber should have known, but was unaware, of the risk he or she was taking. Gross negligence or re cklessness should result in disciplinary action to deter intentionally unsafe acts. ( Excerpt taken from Patient Safety Handbook , June M. Sullivan, JD, Med OT/L, MT (ASCP) and Renee H. Martin, JD, RN, MSN).

It is widely recognized that implemen ting a just culture necessitates the full involvement of all levels of the organization, as well as education and training of all levels of

57 Revisions to Joint Commission Standards in Support of Patient Safety and Medical/Health Care
Error Reduction (JCAHO 2002).

58 See generally D. Marx, Patient Safety and the “Just Culture”: A Primer for Health Care

Executives (Columbia University 2001); J. Reason, Managing the Risks of Organizational Accidents (Ashgate Publishing Ltd. 1997).24

BOST 05-22-09 management and leadership. Counsel must work closely with human resources to ensure that applicable personnel policies address corrective a nd remedial actions that address individual and organizational process weaknesses.

2. Safety Management Systems: Patient Safety and Quality Improvement Systems in
Healthcare

The Patient Safety and Quality Improveme nt Act (“PSQIA”) became effective on January 19, 2009. 5 9 Congress’ goal in enacting PSQIA was to create opportuni ties for providers to share patient safety information with independent entities, called patient safety organizations (“PSOs”), which can analyze and aggregate patient safety data from multiple providers and use it to identify patterns that suggest underlying cause s of patient risks and hazards. To encourage providers of healthcare services to share potentially sensitive information, PSQIA made particular information shared with PSOs, known as patient safety work product (“PSWP”), both privileged and confidential. The final Rule enacts the framework by which the government will certify PSOs, clarifies the scope of privilege an d confidentiality granted to PSWP, and describes how the government will enforce compliance with these provisions. 6 0 PSQIA and the concepts it embodies could serve as a template for the coll ection, protection, aggrega tion, and analysis of
sensitive SMS data.

59 Pub. L. 109-41, 42 U.S.C. §§ 299b-21 – 299b-26

60 42 CFR Part 3.25

BOST 05-22-09 C. Recommendations for FAA’s Proposed Regulations

.

1. Recognize Need to Protect SMS Data . As discussed above, if information collected as part of a SMS is protected from disc losure, it is likely that there will be more and better reporting of safety-related information. Ideally, Section 40123 will be amended, perhaps as part of the next FAA reauth orization legislation, to permit SMS information to be maintained in confidence, expressly not subject to either state or federal FOIA s. However, absent such an amendment, it may be possible for FAA to a dopt regulations protecting SMS data from disclosure and for airports to develop systems that adequately protect SMS information from
disclosure. For the reasons st ated above, we recommend that th e FAA seek to develop its SMS regulations to permit such protection.

Absent Congressional action, such a syst em likely would have several parts. First, we urge the FAA to a dopt regulations which would pr otect sensitive SMS information from disclosure to the greatest extent possible. Second, the F AA’s rulemaking should divide the responsibility for developing a nd providing SMS information among the various parties subject to the FAA’s regulatory authority: air carriers, ai r traffic control and airport operators. SMS information should be de-identified, to the greatest extent possible, before transmittal to the FAA. Rather than providing SMS data directly to the FAA, it may be better for a private, third party to hold such data and to aggregate it. Thus, the FAA and all participants in the SMS programs would be able to access and analyze a rich store of national data. In addition, the participants would be able to use the SMS data collected from their own operations for analysis and trending. Although it is probable that most airports will not be able to protect the SMS information that they gather from disclosure under their state’s FOIA, if SMS responsibilities are divided among the various entities operating at an airport, the pr ivate entities will be able to preserve the confidentiality of their SMS data, while the public entities should be able to establish a SMS data-collection process that de-ide ntifies that data before it is entered into the
database.

