Seattle-Tacoma International Airport 

Non-Punitive Program and Legal Authority 

Prepared For: Federal Aviation Administration 

Office of Airports 

Airport Safety and Operations Division 

Prepared By: Landry Consultants LLC, on behalf of Seattle-Tacoma International Airport and 

 Operations Senior Manager, Mark Coates 

 

Date: 11/25/2009 
ATTORNEYS AT LAW 

111 HUNTINGTON AVENUE 

BOSTON, MASSACHUSETTS 02199 

617.342.4000 

617.342.4001 

WWW.FOLEY.COM 

dbannard@foley.com 

617.342.4033 

Privileged and Confidential 

Attorney Client Communication 

M EMORANDUM

CLIENT-MATTER NUMBER 

094694-0101 

TO: Joanne Landry & Deirdre Cowden, 

Landry Consultants LLC 

FROM: David Y. Bannard & Cheryl Wagonhurst 

CC: Mark Coates & Paul Bintinger, 

Port of Seattle 

DATE: May 22, 2009 

RE: Review of Legal Issues Relating to Implementation of an Airport Safety 

Management System and Recommendations 

Introduction

We have been engaged by Landry Consultants LLC (“Landry Consultants”) to 

review the legal issues associated with implementation of an airport safety management system 

and make recommendations regarding minimizing any legal risks identified with implementation 

of such a safety management system. Landry Consultants has been engaged to conduct research 

and develop proof of concept deliverables for a Federal Aviation Administration-sponsored SMS 

pilot study at Seattle-Tacoma International Airport (“SEA” or the “Airport”). 

This memorandum begins with an introduction to Safety Management Systems 

(“SMS”), followed by an executive summary of the primary issues addressed by the memo and 

our conclusions. After the executive summary, the memo sets forth an in-depth legal analysis of 

the three primary legal areas that are the subject of this memo: (1) legal issues relating to 

maintaining confidentiality of data collected pursuant to SMS, (2) potential liability issues 

arising from adoption of a SMS, and (3) issues relating to extension of SMS to tenants and others 

doing business at an airport. This is followed by a brief discussion of the concept of a “just 

culture” and how such an organizational concept affects SMS. Finally, the memo includes 

recommendations relating to the regulations implementing SMS that the Federal Aviation 

Administration (“FAA”) is expected to promulgate within the next 12 to 18 months. Although 

we have attempted to include an in-depth legal analysis of the issues raised by implementation of 

BOST 05-22-09 
 2 

BOST 05-22-09 

SMS at an airport, the legal issues presented by SMS is a very broad and evolving subject. 

Further, the FAA has yet to promulgate its notice of proposed rulemaking for SMS. It is likely 

that additional legal issues will be raised, and additional legal advice may be required, as the 

regulatory process unfolds and airports begin to fully implement SMS programs. 

Introduction to SMS

The FAA defines a SMS as “a systematic, proactive, and well-defined safety 

program” that allows an airport (or other organization) “to strike a realistic and efficient balance 

between safety and operations.”1 According to the FAA, a SMS is “[t]he formal, top-down 

business-like approach to managing safety risk. It includes systematic procedures, practices, and 

policies for the management of safety (including safety risk management, safety policy, safety 

assurance and safety promotion).”2 Use of SMS is expected to increase the likelihood that 

airport operators will detect and correct safety problems before those problems result in an 

incident or an accident. 

 Why Implement a Safety Management System? 

The International Civil Aviation Organization (“ICAO”) has adopted an 

amendment to its International Standards and Recommended Practices that requires member 

states of ICAO, which include the United States, to require that operators of international airports 

implement a SMS.3 ICAO has adopted similar requirements applicable to operators of 

commercial aircraft, aircraft maintenance organizations and air traffic services.4

 According to 

ICAO, a SMS is “a systematic approach to managing safety, including the necessary 

organizational structure, accountabilities, policies and procedures.”5 A SMS, at a minimum, 

must: (a) identify actual and potential safety hazards; (b) ensure that remedial action necessary to 

maintain an acceptable level of safety is implemented; and (c) provide for continuous monitoring 

and regular assessment of the safety level achieved.6 An approved SMS must clearly define the 

lines of safety accountability throughout the airport operator’s organization, including a direct 

accountability for safety on the part of senior management.7 ICAO has provided guidance on 

 1

 FAA website: www.faa.gov/airports_airtraffic/airport_safety/safety_management_systems 

2

 FAA Advisory Circular (“AC”) No. AC 150/5200-37, Feb. 28, 2007, Introduction to Safety 

Management Systems (SMS) for Airport Operators (“AC 150/5200-37”). 

3

 See Annex 14 to the Convention on International Civil Aviation (“CICA”), § 1.4 (Certification of 

aerodromes). 

4

 See Annex 6, Part I, chapter 3 (aircraft), chapter 8 (aeroplane maintenance), Part III, chapter 1 

(commercial air transport), and Annex 11 (air traffic services) to the CICA. 

5

 CICA, Annex 14, Vol. I, § 1.1. 

6

 Id. at § 1.5.3. 

7

 Id. at § 1.5.4. 
 3 

BOST 05-22-09 

 

safety management systems in the ICAO Safety Management Manual (Doc. 9859)8

 and in the 

Manual on Certification of Aerodromes (Doc. 9774).9

The FAA has issued an Advisory Circular stating that the FAA intends to 

implement a rulemaking that will require the use of SMS at U.S. airports to meet the intent of the 

ICAO standard in a way that complements existing airport safety regulations in 14 CFR Part 139 

(“Part 139”).10 Part 139 prescribes rules governing the certification and operation of almost all 

airport within the United States that have scheduled or unscheduled passenger service.11

 Among 

other things, Part 139 requires that each certificated airport develop, maintain and update an 

Airport Certification Manual (“ACM”) that addresses a wide variety of issues, including specific 

safety-related issues, such as procedures for protecting persons and property during storage, 

dispensing and handling of fuel or procedures for airport condition reporting, as required under 

Part 139.12 Part 139 also addresses numerous, specific safety-related matters in Subpart D – 

Operations.13

 However, Part 139 does not directly address a proactive, forward looking 

approach to hazard identification, risk analysis and mitigation that are the hallmark of a SMS 

program. Accordingly, the FAA has opened a rulemaking project to consider a formal 

requirement for SMS at airports that are certificated under Part 139.14

 There are approximately 

570 Part 139 certificated airports in the United States. 

In preparation for the rulemaking process, the FAA sponsored a pilot SMS 

program at 25 airports, as well as a second pilot phase SMS program currently underway at a 

number of smaller airports, and a SMS proof of concept study at three U.S. airports that 

participated in the first pilot SMS study. In addition, the FAA provided a grant to the Mitre 

Corporation to produce a white paper on SMS, and the Airport Cooperative Research Program of 

the Transportation Research Board of the National Academies (“ACRP”) has approved a grant 

project for development of a SMS user guidebook for airport operators that is nearly completed. 

One of the conclusions of the initial airport SMS pilot studies was that, although 

Part 139 addresses safety at airports in many areas, the existing safety regulations at Part 139 are 

not a comprehensive SMS.15

 Part 139 does not cover all areas of a commercial airport, or even 

8

 The second edition of the ICAO Safety Management Manual has been released in draft form, but 

as of the date of this memo, the ICAO Safety Management Manual has not been finalized. 

9

 See Annex 14 to the Convention on International Civil Aviation (“CICA”), § 1.5 (Certification of 

aerodromes). 

10 See AC 150/5200-37. 

11 14 CFR § 139.1 (applicability) 

12 See, e.g., 14 CFR §§ 139.201 (general requirements), 139.203 (contents of ACM), 139.205 

(amendment of ACM). 

13 See 14 CFR § 139.301, et seq. 

14 Id. 

15 See FAA summary of initial pilot SMS studies, concluding that it is “[a]pparent that [Part] 139 is 

not SMS in and of itself.... Evidence that SMS is something larger, more comprehensive, than is currently found in 
 4 

BOST 05-22-09 

 

all sterile areas (e.g., beyond the security checkpoints, where only passengers or appropriately 

badged employees are permitted) of a commercial airport or all aspects of safety management. 

In addition, Part 139 does not provide for comprehensively collecting and analyzing safety data, 

acting on the trends identified and conducting regular, follow up audits and monitoring of results 

achieved. 

How Does a SMS Work? 

SMS is intended to be a forward-looking proactive program, rather than an 

analysis of past incidents. SMS comprises the following four “Elements”: 

1. Development and implementation of safety policy and objectives, 

including staff responsibilities. 

2. Development of a safety risk management process, which 

describes each system or activity at an airport, identifies hazards 

associated with such system or activity, determines and analyzes 

the risk associated with each such hazard, and treats or mitigates 

and monitors the risk. 

3. Assurance of safety through oversight and auditing to ensure that 

the safety programs are implemented and effective. 

