What privacy? They’re recording conversations made in company livery while getting paid on the job, with notice of that fact in advance. If the recorders were recording them after they exited the plane that’d be a cognizable privacy violation, but that’s not what we’re talking about here.

This is exactly the Overton window I mentioned.

Your opinion/take on this is relatively new. While technically (legally) correct, there was a whole lot of social pushback on this statement or idea even in my lifetime.

This take on workplace privacy has not been the social standard for very long, and is certainly not a universally shared opinion.

Edit: To avoid comment spam here on an irrelevant side-subject. I didn't say it was a regression or a bad thing. I simply am pointing out it has massively shifted in a relatively short period of time. There was serious public debate about introducing these at all just a generation ago. Now it's seen as completely normal to have your entire workday recorded with zero expectation of privacy. It's a rather drastic shift in society.

Are we willing to have our cubicle conversations recorded while we’re on the job to increase the data available in the event of a software defect?

While I value my privacy at the office, these kinds of comparisons need a bit more work to become apples-to-apples. Consider:

1: Are we clicking buttons that could kill hundreds of customers without any chance of it being stopped by external oversight and review? To underscore the danger, is the cubicle secured by an anti-terrorist door which was installed after thousands died when terrorists attacked a similar cubicle before?

2. Are the recordings specially sequestered and regularly overwritten by default, as opposed to being kept indefinitely in a big database for anybody in my reporting chain to look at on a whim?

_____

For example, if I was "coding" inside the control room of a nuclear power plant and developing scripts to help automate the next hour of control-rod movements, I think I would be wayyyy more accepting of a 24-hour disaster recording loop in a box for the US Department of Energy.

Don't forget frequently leaked out of context, for all the laymen and public to gawk at, and cast judgement upon those involved. "This is normal" say industry experts, "and your second quote is missing some very important context. None of which most HR departments will hear about, leaving me objectively worse off searching for a new job."

Tech-bros will read this and say nobody died due to their software, but that's neither true nor the point. Giving every supposedly private interaction at work a chance to leak only sounds reasonable when it's not you

It depends. Are people’s lives at stake?

Are you willing to have a camera pointed at you - not other drivers, you - as you drive to and from work every day? People's lives are at stake, driving is objectively more dangerous than flying, and it can be tied to work by the simple reason that you wouldn't be behind the wheel if you weren't heading to or from work.

This smacks of "Privacy for me but not for thee", to say nothing of the effect it would have on the perpetual low-level pilot shortage due to things like working conditions.

It depends. Am I at work and being paid as a professional driver?

> the perpetual low-level pilot shortage due to things like working conditions.

There are a lot of pilots “waiting in the wings” at smaller carriers, currently being paid peanuts, to get nice cushy jobs at major carriers with union protections who won’t mind having their voice recorded and stored for 24 hours while on the job behind the yokes.

The vast majority of pilots at those regional carriers are already represented by a union: ALPA.*1

That union opposes cockpit video monitoring and has opposed the extension of CVR recordings.*2

*1 - https://www.alpa.org/en/about-alpa/our-pilot-groups

*2 - https://www.flyingmag.com/faa-proposes-extending-cockpit-voi...

Any Zoom or Slack communication is recorded and available...so is this not the state we're in today?

This is not just the state of things in most companies, but it is a legal requirement in companies subject to the Sarbanes-Oxley Act.

fwiw I don't particularly like either state of affairs, but pragmatically some business interns somewhere at JP Morgan has all of their communication recorded and preserved for regulatory oversight, the fact that pilots don't is a testament to their union, and not because it wouldn't be considered normal in today's working world.

The pilots have a union. A lot of people here seem to like the idea of unions. The union negotiates with the airlines (and FAA) over working conditions, rules, and terms. The pilots have privacy concerns about the voice recordings, the union negotiated that, and the compromise was the two-hour recording.

I think the problem is that the CVR is supposed to stop after landing but there are many successful landings where this is skipped, either because of overwork like here or because the pilots discounted the situation.