2. Make SMS Reports to FAA Non-Punitive . Similar to the ASAP program, we recommend that SMS information provided to FAA not result in punitive action unless such
information demonstrates that certain identified laws or regulations have been violated. As discussed above, non-punitive reporting programs have been shown to lead to better and more complete reporting. The goal of SMS should be to encourage the de velopment of a robust system for reporting and analyzing safety-related information and the mitigation of identified risks. Thus, to encourage all participants in the SMS programs to undertake these programs fully, the reported SMS information should not be used to penalize airpor t operators, or other participants in SMS.

3. Allow SMS Data to be Aggregated . As noted above, we recommend that all SMS information provided by various pa rties, including air port operators, air carriers and air traffic control, be provided to a single source and aggregated and that all SMS participants be given access to and the ability to analyze the data. This will likely require that the FAA’s rulemaking also specify a format for reporting such data so th at it will be reported in a consistent manner and can be accessed and analyzed by mul tiple participating parties.26

BOST 05-22-09 4. Establish Criteria for Risk Analysis and Mitigation . To assist airport operators (and others required to undertak e SMS programs) in developing consistent methods for risk analysis and approaches for mitigation, we re commend that the FAA provide clear guidance setting forth the criteria for ranking the risks associated with identified hazards and specifying the minimum rating when risks must be mitigated and ratings below which mitigation is either not required or is at the discretion of the ai rport operator. Although such criteria will not eliminate the risk to airport operators posed by an action for negligence arising from an accident caused by an identified but unmitigated risk, su ch a consistent approach should provide a standard of reasonableness so that, if such stan dards are adhered to by ai rport operators, should provide significant protecti on from negligence actions.

5. Allow for Phased Implementation . We recommend that SM S be phased in three ways: first, as to the areas of each airport which must be subject to SMS, second, with respect to the airports themselves, and third, with respect to the elements of SMS itself. Thus, we would recommend a different, more aggr essive, schedule to implement SMS for large hub airports that have more resources, and pose greater risks simp ly due to more operations, than for small hub airports. We also recommend that the rulema king permit airports to adopt SMS in phases, beginning with the safety statement and identific ation of the senior sa fety staff person, and proceeding through the other steps necessary to establish a complete SMS. Finally, we recommend that airport operators be permitted to undertake the SMS hazard and risk analysis for one aspect of the airport prior to under taking this process for the full airport.

6. Coordinate Airport SM S with Other Programs . As noted above, we recommend that the FAA issue simultaneous SMS regulations for all participants in the commercial aviation system regulated by the FAA and that these regula tions provide very clear guidance with respect to the boundaries among each of these participants ’ responsibilities. Thus, for example, an airport operator’s SMS program could cover th e operations on common apron areas up to the point where aircraft are handed off to the airport’s control to wer, while the control tower’s SMS would cover operations on the portions of the ai rport over which the control tower exercises control, including taxiways and runways, and air carriers’ SMS would apply to operations within the ramp areas controlled by the carrier. Of course, there will be overlap between the areas covered; for example, an airport operator likely should be responsible for hazard identification, risk analysis and mitigation relating to matters under its control, such as pavement condition, while air traffic control may be responsible for hazard identification, risk analysis and mitigation of operational matters on the same pavement areas . Further, mitigation of risks likely will require cooperation and coordination among the va rious entities. For example, an operational risk identified by air traffic cont rol may require the airp ort operator to undertake a capital project to mitigate the risk. We strongly recommend th at the FAA engage in a dialog regarding the proper allocations of res ponsibility and means of coordination with the affected entities during the rulemaking process.

7. Make Funds and Guidance Available . As noted in the discussion above, through the process of hazard identif ication and risk analysis that are at the heart of SMS, it is very likely that following the initial adoption of SMS, there w ill be risks identified that require mitigation, and at least some of these mitigation actions will require an infusion of capital, either to
construct or reconstruct faciliti es required to mitigate identifie d risks or to undertake programs27

BOST 05-22-09 and develop processes to mitigate identified risks. We recommend that, to the greatest extent possible, the FAA’s rulemaking make such mitiga tion measures eligible for funding with Airport Improvement Program (“AIP”) grants and with pa ssenger facility charges (“PFCs”) and, further, we recommend that FAA seek significant additional AIP funding from Congress for such programs, especially in the early years after adoption of SMS, when it is likely that the most active mitigation measures will be undertaken.