4. Promotion of safety through the development of a positive safety 

culture, including training, within the organization.16

 

Thus, an airport that adopts SMS will generally designate a senior level safety 

manager who reports to senior management and is charged under the safety policy developed by 

the airport with overseeing implementation of the SMS. The second elemnt of SMS will require 

most airports to undertake a significant program to describe the systems and activities at the 

airport and the hazards associated with such systems and activities, determine the level of risk 

associated with such hazards and then mitigate the risks that are found to be unacceptable under 

standards included in the airport’s SMS. Airports may choose to undertake this task in phases, 

for example, undertaking this with respect to the apron first, and then extending it to the bagwell, 

and then to other areas of the airport. As part of this process, as well as the monitoring 

component of this element and the auditing component of the third element, data will be gathered 

and analyzed. Initially, an airport will need to design and populate this database with the 

systems and activities, the hazards identified, the degree of risk identified for each such hazard, 

and the mitigation activities undertaken, if any. Following the initial development of this 

the act of complying with 139 requirements. Evidence that 139 compliance may eventually become part of airport 

SMS program ... contrary to the idea that SMS would eventually become part of 139. Reference made to the idea 

that SMS could be used to ensure 139 compliance ... but that 139 by itself could not ensure that SMS was 

functioning.” Presentation at joint FAA/Airports Council International – North America (“ACI-NA”)/American 

Association of Airport Executives (“AAAE”) SMS Conference, Baltimore, MD, October, 2008. 

16 See AC 150/5200-37, Ch. 2 (Elements of a Safety Management System). 
 5 

BOST 05-22-09 

 

database, an airport will need to continue to gather data on new activities, newly identified 

hazards, changes in the degree of risk assigned to such hazards, and the results of mitigation 

activities. As is discussed in detail below, it is the act of gathering and maintaining this critical 

database that presents many of the legal issues that are associated with SMS. 

Among the critical elements of a SMS that have been identified are the ability to 

gather and analyze data from many different sources regarding hazards at an airport. SMS is 

predicated upon the belief that the analysis of data concerning hazards can be applied to 

determine the causes leading to accidents and, thus, to mitigate the personal injury and property 

damage resulting from such accidents by avoiding them. The more data that can be included in 

such an analysis, the better the likelihood that hazards can be identified and mitigated, and 

accidents avoided. 

SMS in Other Contexts 

Other industries, notably the health care industry and the nuclear energy and oil 

and gas industries, have adopted practices similar to SMS. Best practices from these industries 

have shown that more and better data are provided where data can be held in confidence, where 

there is a non-punitive reporting policy, and where information can be reported anonymously.17

 

For example, the report on a roundtable co-sponsored by Kaiser Permanente Institute for Health 

Policy, NASA Aviation Safety Reporting System and The National Quality Forum in August of 

2000, concluded that proposed voluntary patient safety improvement reporting systems would 

build on design elements from the Aviation Safety Reporting System and include the following 

key design elements:18

• Voluntary reporting to a non-regulatory entity. 

• Strong confidentiality protections. 

• Complement existing reporting systems. 

• Public access to a de-identified database (i.e., de-identified patient, 

provider, institution, and person reporting). 

• Expert analysis of the reports is essential. 

• Enable the system through federal authorizing and funding. 

• Individuals and institutions should be instructed to report 

complaints of criminal activity, gross negligence or professional 

17 See, e.g., CRS Report for Congress, Health Care Quality: Improving Patient Safety by Promoting 

Medical Errors Reporting, updated March 24, 2005. 

18 See “Design Considerations for a Patient Safety Improvement Reporting System”, sponsored by 

Kaiser Permanente Institute for Health Policy, NASA Aviation Safety Reporting System and The National Quality 

Forum, held at NASA Ames Research Center, Moffitt Field, California, August 28 - 29, 2000. 
 6 

BOST 05-22-09 

 

misconduct to the appropriate regulatory agency and not to the 

voluntary reporting system. 

• Individuals or institutions reporting to the system should be 

guaranteed confidentiality, but should not be anonymous. Follow 

up may be necessary. 

Health care, in particular, has been able to demonstrate tangible and significant 

reductions in medical errors, thereby improving safety. As discussed in this document, research 

has shown that where an “ethical culture” is developed and encouraged, reporting of incidents 

increases and costs are reduced.19

SMS Operational Characteristics and Issues 

As noted above, ICAO has recommended that SMS be implemented by all 

participants in the international air transportation system, including airport operators, aircraft 

operators, aircraft maintenance organizations and air traffic control providers. The FAA has 

begun to implement SMS for air carriers, for its air traffic controllers and for airport operators. 

Inevitably, there will be overlap between the functions of SMS adopted by each of these 

participants. As discussed below, we recommend that the FAA issue rules that help clarify the 

responsibilities of the various participants for various functions. In all events, however, it is 

likely that in order to implement SMS effectively, each airport operator will be faced with the 

necessity of working with the air carriers, ground handlers, and air traffic control at that airport 

to coordinate SMS among them and ensure that all areas are covered adequately by SMS 

implemented by one or more of the organizations operating at the airport. 

Thus, the proper scope of a SMS is an issue that both the FAA, through its 

rulemaking process, and the airports must address; should the SMS program apply only to the 

airport’s staff and areas within the control of the airport, or should it be applied more broadly, for 

example, to cover all of the airside other than the areas under the air traffic control tower’s direct 

control, or all areas of the airport, including landside. Although, depending on the content of the 

final rule, to a certain extent, this issue may not be a legal one, if an airport operator determines 

to extend the scope of its SMS to areas and operations not directly within the airport operator’s 

control, then additional legal issues relating to the conflict between a tenant’s rights to control its 

employees and actions within its leased space and an airport operator’s desire to enhance safety 

at the airport, are likely to arise, as noted below. 

In many ways, SMS is similar to a traditional cost-benefit analysis. SMS is 

intended to identify hazards, quantify the risk – both in terms of likelihood and in terms of 

severity – of the hazard occurring, and then mitigate those risks found to lie within an 

unacceptable range of severity and/or likelihood. SMS recognizes that risk cannot be eliminated, 

and that the costs of mitigating certain risks cannot be justified, either because the risk is so 

remote or because the cost to mitigate certain risks is unreasonable. But by moving from a 

19 CRS Report for Congress, Health Care Quality: Improving Patient Safety by Promoting Medical 

Errors Reporting, updated March 24, 2005. 
 7 

BOST 05-22-09 

reactive mode of managing safety in which safety advances typically follow accident 

investigations and toward the more predictive mode of managing safety in which data collection 

and analysis enable risks to be identified and addressed before they cause an accident, SMS has 

the potential for leading to a major improvement in aviation safety.20

 

Executive Summary 

 Set forth below is a summary of the legal issues that we have identified to date 

arising from the proposed promulgation of regulations mandating adoption of SMS at Part 139-

certificated airports, and a summary of recommendations arising from our analysis. For 

example, the data-driven nature of SMS and the fact that studies have demonstrated that 

maintaining confidentiality of information and those reporting such information can be a critical 

factor in development of safety systems conflicts with the fact that the vast majority of U.S. 

airports are subject to freedom of information laws that require disclosure of most information 

gathered by such airports. Thus, several of our recommendations relate to means and methods to 

protect SMS data from disclosure. In summary, we find or recommend that: 

• The implementation of SMS has the potential to be a significant step forward in 

promotion of aviation safety and is likely to result in lives saved, fewer personal 

injuries and reduced property damage. However, SMS also has the potential for 

increasing legal liability exposure for those entities forced to adopt SMS. 

• Careful consideration should be given to the design and implementation of the 

regulations and related systems that will comprise the FAA’s integrated SMS for 

airport operators, air carriers and air traffic control, so that the objectives of SMS 

can be achieved while minimizing additional legal liability exposure and 

unnecessary costs. 

• SMS will be most beneficial when a wide range of information and data are 

reported and made available, so that all applicable hazards are identified, risks 

analyzed and appropriate corrective action is taken so as to mitigate future risk. 

• In order to encourage identification of potential safety issues and proper reporting, 

the FAA should implement regulations that protect data from disclosure, to the 

greatest extent possible, and permit data to be de-identified and aggregated in a 

manner that allows airports as well as other participants in the national aviation 

system, including air carriers, air traffic control, the FAA and ground service 

providers, to access such data for appropriate analysis. 49 U.S.C. Section 40123 

should be amended to protect SMS information from disclosure under state and 

federal FOIA. 

• Because implementation of SMS programs will heighten awareness of certain 

risks related to aviation safety, those entities participating in SMS programs will 

likely face increased legal liability exposure for negligence claims, or even claims 

 20 See Aerosafety World, “Into the Mainstream”, January 2009, p. 25. 
 8 

BOST 05-22-09 

arising under related theories, such as recklessness, in the event of an accident. 

Failure to adhere to SMS regulatory requirements could also give rise to 

“whistleblower” actions arising under the federal False Claims Act. 

• The FAA should adopt comprehensive SMS regulations addressing all 

participants in the national aviation system that, among other things, clearly 

divide responsibilities among the various SMS participants; air carriers, air traffic 

control and airport operators. 

• The FAA should provide clear guidance for risk analysis and standards for 

requisite undertaking of mitigation. Where SMS participants carefully adhere to 

the FAA’s guidance, such participants should be able to establish the 

reasonableness of the actions taken or not taken. 

• Rather than require airport operators to assert control over third parties operating 

at airports in order to undertake a SMS program applicable to the entire airport, 

The FAA should issue guidance requiring all parties operating at an airport to 

participate in or undertake SMS, and clearly divide SMS responsibility among 

them. 