Every airplane type is a bit different, but typically, if the aircraft is powered then the CVR is recording. Even if it’s at the gate with nobody onboard— the CVR does not know nor care.

The only way to stop the CVR from recording is to depower the airplane (which is one of the steps you take prior to an emergency evacuation) or to pull the circuit breaker if the airplane needs to stay powered.

A pilot would never pull the circuit breaker without confirmation from management or safety to do so. It’s just not done routinely. Depending on the airline, it may not even be the pilot’s responsibility to do so. Every airline has a binder (likely, several binders) full of procedures to follow after a NTSB-reportable accident. No one person is expected to do the job of many.

> recordings get pulled on successful landing after declaring emergency

Declaring an emergency (standing alone) should not be a reason to pull the CVR, IMO. There should be an aviation-safety related reason at a minimum. (Declaring an emergency to facilitate expedited handling for a passenger medical emergency should not trigger a need to preserve the CVR recordings, as one concrete example.)

Additionally, this might make pilots more reluctant to declare an emergency, which would have a negative impact on safety.

Indeed! It's mind-blowing the number of conversations I've had online and in-person where pilots say something like "I didn't want to declare an emergency, because I didn't want to do a lot of paperwork." Invariably, someone (sometimes me) asks "for those of us who have declared an emergency, how much paperwork was involved?"

In ~95% of declared emergencies, there is zero paperwork or followup required. In over half of them, the pilot elected to (voluntarily but advisedly) fill out a NASA ASRS form (which is about a 15 minute task and something they probably would have done under the same circumstances without the emergency declaration). ( https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf )

This might well be somewhere that you can improve with training. It reminds me of the situation for CAPS (the Cirrus Airframe Parachute System, a ballistic parachute for Cirrus small planes). Once you train pilots to specifically plan to use CAPS when things go wrong, rather than relying on them realising in time after something has gone wrong but before fatal injury is inevitable that the CAPS can save them, you get significant improvements in save rates.

It may be that training pilots specifically to declare emergency as soon as there's a problem rather than waiting until they're sure they can't solve the problem and need outside assistance will improve overall safety outcomes.

There's a tragic case I watched a safety video about where the private pilot, very low on fuel, asks if he can land at a (closed) airbase whose traffic controller he's talking to. The base's controller says he cannot land unless he's an emergency. That was his last chance to survive, all he needs to do is say he's an emergency - "I'm on fumes, I need to land right now" she'd turn the base's lights on, he puts it down on a strip that's not meant for civilians and maybe he spends the evening explaining to some MPs how he fucked up - but he's not dead. Instead he accepts this as a "No" and flies on for a few more miles until he runs out of fuel and crashes.

Indeed the improvements in Cirrus training and communications has had a fleet-wide positive effect. I do think calling all of the no-life-lost deployments "saves" is disingenuous at best and more likely intentional shading of the truth. We don't call every airbag deployment without loss of life a "save" but we can draw database-wide conclusions about how many net lives were saved. In CAPS case, I don't believe the most accurate estimate of lives saved (vs a counterfactual where the airplanes did not have CAPS) is 258 across 126 events, as many of those occupants would have also survived the event without CAPS.

PS1: I saw what I think is that same ASF video ( https://youtu.be/fLlWf-Fk_YM?t=10m ). Really frustrating, especially how obvious it was an emergency to everyone except the two people on the radio (where the bulk of blame belongs to the pilot of N4975S.

PS2: One of my instructors was in CAPS Event #59. I talked to her afterwards; she was a fan. :)

I think the airbag comparison is a bit off, airbag deployment is automatic, so it may be that all the humans involved were like "This is fine" but you tripped the impact limits and so now there's an airbag deployment, CAPS isn't like that, a human has made the conscious decision to deploy.

Yes, but the outcome is still a statistical improvement over a non-zero baseline. Some of the stricken Cirrus would have been landed with zero fatalities (likely including my flight instructor's case).