Finally, we recommend that the FAA conti nue to provide guidance, through seminars, studies and outreach, on the development and impl ementation of SMS. Given the wide variety of configurations of airports, of the types of operations at airports and of the airports themselves, there can be no “one size fits all” approach to SMS. Thus, each airport operator will have to develop a SMS that fits the needs of its airport. As it has to date, FAA can provide guidance and help disseminate information regarding all elem ents of SMS as well as continue to sponsor research projects to further deve lop a variety of “best practices” for use at the wide variety of airports in the United States.

Conclusions

Implementation of SMS has the potential to be a significant step forward in promotion of aviation safety and is likely to re sult in lives saved, fewer personal injuries and reduced property damage. However, SMS also has the potential for increasing exposure for those entities forced to adopt SMS. Thus, caref ul consideration should be given to the design and implementation of the regulations and re lated systems that will comprise the FAA’s integrated SMS for airport operators, air carriers a nd air traffic control, so that the objectives of SMS can be achieved while minimizing additional exposure and unnecessary costs. Airports and other participants in the aviation industry shou ld closely monitor and become involved in the FAA’s rulemaking process for SMS, and airports s hould exercise care in development of their SMS programs in order to address the legal issues described above.

SMS will be most beneficial when a wide range of information and data are reported and made available, so that all applicab le hazards are identified, risks analyzed and, if appropriate, mitigated. In order to encourag e reporting, data gathered under SMS should be protected from disclosure, to the greatest extent possible, and de-identified and aggregated in a manner that allows multiple partie s involved in the air transporta tion system to access such data for appropriate analysis and action. Ideally, Congress will amend 49 U.S.C. § 40123 to permit FAA to exempt from all disclosure under state and federal FOIA data provided under an SMS, except where there has been a breach of law or regulation. We believe th at airports and other
members of the aviation indus try should advocate for legal pr otection of SMS data from
disclosure.

Because implementation of SMS program s will heighten aw areness of certain risks related to aviation safety, those entities participating in the SMS programs will face increased exposure for negligence (and potentially, othe r) claims in the event of an accident. To appropriately minimize such exposure, FAA can and should take several steps. First, FAA should clearly divide responsibilit ies among the various SMS particip ants; air carriers, air traffic control and airport operators. Second, FAA should provide clear guidance for risk analysis and28

BOST 05-22-09 for the requisite undertaking of mitigation, versus elective mitiga tion. Airport operators should establish compliance programs and carefully adhere to the FAA’s guidance. Through compliance with the FAA’s guidance, airports shoul d be able to establish the reasonableness of the actions taken. Accordingly, when incidents do occur that we re foreseen through the hazard identification as being possible bu t were determined thro ugh properly undertaken risk analysis as being either unlikely to occur or if occurring, unlikely to result in serious inju ry or property damage, it can be demonstrated that is was also reasonable not to take action to mitigate such identified hazards. Finally, Airports should strongly advocate that Congress and the FAA expand the permitted uses of AIP grant funds and PFC s to cover mitigation of risks identified in SMS analyses, and that they increase funding available thro ugh the AIP and PFC programs for such purposes.

Rather than require airport operators to assert control over third parties operating at airports in order to undertak e a SMS program applicable to th e entire airport, airports and
other aviation stakeholders shoul d urge FAA to issue guidance fo r all parties operating at an airport, and to clearly divide SMS responsibilities among them. Further, airports should be permitted to implement SMS in a phased appro ach, so that the operational and financial consequences of adoption of a SMS program do not impact airport operato rs (and rates) all at once, and airport operators have the opportunity to deve lop a program rationally.