• Airports should be permitted to implement SMS in a phased approach, so that the 

operational and financial consequences of adoption of a SMS program do not 

impact airport operators (and rates) all at once, and the airport operators have the 

opportunity to develop an SMS program rationally. 

• To the extent possible, FAA should expand the permitted uses of AIP grant funds 

and PFCs through regulation to cover mitigation of risks identified in SMS 

analyses, and FAA should work with Congress to amend AIP and PFC eligibility 

requirements under current law to permit use of such funds to mitigate risks 

identified in SMS analyses. 

• FAA should work with Congress to provide additional funding throught the AIP 

(and, if necessary, PFC) programs for mitigation of risks identified through SMS 

analyses. 

Discussion

A. Legal Issues 

Based on our review to date of the legal issues presented by SMS, we have 

identified three primary areas: (1) the ability to maintain confidentiality of information; (2) 

potential for a heightened duty of care for airport operators; and (3) depending on the scope of 

the FAA’s final rulemaking, constraints upon an airport operator’s ability to require its tenants 

and others doing business at the airport to comply with the SMS program adopted at the airport. 

1. Maintaining Confidentiality
 9 

BOST 05-22-09 

 

It has been demonstrated that where data provided is held in confidence, reporting 

is improved.21

 The United States Congress recognized this when it enacted legislation that 

protects certain voluntarily submitted aviation safety or security related information from 

disclosure.22 The FAA has implemented Section 40123 through regulations23 and under those 

regulations, FAA has adopted several safety programs, notably including the Aviation Safety 

Action Program (“ASAP”)24

 for air carriers and their employees, as discussed below. 

ICAO has clearly noted the distinction between what it terms “error reporting” 

and “hazard reporting”, stating that “error reporting is self-incriminatory and may thus lead to 

blame and punishment, while hazard reporting is objective and neutral.25

 ICAO goes on to note 

that because of the early emphasis on error reporting as opposed to hazard reporting, the 

protection of reporters has been a hot topic since the inception of reporting systems.26

 ICAO 

distinguishes between records relating to accidents and serious incidents, where there may be 

overriding considerations that require disclosure of the records for judicial investigations, and 

records related to voluntary hazard reporting, where there is strong justification for protection.27 

ICAO concludes that a consequence of effective safety reporting “... is that key data is properly 

safeguarded, and the promotion of a system of checks and balances that ensures that reporters of 

hazards feel confident that hazard reporting will not be put to uses other than for which it was 

implemented, operational personnel are encouraged (and rewarded) for providing essential safety 

information related to hazards. However, there is a clear line that differentiates between 

acceptable and unacceptable operational performance.”28

 

21 See, e.g., Aerosafety World, “Rebuilding ASAP”, Feb. 2009, at 42 (“the majority of the 

information on which such [safety] enhancements now depend would not surface at all if not voluntarily disclosed.” 

Quoting Independent Review Team, Managing Risks in Civil Aviation: A Review of the FAA’s Approach to Safety. 

Sept. 2, 2008); Id. at 43 (“The [Flight Safety] Foundation and others have estimated that about 98 percent of the 

safety information obtained from voluntary disclosure programs would no longer be available if participants were 

subject to prosecution and penalties.”) 

22 See 49 U.S.C. § 40123(a) (“Notwithstanding any other provision of law, neither the Administrator 

of the Federal Aviation Administration, nor any agency receiving information from the Administrator, shall disclose 

voluntarily-provided safety or security related information if the Administrator finds that – (1) the disclosure of the 

information would inhibit the voluntary provision of that type of information and that the receipt of that type of 

information aids in fulfilling the Administrator’s safety and security responsibilities; and (2) withholding such 

information from disclosure would be consistent with the Administrator’s safety and security responsibilities.”) 

(“Section 40123”) 

23 See 14 CFR Part 193 (Protection of Voluntarily Submitted Information) (“Part 193”). 

24 See FAA Order 8000.82 Designation of Aviation Safety Action Program (ASAP) Information as 

Protected from Public Disclosure Under 14 CFR Part 193 (“Order 8000.82”) 

25 ICAO Safety Management Manual (“SMM”), 2d ed. (draft), § 2.8.23. 

26 Id. 

27 Id. at 2.8.24 – 2.8.26. 

28 Id. at § 2.8.15(e). 
 10 

BOST 05-22-09 

 

It is important to note that there are several different types of disclosure of 

information that may be mandated. As discussed below, state and the federal freedom of 

information acts (“FOIA”) generally mandate that all information, data, documents and other 

materials (collectively, “information”) held by a governmental entity be disclosed upon request, 

unless such information falls within one of a very few statutorily enumerated exceptions.29 The 

other is the legal discovery process. The ASAP program appears to be exempt from disclosure 

under both the federal FOIA and through discovery, although a federal court in a case involving 

the August 27, 2006, crash during an attempted takeoff from a taxiway at Blue Grass Airport in 

Lexington, Kentucky, has passed until trial the question of whether ASAP data submitted before 

the crash may be admitted at trial.30 In that case, a federal district court judge deferred until trial 

a motion calling for the release of the airline’s ASAP reports.31

In addition, the controversy over the recently initiated FAA action to protect its 

Wildlife Strike Database32 from disclosure pursuant to Section 40123 points out the very real 

difficulties that lie ahead for any effort to exempt aviation safety information from disclosure.33

The FAA initially sought to make the information submitted to the Wildlife Strike Database 

confidential, but in the face of significant media and public attention, the FAA elected to make 

such information public.34 In its comments on the proposal, Airports Council International 

concluded that it could not take a position either supporting or opposing the FAA’s proposed 

order, but it noted that if such data are made public, the FAA should “... provide explanatory 

information to assist the public and media to use the data responsibly....”35 Interestingly, one 

reason that many ACI-NA member airports were ambivalent regarding the proposed order was 

29 See, e.g., 5 U.S.C. § 552(a)(3)(A) “... except as provided in subparagraph (E), [relating to 

intelligence agencies] each agency, upon request for records which (i) reasonably describes such records and (ii) is 

made in accordance with published rules stating the time, place, fees (if any), and procedures to be followed, shall 

make the records available to any person.” (emphasis added). Section 552(b) goes on to state that section 552 does 

not apply to matters that are listed under 9 separate listed exceptions, most of which are narrowly drawn, including 

matters that are “specifically exempted from disclosure by statute ... provided that such statute (A) requires that the 

matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes 

particular criteria for withholding or refers to particular types of matters to be withheld.” (§ 552(b)(3).) Safety 

information in general is not a specific exception to the federal FOIA, but Section 40123 provides for exceptions to 

FOIA. 

30 See In re: Air Crash at Lexington, KY, Slip Opinion at 12, July 17, 2008 (E.D. KY) (granting 

motion to exclude all reference or evidence concerning ASAP reports filed after the crash of Flight No. 5191; 

passing until trial Comair’s request to exclude all ASAP reports, both before and after the crash.) 

31 See Aerosafety World, “Rebuilding ASAP”. Feb. 2009 at 40, 43. 

32 See 74 Fed. Reg. at 11698, March 19, 2009. 

33 See, e.g., USA Today editorial, April 3, 2009; USA Today, “Aircraft hit birds 62% more strikes 

since ‘90’s”, April 7, 2009. 

34 See The Washington Post, April 23, 2009, “LaHood Snubs Plan to Keep Data on Bird Strikes 

Secret”. 

35 Comments of Airports Council International – North America (“ACI-NA”) -- In the Matter of 

Notice of Proposed Order Designating Information as Protected from Disclosure, Docket FAA-2009-0245, at p. 7, 

April 20, 2009. 
 11 

BOST 05-22-09 

that such airports “... are subject to state and local sunshine laws that require them to provide 

their locally-collected wildlife strike reports to the public already.”36 This example demonstrates 

both the difficulty in protecting safety data from disclosure and the need for a solution that 

addresses both federal and state FOIAs. In order to protect any such safety information from 

disclosure, it is likely that the FAA and other stakeholders, such as airports, air carriers and 

ground handlers, will need to make a compelling case for such treatment. 

The vast majority of commercial service airports in the United States must 

disclose most information (including safety information) held by those airports upon request. 

Almost all commercial service airports in the United States, including SEA, are owned and 

operated by municipal or state governmental entities, including independent authorities, that are 

subject to their state’s FOIA. Furthermore, the FAA is subject to the federal FOIA.37 State 

FOIAs are modeled on the federal FOIA, although each state’s act differs in certain particulars. 

In general, aviation safety information is not an exception to disclosure under state and federal 

FOIAs, other than the statutorily created exception noted above for voluntarily disclosed 

information under Section 40123. 

The requirement that public airport operators provide information on request 

pursuant to FOIA significantly inhibits most private entities from participation in a voluntary 

program of self-reporting safety-related information. In a draft report prepared for the Airport 

concerning ramp procedure reporting, it was noted that both the majority of the airlines and 

service vendors/ramp operators indicated that they had concerns that “any incident that is 

reported to the Port immediately becomes a matters of public record.”38 The purpose of this 

section is to consider legal means that may be used to report and record information in ways that 

may help protect it from disclosure. 

a. Federal Preemption. The ideal resolution of this issue would be for 

Congress to extend the ambit of Section 40123 to exempt all information gathered under an 

FAA-approved SMS from disclosure under the federal FOIA, and through preemption, protect 

SMS data from disclosure under state FOIAs as well. Where a federal statute or regulation is 

intended to preempt state law and the agency that promulgated that regulation acted within the 

scope of its delegated authority in doing so, a federal statute or regulation can preempt a state’s 

laws on the same subject. If the FAA is granted the authority to adopt regulations protecting 

certain information from disclosure in order to promote safety, and the FAA adopts a regulation 

that designates SMS data as exempt from disclosure because of the concern that public 

disclosure may inhibit the provision of important safety-related information, such regulation 

likely would preempt a contrary state FOIA requirement to disclose that information. 

 36 Id. at 4. 

37 See 5 U.S.C. § 552 (federal FOIA) 

38 See Seattle International Airport Ramp Procedure Reporting prepared by Harold N. Handke, 

Airport Design & Operations, at Appendix 1. 
 12 

BOST 05-22-09 

nformation. 

 

 The information that is made confidential under Section 40123 is exempt from 

disclosure under federal FOIA because it constitutes matters that are “specifically exempted from 

disclosure by a statute that requires that the matters be withheld from the public in such a manner 

as to leave no discretion on the issue,” and Section 40123 “establishes particular criteria for 

withholding or refers to particular types of matters to be withheld.” As Section 40123 only 

applies to information voluntarily provided to the FAA, however, it is not of much utility to an 

airport seeking to establish a SMS that is exempt from the requirements of its state’s FOIA. 

Similarly, if FAA adopts a requirement that all Part 139 airports implement SMS, as FAA is 

expected to do, it may not be possible to withhold SMS data under a state FOIA under Section 

40123, as the information arguably is not “voluntarily” provided if it is mandated by federal 

regulation. 

We recommend that airports seek action from Congress to amend Section 40123 

to eliminate the requirement that such information be voluntarily provided and to expressly limit 

the information that is subject to disclosure through discovery. Further, we recommend that 

when the FAA subsequently adopts regulations promulgating the requirement that airports 

certificated under Part 139 implement an SMS, that such regulations expressly exempt SMS 

data, other than certain narrowly defined data demonstrating violations of law or regulation 

similar to the ASAP, from disclosure under all state and federal FOIAs. However, we are also 

quite aware that this approach is likely to be met with resistance from several sectors, including 

the media. In order for such an exemption from disclosure to be approved, it will take strong 

efforts by multiple stakeholders, demonstrating the tangible safety benefits that should accrue 

from a robust SMS program, to convince policy makers that the benefits of nondisclosure 

outweigh the desire for transparency. In such an event, there is a strong argument that such 

federal action would preempt all state laws, including state FOIAs, and protect SMS data from 

disclosure. 

The FAA is expressly charged by Congress with overseeing aviation safety within 

the United States.39

 If the FAA adopts regulations protecting certain information from 

disclosure in order to promote safety because of the concern that public disclosure may inhibit 

the provision of important safety-related information, such regulations likely would preempt a 

contrary state FOIA requirement to disclose that i

For example, under Section 40123 and Part 193, the FAA has adopted Order 

8000.82 exempting ASAP data from disclosure. The FAA found that “disclosure of the 

information would inhibit the voluntary provision of that type of information. Certificate holders 

and their employees are reluctant to share sensitive safety information with the FAA, including 

employee self-reports of alleged violations, if such submissions might be subject to public 

disclosure.”40

 Order 8000.82 continues “A significant impediment to the sharing of ASAP 

information with the FAA is the aviation industry’s concern over public disclosure of the 

39 See, e.g., 49 U.S.C. § 40101(a) (“... the Secretary of Transportation shall consider the following 

matters, among others, as being in the public interest and consistent with public convenience and necessity: (1) 

assigning and maintaining safety as the highest priority in air commerce....”) 

40 Order 8000.82 at ¶ 6(c). 
 13 

BOST 05-22-09 

mandate. There, the court ruled that the federal FOIA and two exemptions thereunder, coupled 

 

information and, if disclosed, the potential for it to be used for other than the safety enhancement 

purposes for which the ASAP was created.”41

 Thus, with the exception of reports involving 

possible criminal activity, substance abuse, controlled substances, alcohol, or intentional 

falsification, the FAA withholds significant amounts of information provided under ASAP, 

including the employee’s ASAP report and the content of that report and the identity of the 

certificate holder associated with such report.42

 In determining whether a federal regulation preempts conflicting state law, courts 

must determine (1) whether the federal regulation was intended to preempt state law and (2) 

whether the agency that promulgated the rule acted within the scope of its delegated authority in 

doing so. Where a clear conflict between state law and federal regulation exists, such that 

compliance with both is impossible, courts will analyze the nature and scope of the authority 

granted to the agency to determine whether preemption is appropriate. In ACLU of New Jersey 

v. Hudson, a court ruled that an Immigration and Nationalization Service (“INS”) regulation 

preempted a conflicting New Jersey sunshine law because the INS Commissioner was acting 

under properly delegated authority in promulgating the rule based on Congress’ plenary power 

over matters concerning immigration.43 The same result occurred in Brady-Lunny v. Massey, 

where the delegated authority to promulgate the rule at issue was based on a less clear 

44

41 ). 

42

he validity of the regulation, and it accordingly ruled that the 

federal regulation m

 Id. at ¶ 6(c)(1

Id. at ¶ 5(b). 

43 ACLU of New Jersey, Inc. v. County of Hudson, 799 A.2d 629, 635 (N.J. Super. Ct. App. Div. 

2002). This case involved the United States, who acted as an intervener and appealed a trial court’s order requiring 

two counties to disclose pedigree data and other specified information pertaining to certain inmates, including those 

in county care pursuant to contracts with the INS. The plaintiffs sued alleging that the counties unlawfully refused 

to make available public records as required by New Jersey’s Right-to-Know Law. Id. The United States argued 

that an INS “interim rule” barring the disclosure of the information sought preempts state law and forbids the 

disclosure of the requested information. Id. at 638-39. In overturning the trial court’s decision, the court noted that 

“federal regulations have the same pre-emptive effect as federal statutes as long as the agency (1) intended to 

preempt state law and (2) acted within the scope of its delegated authority.” Id. at 646 (internal citations and 

quotations omitted). The court found a clear conflict between state laws that mandated disclosure of the information 

and the federal regulation that prohibited its disclosure, warranting a preemption analysis. Id. at 646-47. The court 

next noted that “a federal agency may preempt state law only when and if it is acting within the scope of its 

congressionally delegated authority.” Id. at 647. To make this determination, courts must “examine the nature and 

scope of the authority granted by Congress.” Id. “Where Congress has directed an administrator to exercise his 

discretion, his judgments are subject to judicial review only to determine whether he has exceeded his statutory 

authority or acted arbitrarily.” Id. (internal quotations and citations omitted). Using these principles, the court 

found that Congress has exclusive jurisdiction over immigration and that the regulation was promulgated by the 

Commissioner of the INS under appropriately delegated authority. Id. at 650. The court concluded that none of the 

arguments advanced by the plaintiffs detracted from t

ust preempt state law. Id. at 655. 

44 Brady-Lunny v. Massey, 185 F.Supp.2d 928, 929-30 (C.D. Ill. 2002). In this case, a reporter from 

an Illinois newspaper sent an Illinois Freedom of Information Act (“Illinois FOIA”) request to the county sheriff 

asking for various information about prisoners in the sheriff’s custody. The sheriff provided the information with 

respect to state inmates, but not as to federal inmates. Id. at 930. The United States then intervened and also refused 

to accede to the Illinois FOIA request because the Federal Bureau of Prisons has a prohibition on disclosing lists of 

federal inmates. Id. The court noted that the Illinois FOIA specifically exempts from disclosure information 
 14 

BOST 05-22-09 

b. Working Within FOIA

with a regulation validly promulgated by the Federal Bureau of Prisons prohibiting disclosure of 

certain information, preempted an Illinois sunshine law. Like the INS and Bureau of Prisons 

regulations, an FAA regulation prohibiting the disclosure of certain safety and security 

information collected by airport operators in connection with a mandatory safety program should 

be deemed to be a valid exercise of authority. 

. Without obtaining statutory authority that protects 

SMS data f

i. Reporting

rom disclosure under federal and state FOIAs, there are steps that an airport that 

adopts a SMS can take to encourage reporting and protect certain information from disclosure. 

Generally, these steps are taken in the way that information is reported, and in the way that 

information is recorded. Each airport should develop clear standards for both reporting and 

recording SMS data in a manner that will protect such data from disclosure to the greatest extent 

possible. 

. The manner in which information is gathered for an 

airport’s SMS

 One method of reporting that serves to reduce disclosure is providing for 

(1) Anonymous Reporting

 database can be established both to minimize the information gathered – so that 

certain information that parties would prefer not be disclosed is not gathered and thus cannot be 

subject to disclosure – as well as to encourage reporting. We recommend that reporting of 

safety-related information under an airport’s SMS be standardized pursuant to policies and 

procedures adopted by the airport operator as part of its SMS program. Those standards can 

address both the types of information that should be provided and the manner in which the 

information is provided. Just as importantly, the policies and procedures should clearly state the 

types of information that should not be reported. 

anonymous reporting. Another is to set up reporting processes that do not require that certain 

types of identifying data be provided. The crucial issue is that under FOIA, it is only the 

information held by the governmental entity that must be disclosed. Thus, if certain information 

is intentionally not obtained, it will not be available for disclosure. 

. A system that permits information 

to be reported anonym

One drawback to anonymous reporting is that it can be difficult to investigate the 

issue and follo

ously, such as through a telephone “tip line” or by other anonymous 

communication, can lead both to increased participation and will avoid identification of the 

reporting person. It has been shown, as discussed below, that where a reporting program is nonpunitive, participants are more likely to provide more and better information. Similarly, where 

persons are concerned about protecting their identity, an anonymous tip line can provide the 

ability to report safety-related information, without the identity of the reporter being disclosable. 

w up with those submitting reports. However, many health care institutions have 

implemented anonymous reporting systems that have been integrated within the institution’s 

 prohibited from disclosure by federal or state law or rules and regulations. Id. at 931. The court’s analysis then 

turned on the validity of the Bureau’s regulation that prohibits disclosure of federal inmates. Id. Without much 

analysis, the court ruled that the federal FOIA and two exemptions thereunder applied to the information and that the 

Bureau’s regulation was valid; therefore, the information was protected from disclosure. Id. at 932. 
 15 

BOST 05-22-09 

ethics and compliance program structure, thus creating a framework for improved reporting and 

accountability. 

(2) De-Identification of Information. Another method of 

reporting and recording information that avoids FOIA requirements is to “de-identify” certain 

information when it is reported. For example, rather than requiring that the name of an airline 

whose aircraft was involved in an incident be reported, the SMS program would simply require 

that the incident be described, without specifying names of participants. A drawback to such a 

system is that it is harder to develop trend analyses tied to a specific identifier, such as the name 

of an airline or fixed base operator. As a compromise, certain neutral identifiers can be used, 

such as the area of the airport the incident occurred (either on a grid basis or by gate or other 

similar basis), but these identifiers are themselves disclosable and can lead to identifying the 

parties involved in at least some incidents. 

ii. Recording. As noted above, not only can the manner in which 

information is reported be set up so as to protect certain information from disclosure, the way 

information is recorded can also be established in such a manner as to protect information. As 

described above, “de-identification” of information when it is reported or when it is recorded 

will prevent collection of and maintaining certain identifying information. Similarly, it may be 

possible to arrange for information to be held by a third party not subject under the applicable 

FOIA. Such third party hosting of information is often performed for health care institutions, not 

because of FOIA concerns, but to maximize efficiency. In the airport context, however, if data is 

provided directly to a third party not subject to FOIA, in certain cases it may be possible to 

prevent the disclosure of that information under FOIA. There are several drawbacks to this 

approach, however. The first is that the federal FOIA was recently amended to include 

information gathered on behalf of a federal agency by a third party as information subject to 

FOIA.45

 It is likely that many, if not all, state FOIAs will follow this lead at some point, thereby 

mooting this potential means for avoiding disclosure. Second, once the airport accesses the third 

party’s database, the information that is delivered to the airport becomes subject to applicable 

FOIA. Thus, it may be desirable to establish de-identification protocols for all data provided to 

or drawn from such a third party host. 

iii. Privilege. A final source of confidentiality is privileges and other 

legal requirements prohibiting disclosure. For example, materials subject to the attorney-client 

privilege are generally not subject to disclosure under state and federal FOIA. Similarly, security 

sensitive information, or “SSI,” as defined in 49 U.S.C. § 1500, et seq., may not be disseminated 

except to those with a need to know without permission of the Transportation Security 

Administration (“TSA”). However, these sources of confidentiality will apply only to a limited 

 

45 See 5 U.S.C. § 552(f)(2) (“ ‘record’ and any other term used in this section in reference to information 

includes – (A) any information that would be an agency record subject to the requirements of this section when 

maintained by an agency in any format, including an electronic format; and (B) any information described under 

subparagraph (A) that is maintained for an agency by an entity under Government contract, for the purposes of 

records management.”) added by Pub. L. 110-175, Sec. 9 (Dec. 31, 2007). 
 16 

BOST 05-22-09 

range of data, and courts often read these exceptions narrowly in favor of disclosing materials, 

with privileged or prohibited materials redacted. 

c. Alternatives to Reporting. Instead of gathering data from third parties 

such as airlines and fixed base operators (“FBOs”), we recommend that the FAA instead require 

that these third parties also be required to undertake SMS programs (or that airline programs 

include third party providers of service to the airlines). In such an event, the data reported by 

such other parties ideally would be de-identified, aggregated, and made available to all 

participants in the FAA’s SMS programs, so that airport operators, among others, could access 

safety hazard data relating to their airport, as well as generally, to assist in risk analysis and 

mitigation. 

 In the alternative, another option may be to rely on programs established by 

others, such as the International Air Transport Association (“IATA”), which has established the 

International Air Transport Association Operational Safety Audit (“IOSA”) program for member 

airlines and the ICAO Safety Audit Guidelines (“ISAGO”) for FBOs and other ground handlers. 

While all air carriers and third party handlers are not required to comply with IOSA or ISAGO, 

respectively, it would likely be reasonable for airport operators to require FBOs to comply with 

ISAGO as part of the minimum standards for operation at an airport, and to provide certain 

benefits, such as reduced fees or other “carrots” for airlines that are IOSA certified.46

 

2. Potential Liability Issues. 

Airports that implement a SMS may heighten their risk of liability. Through the 

process of developing a gap analysis and ranking potential safety threats, airports may be 

increasing their risk of liability for negligence – or even recklessness - where a threat to safety is 

identified, but not promptly mitigated. This issue is of lesser concern to an airport operator 

where a substantial safety threat is located within an area not subject to the control of the airport 

operator, but even in that case, there may be a duty to warn the entity controlling such space and, 

as landlord, the airport operator may have a duty to attempt to mitigate any such identified 

threats. Further, failure to comply with the SMS regulations, when promulgated by FAA, could 

give rise to a federal Tort Claims Act whistleblower action. 

a. Negligence. Liability for negligence arises when a party owes others a 

duty to conform to a standard of conduct for the protection of others from unreasonable risk, and 

that party breaches that duty, resulting in injury or damage to another.47

 In addition, negligence 

has been found where a risk has been identified and where there is an unreasonably great risk of 

causing damage or injury, and the identified risk is not mitigated.48

 In such cases, the general 

 46 Note that under FAA regulations, it is unlikely that an airport may prevent an air carrier from 

operating at the airport without a SMS in place. However, an airport may justly discriminate between those carriers 

with SMS and those without by providing certain incentives. 

47 See Prosser & Keeton on Torts, 5th ed., § 30, pp. 164-165 (1984). 

48 Id. at § 31, pp. 169. 
 17 

BOST 05-22-09 

legal standard is whether a reasonable person would have mitigated the identified risk.49 If a 

reasonable person, as determined by the fact finder (generally, the jury) would have undertaken 

steps to mitigate the identified risk, then the party that failed to mitigate such a risk will generally 

be found liable to the person injured. 

Thus, implementation of SMS could lead to increased likelihood of liability 

because the process identifies otherwise unknown risks and quantifies the potential impact of 

such incidents. By being on notice of these risks through a SMS analysis, an airport operator 

arguably has a duty to persons at the airport (including, for example, airport tenants, those doing 

business at the airport and travelers) to take all reasonable steps to mitigate the identified risk. If 

the SMS analysis had not been performed, the lack of knowledge of a risk, and thus failure to 

mitigate it, could be a defense. 

The obvious response to this concern is for airports to mitigate risks as they are 

identified through SMS, and that is certainly one of the goals of SMS. However, inherent in the 

SMS process is judgment regarding the likelihood that a given risk will result in an incident and 

regarding the potential seriousness of the consequences of such an incident. Further, many 

mitigation alternatives will require a cost-benefit analysis. If the risk is remote, the potential for 

injury low and/or the cost to mitigate the risk is high, an airport may choose not to mitigate a 

given risk. In such a case, in the unfortunate event that the identified risk leads to an accident, 

there will inevitably be second guessing of the decision not to mitigate that risk, and evidence 

will exist that the airport was both aware of the risk and chose not to correct it. 

As noted above, the simple solution is for an airport operator to mitigate all risks 

that are identified. However, that alternative will not always be possible. It is also likely that 

over time, the identified risks that have not been mitigated will become fewer as the airport 

operator undertakes mitigation measures. Accordingly, it is likely that the greatest costs 

associated with undertaking mitigation measures will be in the early years of implementation of a 

SMS (or application of a SMS to a new area of an airport, if the program is phased in). Thus, 

airports that adopt SMS (and once FAA requires implementation of SMS, this will be universal) 

will need to commit adequate resources not only to undertake the SMS program itself, but to 

mitigate the more significant risks that are identified. 

To the extent that the FAA provides guidance regarding which risks must be 

mitigated and which risks may be addressed through other means, the FAA’s standards will 

provide strong evidence of reasonableness. Furthermore, to the extent that the FAA develops 

consistent standards for rating risks and quantifying those risks that must be mitigated versus 

those risks that are acceptable, airports will be able to obtain some protection from liability 

where the airport acts consistently in accord with the FAA’s guidance. As noted above, SMS is 

not intended to lead to mitigation of all identified risks, it is intended to be used in a manner 

similar to a cost – benefit analysis. Risk cannot be eliminated, only managed. Accordingly, 

ICAO defines “safety” as “... the state in which the possibility of harm to persons or of property 

 49 Id. 
 18 

BOST 05-22-09 

damage is reduced to, and maintained at or below, an acceptable level through a continuing 

process of hazard identification and safety risk management.”50 

With respect to risks that are determined to be remote or that present low risk of 

harm, airports will need to be rigorous in their analysis and maintain careful records regarding 

their analysis and any changes in the determination that may be warranted, in order to 

demonstrate the reasonableness of the decision not to undertake mitigation measures. In 

addition, to the extent that the airport’s SMS includes a clear process for categorizing risks and 

the airport operator demonstrates a clear practice of mitigating risks determined to be above the 

threshold established in the SMS, the airport operator will help demonstrate its reasonableness. 

Conversely, where an airport operator demonstrably fails to mitigate identified risks in 

accordance with its SMS or otherwise fails to adhere to the policies and provisions adopted in its 

implemented SMS, it is much more likely that such an operator will be found to have acted 

unreasonably and be held liable where an identified risk results in injury. 

Mitigation of hazards in areas not subject to an airport operator’s direct control 

can be addressed through strong lease (or other agreement) provisions that mandate that if a 

hazard is identified by the airport operator or through SMS within an area subject to a tenant’s 

control, the tenant must promptly mitigate that hazard if directed to do so by the airport operator. 

Such an agreement should also contain a strong self-help provision permitting the airport 

operator to take such steps as may be necessary in the judgment of the operator to mitigate any 

such hazard if the tenant does not do so in a reasonable period of time, and allowing the airport 

operator to charge the cost of such measures back to the tenant. 

b. Recklessness. A heightened form of liability for negligent acts is so-called 

“reckless” or “willful or wanton” conduct, which is action that “is so far from a proper state of 

mind that it is treated in many respects as if it were so intended.”51 The usual meaning of these 

terms is that an actor has intentionally done an act of an unreasonable character in disregard of a 

known or obvious risk that was so great as to make it highly probable that harm would follow, 

usually coupled with a conscious indifference to the consequences.52

 This can also be stated as 

an extreme departure from ordinary care in a situation where a high degree of danger is 

apparent.53

One of the hallmarks of the commercial aviation industry is that, despite the 

potential dangers of flight, the industry has adopted a safety culture that has resulted in an 

outstanding safety record. Nevertheless, the consequences of failure to maintain a safe 

environment at an airport can be catastrophic. By adopting a SMS program, claims for 

recklessness could arise where a risk analysis demonstrates that a hazard had a significant 

potential for occurring and for causing serious injury or death, and the airport operator chooses 

 50 See ICAO SMM (draft), § 2.2.4. 

51 Prosser & Keeton on Torts, 5th ed., § 34, p. 213. 

52 Id. 

53 Id. at 214. 
 19 

BOST 05-22-09 

not to undertake measures to remedy such hazard, or potentially, where the operator postpones 

taking remedial action, and the foreseen hazard occurs, resulting in serious injury or death. To 

the extent that failure to remedy such a hazard was an extreme departure from ordinary care and 

the risk analysis demonstrated that it was highly probable that harm would follow from such a 

hazard, an airport operator could be faced with an action alleging reckless conduct. Where a 

fact-finder finds that such conduct was, in fact, reckless, the consequences to the airport operator 

can much more severe, resulting in higher financial judgments and, depending on the terms of 

the policy, lack of insurance coverage. As suggested above, airports will need to closely monitor 

the SMS risk analysis process and, when significant risks are identified, airports will need to act 

promptly to mitigate those risks. 

c. False Claims Act Actions. The vast majority of U.S. airports receive 

federal grant funding under the Airport Improvement Program (“AIP”). All recipients of AIP 

grant funds must enter into a grant agreement with the FAA that includes a long list of grant 

assurances, including assurance numbers 19 (operation and maintenance) and 20 (hazard 

removal and mitigation). If an airport operator fails to undertake a SMS program or otherwise 

comply with the regulations promulgated by FAA relating to SMS, it is possible, especially 

where an incident or accident gives rise to personal injury, death or property damage, that a 

claim could be asserted against the airport operator under the federal False Claims Act for breach 

of the AIP grant agreement through failure to comply with the airport’s grant assurances. In 

contrast, demonstrated compliance with the FAA’s regulatory requirements and adherence to an 

airport’s adopted SMS should help an airport operator demonstrate full compliance with these 

assurances. 

3. Regulation of Tenants and Others Doing Business at the Airport. 

As is discussed briefly above, one of the fundamental issues that will confront an 

airport implementing an SMS is how broad its scope will be. If the FAA implements regulations 

requiring that all participants in the commercial aviation system, including airlines, air traffic 

control and airport operators, undertake separate, integrated SMS programs, and if the FAA also 

provides concrete guidance that identifies the boundaries of each of the participants’ 

responsibilities, it is likely that it will be significantly simpler for airport operators to regulate 

their tenants and others engaged in operations at their airport. However, absent such a 

comprehensive approach to SMS or the FAA’s failure to adequately separate SMS 

responsibilities, airport operators will have to determine the proper scope of their SMS program, 

including determining whether to require that tenants and others participate in some way. Thus, 

the breadth of an airport’s SMS may include both its geographic reach (i.e., whether or not to 

include landside as well as airside operations, and with respect to airside, whether all operations 

or only selected areas will be included within the ambit of the SMS), and the scope of those 

persons and entities that will be expect or encouraged to provide information for inclusion in the 

airport’s SMS database. This section of the memorandum considers issues related to an airport 

operator’s decision to extend its SMS to include its tenants and their operations, and the legal 

issues presented by such a decision. 

In general, the airport operator owns and controls the airport and thus has the 

ability to order its relationship with its tenants and others permitted to operate on the airport 
 20 

BOST 05-22-09 

through several different means, including agreements voluntarily entered into between the 

operator and its tenants and service providers, as well as through adoption of minimum standards 

and/or airport-wide rules, regulations and directives. However, there are certain legal limits to 

the requirements that an airport operator may impose upon such entities. These include 

constitutional limits on the impairment of existing contracts, limitations on the ability of a third 

party to regulate labor arrangements, and FAA requirements that prohibit unjust discrimination. 

a. Agreements. In general, two parties are free to enter into a contract that 

would include all of the terms of a SMS, such as analyzing systems or activities of the tenant, 

identifying hazards and risks relating to such systems and activities, including requiring 

reporting by airline employees, and mitigating the risks identified. Thus, use of agreements, 

such as an airport use and lease agreement or standardized agreements with ground handlers, is 

likely the best way to achieve consistent and full compliance with an airport’s SMS as it relates 

to third parties. In addition, an agreement can provide for the recurring follow up reporting and 

analysis that is necessarily a significant part of SMS. Only where an agreement breaches a 

provision of law could it be voided. A final benefit of using agreements for establishing the 

terms of SMS interactions with third parties is the ability to use incentives as well as penalties to 

encourage cooperation with contractual provisions. As long as such incentives are offered in a 

not unjustly discriminatory manner, airports may use “carrots”, such as reduced fees or more 

liberal terms, in conjunction with traditional “sticks”, such as events of default or monetary 

penalties, to encourage tenants and other third parties to comply with contractual terms or to 

achieve other goals, such as become IOSA or ISAGO-certified. 

Nevertheless, certain provisions of an agreement may not be easily enforced or 

monitored, such as requiring reporting of hazards or incidents that occur only between tenant 

employees within a tenant’s leasehold. There are several additional drawbacks to the use of 

agreements as the primary way to implement a wide-ranging SMS program, however. The first 

is that many, if not most, airports enter into agreements with a term of years. Thus, at any given 

time, the airport may be in a position to negotiate a new agreement with certain of its tenants, but 

it is often difficult to negotiate all of the relevant agreements within a short period of time. The 

second is that agreements are generally the subject of negotiation, rather than imposed upon, the 

counterparty. Thus, achieving consistent terms can often be difficult, especially in the context of 

an issue that can be as sensitive as SMS, as different parties will have different concerns, and 

leverage, and likely seek to address certain key issues in different ways. 

 b. Minimum Standards. The FAA recommends that all airport operators 

adopt minimum standards that set a threshold for the requirements for operating at the subject 

airport. Often, different minimum standards are adopted that apply to different types of 

operations, such as commercial service air carriers, all-cargo carriers, FBOs, limited service 

providers and the like. Generally, minimum standards are applied either as a regulation adopted 

by the airport operator, or as a pre-condition to operation at the airport. For parties other than 

airlines, minimum standards can be an effective way to provide for a uniform set of requirements 

and standards that must be met in order to be granted the privilege of operating at an airport. 

Where, however, a pre-existing agreement incorporates minimum standards, as modified from 

time to time, into the agreement, problems can arise if such minimum standards seek to impose 

requirements that may interfere with a third party’s other obligations, such as the terms of a 
 21 

BOST 05-22-09 

collective bargaining agreement. Thus, minimum standards are often most effectively used as a 

floor, with which a service provider must comply in order to commence operations at an airport. 

Application of minimum standards to an entity already operating at an airport can create 

problems, either where the current operating agreement does not expressly incorporate 

amendments to the minimum standards in effect at the time the agreement was entered into, or 

where, even if incorporated, such amendments conflict with other requirements binding upon the 

operator. In addition, it can be difficult, if not impossible, under federal aviation law and 

regulations to justify application of minimum standards to exclude an air carrier from operating 

at an airport, although the manner in which a carrier operates may be regulated though minimum 

standards. 

 c. Regulations. The third common means of regulating tenants and others 

operating at an airport is the adoption of regulations. The primary advantages of the use of 

regulations to order behavior are that the terms and conditions will be uniform among all 

regulated entities, and the airport operator, which is a generally a governmental entity, often has 

punitive power to enforce such regulations, such as the imposition of fines or, in some cases, 

even criminal penalties for violations. The disadvantages to the use of regulations are that the 

process for adopting a regulation can often be cumbersome and time-consuming (although 

negotiating multiple agreements can be even more difficult), and the prohibition under the 

United States Constitution of the adoption of laws and regulations that would abrogate an 

existing contract. Thus, regulations may not be enforced which would retroactively seek to alter 

certain contractual provisions already in force between an airport tenant or service provider and 

another party, such as collective bargaining provisions. One way to avoid the time-consuming 

regulatory process may be for an airport to issue an “airport directive”, which is often a short 

term mandate issued by the airport’s Director of Aviation to address an operational, safety or 

security issue. 

B. Just Culture and Safety Management Systems. 

1. Nonpunitive Environment and a Just Culture 

A critical and fundamental component of any safety plan is the expectation that 

errors will be reported so that the organization can compile information, analyze data, 

communicate trends, and develop tools for resolving events and ultimately implement procedural 

and systematic change. It is therefore imperative to the success of any safety program that the 

organization’s management style in dealing with error ensures that there are no reprisals and no 

impediments to information flowing freely to management and leadership.54

 Reporting will not 

occur if staff believes they will be punished for doing so. In fact, punishing employees for 

making a mistake emanates from the misconception that the individual is to “blame” for his or 

her mistake and that punishment will lead both to improved performance in that individual and 

serve as a deterrent to error in others. Abundant evidence in human factors and cognitive 

 54 See, e.g., M. Meaney, Error Reduction, Patient Safety and Institutional Ethics Committees, 32 

Jour. of Law, Medicine & Ethics, No. 2, pp. 358 – 362 (comparing “Safety Culture” to a Culture of Blame”). 
 22 

BOST 05-22-09 

 

psychology literature recognizes that most human errors are symptoms of underlying system 

failures, not personal failures. 

The healthcare industry looked to aviation safety models in order to improve 

patient safety and found that aviation industry leaders “consider safety to be the dominant 

characteristic of organizational culture”.55

 Over the past decade, the healthcare industry has 

diligently worked to transform its organizational culture to shift toward a patient safety culture. 

Just as the healthcare industry studied the aviation and energy industries to improve patient 

safety, airports and other participants in the aviation industry can learn from the great strides that 

the healthcare industry has made in successfully adopting a widespread patient safety culture. 

In the healthcare industry, patient safety necessitates that organizations attain a 

“just culture,” which is an atmosphere of trust where people are encouraged and even rewarded 

for providing safety-related information, but which is also clear about where the line must be 

drawn between acceptable and unacceptable behavior.56

With the significant emphasis on patient safety, the healthcare industry can now 

provide models for the aviation industry. In order to develop an effective patient safety culture, 

healthcare organizations strive to achieve the following characteristics of a blame-free 

environment, wherein the organization: 

● embraces the concept that those under its employ or who practice in its 

facility do not purposely seek to create errors, rather, that most errors 

occur as a result of ineffective, improperly designed, or flawed systems; 

● seeks to develop human resource policies and procedures that support the 

realization that most errors are not the result of individual failure, but 

system failure; 

● develops ways to reward, rather than discourage, reporting of errors or 

patient-safety concerns; 

● celebrates success at improvement in the reporting of patient-safety 

concerns and errors, as well as how such disclosure has been used to make 

improvements in systems to prevent the future possibility of error; 

● purposely works to alter its mindset about errors and its behavior with 

respect to errors, possibly by changing the language it uses to talk about 

patient safety and errors; 

● seeks to engender an environment where reporting about errors and patient 

safety is the norm, by actively creating an environment where practitioners 

55 Id. at 361. 

56 J. Reason, Managing the Risks of Organizational Accidents (Ashgate Publishing Ltd., 1997). 
 23 

BOST 05-22-09 

 

and employees do not fear retribution for raising concerns or reporting 

errors; and 

● implements methods of feedback to learn from error. 

In the healthcare industry, it is ideal that error reporting takes place through an 

established reporting system supported by policies and procedures that are endorsed by the 

governing board and communicated to staff. The reporting system adopted should be clearly 

articulated to staff and include a description of which events are reportable, the time frame 

within which they are to be reported, and a readily available, easy-to-use format/form that is 

universal throughout the organization. The reporting system also should allow for feedback to 

clinicians and staff on the risk-reduction efforts made by the organization in response to reported 

events. 

JCAHO, the hospital accreditation agency, expressly recognizes that the leaders 

of an organization are responsible for setting the tone such that internal reporting occurs within a 

system where there is “minimalization of individual blame or retribution for involvement in a 

medical/health care error.”57

 While JCAHO does not require an amnesty policy for accredited 

providers, many patient-safety experts recommend a policy that allows staff to come forward and 

report errors as required by the organization and face no direct impact on their employment for 

doing so. 

This is not to say that an organization that adopts a just culture eliminates 

individual or organizational accountability. Organizations can and should adopt a disciplinary 

model that centers on accountability and integrates the notions of individual and organizational 

culpability (e.g., human error, negligence, recklessness, and intentional acts) with the type of 

error (e.g., rule-based, skill-based, or knowledge-based).58 To determine whether a particular 

behavior is culpable enough to involve disciplinary action, the disciplinary policy should require 

that each safety event be assessed individually. The disciplinary decision-making model many 

healthcare providers select is based on staff risk-based behavior that incorporates the concepts of 

the civil tort liability system (i.e., negligence, gross negligence or recklessness). The threshold 

for discipline is generally determined to be negligence where the staff member had no conscious 

disregard of a known risk; instead, the staff member should have known, but was unaware, of the 

risk he or she was taking. Gross negligence or recklessness should result in disciplinary action to 

deter intentionally unsafe acts. (Excerpt taken from Patient Safety Handbook, June M. Sullivan, 

JD, Med OT/L, MT (ASCP) and Renee H. Martin, JD, RN, MSN). 

It is widely recognized that implementing a just culture necessitates the full 

involvement of all levels of the organization, as well as education and training of all levels of 

57 Revisions to Joint Commission Standards in Support of Patient Safety and Medical/Health Care 

Error Reduction (JCAHO 2002). 

58 See generally D. Marx, Patient Safety and the “Just Culture”: A Primer for Health Care 

Executives (Columbia University 2001); J. Reason, Managing the Risks of Organizational Accidents (Ashgate 

Publishing Ltd. 1997). 
 24 

BOST 05-22-09 

management and leadership. Counsel must work closely with human resources to ensure that 

applicable personnel policies address corrective and remedial actions that address individual and 

organizational process weaknesses. 

2. Safety Management Systems: Patient Safety and Quality Improvement Systems in 

Healthcare 

The Patient Safety and Quality Improvement Act (“PSQIA”) became effective on 

January 19, 2009.59

 Congress’ goal in enacting PSQIA was to create opportunities for providers 

to share patient safety information with independent entities, called patient safety organizations 

(“PSOs”), which can analyze and aggregate patient safety data from multiple providers and use it 

to identify patterns that suggest underlying causes of patient risks and hazards. To encourage 

providers of healthcare services to share potentially sensitive information, PSQIA made 

particular information shared with PSOs, known as patient safety work product (“PSWP”), both 

privileged and confidential. The final Rule enacts the framework by which the government will 

certify PSOs, clarifies the scope of privilege and confidentiality granted to PSWP, and describes 

how the government will enforce compliance with these provisions.60

 PSQIA and the concepts it 

embodies could serve as a template for the collection, protection, aggregation, and analysis of 

sensitive SMS data. 

 59 Pub. L. 109-41, 42 U.S.C. §§ 299b-21 – 299b-26 

60 42 CFR Part 3. 
 25 

BOST 05-22-09 

C. Recommendations for FAA’s Proposed Regulations. 

1. Recognize Need to Protect SMS Data. As discussed above, if information 

collected as part of a SMS is protected from disclosure, it is likely that there will be more and 

better reporting of safety-related information. Ideally, Section 40123 will be amended, perhaps 

as part of the next FAA reauthorization legislation, to permit SMS information to be maintained 

in confidence, expressly not subject to either state or federal FOIAs. However, absent such an 

amendment, it may be possible for FAA to adopt regulations protecting SMS data from 

disclosure and for airports to develop systems that adequately protect SMS information from 

disclosure. For the reasons stated above, we recommend that the FAA seek to develop its SMS 

regulations to permit such protection. 

 Absent Congressional action, such a system likely would have several parts. 

First, we urge the FAA to adopt regulations which would protect sensitive SMS information 

from disclosure to the greatest extent possible. Second, the FAA’s rulemaking should divide the 

responsibility for developing and providing SMS information among the various parties subject 

to the FAA’s regulatory authority: air carriers, air traffic control and airport operators. SMS 

information should be de-identified, to the greatest extent possible, before transmittal to the 

FAA. Rather than providing SMS data directly to the FAA, it may be better for a private, third 

party to hold such data and to aggregate it. Thus, the FAA and all participants in the SMS 

programs would be able to access and analyze a rich store of national data. In addition, the 

participants would be able to use the SMS data collected from their own operations for analysis 

and trending. Although it is probable that most airports will not be able to protect the SMS 

information that they gather from disclosure under their state’s FOIA, if SMS responsibilities are 

divided among the various entities operating at an airport, the private entities will be able to 

preserve the confidentiality of their SMS data, while the public entities should be able to 

establish a SMS data-collection process that de-identifies that data before it is entered into the 

database. 

2. Make SMS Reports to FAA Non-Punitive. Similar to the ASAP program, we 

recommend that SMS information provided to FAA not result in punitive action unless such 

information demonstrates that certain identified laws or regulations have been violated. As 

discussed above, non-punitive reporting programs have been shown to lead to better and more 

complete reporting. The goal of SMS should be to encourage the development of a robust 

system for reporting and analyzing safety-related information and the mitigation of identified 

risks. Thus, to encourage all participants in the SMS programs to undertake these programs 

fully, the reported SMS information should not be used to penalize airport operators, or other 

participants in SMS. 

3. Allow SMS Data to be Aggregated. As noted above, we recommend that all SMS 

information provided by various parties, including airport operators, air carriers and air traffic 

control, be provided to a single source and aggregated and that all SMS participants be given 

access to and the ability to analyze the data. This will likely require that the FAA’s rulemaking 

also specify a format for reporting such data so that it will be reported in a consistent manner and 

can be accessed and analyzed by multiple participating parties. 
 26 

BOST 05-22-09 

4. Establish Criteria for Risk Analysis and Mitigation. To assist airport operators 

(and others required to undertake SMS programs) in developing consistent methods for risk 

analysis and approaches for mitigation, we recommend that the FAA provide clear guidance 

setting forth the criteria for ranking the risks associated with identified hazards and specifying 

the minimum rating when risks must be mitigated and ratings below which mitigation is either 

not required or is at the discretion of the airport operator. Although such criteria will not 

eliminate the risk to airport operators posed by an action for negligence arising from an accident 

caused by an identified but unmitigated risk, such a consistent approach should provide a 

standard of reasonableness so that, if such standards are adhered to by airport operators, should 

provide significant protection from negligence actions. 

5. Allow for Phased Implementation. We recommend that SMS be phased in three 

ways: first, as to the areas of each airport which must be subject to SMS, second, with respect to 

the airports themselves, and third, with respect to the elements of SMS itself. Thus, we would 

recommend a different, more aggressive, schedule to implement SMS for large hub airports that 

have more resources, and pose greater risks simply due to more operations, than for small hub 

airports. We also recommend that the rulemaking permit airports to adopt SMS in phases, 

beginning with the safety statement and identification of the senior safety staff person, and 

proceeding through the other steps necessary to establish a complete SMS. Finally, we 

recommend that airport operators be permitted to undertake the SMS hazard and risk analysis for 

one aspect of the airport prior to undertaking this process for the full airport. 

6. Coordinate Airport SMS with Other Programs. As noted above, we recommend 

that the FAA issue simultaneous SMS regulations for all participants in the commercial aviation 

system regulated by the FAA and that these regulations provide very clear guidance with respect 

to the boundaries among each of these participants’ responsibilities. Thus, for example, an 

airport operator’s SMS program could cover the operations on common apron areas up to the 

point where aircraft are handed off to the airport’s control tower, while the control tower’s SMS 

would cover operations on the portions of the airport over which the control tower exercises 

control, including taxiways and runways, and air carriers’ SMS would apply to operations within 

the ramp areas controlled by the carrier. Of course, there will be overlap between the areas 

covered; for example, an airport operator likely should be responsible for hazard identification, 

risk analysis and mitigation relating to matters under its control, such as pavement condition, 

while air traffic control may be responsible for hazard identification, risk analysis and mitigation 

of operational matters on the same pavement areas. Further, mitigation of risks likely will 

require cooperation and coordination among the various entities. For example, an operational 

risk identified by air traffic control may require the airport operator to undertake a capital project 

to mitigate the risk. We strongly recommend that the FAA engage in a dialog regarding the 

proper allocations of responsibility and means of coordination with the affected entities during 

the rulemaking process. 

7. Make Funds and Guidance Available. As noted in the discussion above, through 

the process of hazard identification and risk analysis that are at the heart of SMS, it is very likely 

that following the initial adoption of SMS, there will be risks identified that require mitigation, 

and at least some of these mitigation actions will require an infusion of capital, either to 

construct or reconstruct facilities required to mitigate identified risks or to undertake programs 
 27 

BOST 05-22-09 

and develop processes to mitigate identified risks. We recommend that, to the greatest extent 

possible, the FAA’s rulemaking make such mitigation measures eligible for funding with Airport 

Improvement Program (“AIP”) grants and with passenger facility charges (“PFCs”) and, further, 

we recommend that FAA seek significant additional AIP funding from Congress for such 

programs, especially in the early years after adoption of SMS, when it is likely that the most 

active mitigation measures will be undertaken.

Finally, we recommend that the FAA continue to provide guidance, through seminars, 

studies and outreach, on the development and implementation of SMS. Given the wide variety 

of configurations of airports, of the types of operations at airports and of the airports themselves, 

there can be no “one size fits all” approach to SMS. Thus, each airport operator will have to 

develop a SMS that fits the needs of its airport. As it has to date, FAA can provide guidance and 

help disseminate information regarding all elements of SMS as well as continue to sponsor 

research projects to further develop a variety of “best practices” for use at the wide variety of 

airports in the United States.

Conclusions

 Implementation of SMS has the potential to be a significant step forward in 

promotion of aviation safety and is likely to result in lives saved, fewer personal injuries and 

reduced property damage. However, SMS also has the potential for increasing exposure for 

those entities forced to adopt SMS. Thus, careful consideration should be given to the design 

and implementation of the regulations and related systems that will comprise the FAA’s 

integrated SMS for airport operators, air carriers and air traffic control, so that the objectives of 

SMS can be achieved while minimizing additional exposure and unnecessary costs. Airports and 

other participants in the aviation industry should closely monitor and become involved in the 

FAA’s rulemaking process for SMS, and airports should exercise care in development of their 

SMS programs in order to address the legal issues described above. 

 SMS will be most beneficial when a wide range of information and data are 

reported and made available, so that all applicable hazards are identified, risks analyzed and, if 

appropriate, mitigated. In order to encourage reporting, data gathered under SMS should be 

protected from disclosure, to the greatest extent possible, and de-identified and aggregated in a 

manner that allows multiple parties involved in the air transportation system to access such data 

for appropriate analysis and action. Ideally, Congress will amend 49 U.S.C. § 40123 to permit 

FAA to exempt from all disclosure under state and federal FOIA data provided under an SMS, 

except where there has been a breach of law or regulation. We believe that airports and other 

members of the aviation industry should advocate for legal protection of SMS data from 

disclosure. 

 Because implementation of SMS programs will heighten awareness of certain 

risks related to aviation safety, those entities participating in the SMS programs will face 

increased exposure for negligence (and potentially, other) claims in the event of an accident. To 

appropriately minimize such exposure, FAA can and should take several steps. First, FAA 

should clearly divide responsibilities among the various SMS participants; air carriers, air traffic 

control and airport operators. Second, FAA should provide clear guidance for risk analysis and 
 28 

BOST 05-22-09 

for the requisite undertaking of mitigation, versus elective mitigation. Airport operators should 

establish compliance programs and carefully adhere to the FAA’s guidance. Through 

compliance with the FAA’s guidance, airports should be able to establish the reasonableness of 

the actions taken. Accordingly, when incidents do occur that were foreseen through the hazard 

identification as being possible but were determined through properly undertaken risk analysis as 

being either unlikely to occur or if occurring, unlikely to result in serious injury or property 

damage, it can be demonstrated that is was also reasonable not to take action to mitigate such 

identified hazards. Finally, Airports should strongly advocate that Congress and the FAA 

expand the permitted uses of AIP grant funds and PFCs to cover mitigation of risks identified in 

SMS analyses, and that they increase funding available through the AIP and PFC programs for 

such purposes. 

 Rather than require airport operators to assert control over third parties operating 

at airports in order to undertake a SMS program applicable to the entire airport, airports and 

other aviation stakeholders should urge FAA to issue guidance for all parties operating at an 

airport, and to clearly divide SMS responsibilities among them. Further, airports should be 

permitted to implement SMS in a phased approach, so that the operational and financial 

consequences of adoption of a SMS program do not impact airport operators (and rates) all at 

once, and airport operators have the opportunity to develop a program rationally.