Calling them all "saves" is overstating the incremental benefit.

The paperwork is often NOT government mandated; there may be corporate mandates, too around it.

(I've technically declared pan-pan once, there was no paperwork.)

>I think those that dismiss this concern entirely are the folks who cannot think critically

I will absolutely, unreservedly dismiss the concern of a pilot for privacy in the cockpit because I can think critically. The notion that someone deserves privacy in the cockpit of commercial aircraft is outrageously silly and utterly indefensible. Pilot your own personal aircraft if you want that privacy.

And there is absolutely an "Overton window", but it is wrong to think that whatever way it moves is a regression or worsening (which is the classic "everything is always getting worse" melodrama). Sometimes the way things are is not rational or optimized, but just are.

The 2 hour thing was nothing but a technical limit (a literal loop of magnetic tape), and every other justification is retconning.

> The 2 hour thing was nothing but a technical limit (a literal loop of magnetic tape), and every other justification is retconning.

The 2 hour thing was 30 minutes when it was magnetic tape. It moved to digital a while ago and that's when the unions negotiated it to 2 hours after some incidents. The 2 hour limit was not based on anything technical that I'm aware of.

The privacy stuff is absolutely not reconning. Heck, it was pretty much the most talked about topic over the water cooler when I was doing some IT contract work for ALPA in my teens.

My memory is certainly fuzzy but not quite that fuzzy.

> I think those that dismiss this concern entirely are the folks who cannot think critically.

So if you don't agree, you can't think critically. Got it.

Or maybe, we did think about it critically and simply don't agree.

There are various way this can be solved. We have modern encryption that could make this far, far safer then it is today. We have methods from data leaking. We have process to only allow data to be decrypted if required.

This would actually force us to really think critically about who has what access when. In planing this the airlines, unions, FAA should sit together with some technical experts and think of this critically.

This seems less complex to me then a modern high bypass turbo engine.

> There are various way this can be solved. We have modern encryption that could make this far, far safer then it is today. We have methods from data leaking. We have process to only allow data to be decrypted if required.

There are not. You cannot solve a social problem with a technical solution. If the data exists, it can and likely will be used.

> This highlights a complete failure on multiple levels and an inability to critically think about the problem space. How much time was spent implementing a system that under most circumstances where it would be needed would render itself entirely useless?

I was responding in particular to this. It does not highlight an inability to think critically unless you value privacy at zero and only look at these recordings as a technical problem. Under most circumstances when it's needed this system has functioned exactly as designed. You read about the failures because they are the exception. Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement.

I would actually agree with you in general if for not that comment. It simply means we disagree. But it surely does not mean no one has thought critically about this subject when it was introduced or since.

> There are not. You cannot solve a social problem with a technical solution. If the data exists, it can and likely will be used.

Except in reality we use often use technical solution to solve social problems. Or rather technical capabiltiy gives us the means to approach a social problem in a different way.

> unless you value privacy at zero

The assumption that privacy is 100% impossible if something is recorded and stored is simply categorically false.

> only look at these recordings as a technical problem

I didn't do that. I suggested that the FAA, the Unions, the Airlines and the manufactures sit together and come up with a solution of what the exact data access policies are.

> Under most circumstances when it's needed this system has functioned exactly as designed.

And yet when going threw the history of air incidents, there are lots of cases where this isn't the case. Most isn't good enough.

> You read about the failures because they are the exception.

Sure and a server crashing is the exception, and yet somehow most of use still run 2 server if we want things to work continuously.

The argument 'mostly its fine, its just occasionally that a couple 100 people die and we don't know why' just doesn't work for me. Yes in most cases its not that dramatic, but it would still be very useful.

> . Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement.

Fair.

Seems like a decent compromise would be to record a 2 hour loop but as soon as the words "declaring emergency" or similar are detected it stops looping and just records everything till the storage is full. Say 25 hours worth. The point being that at the end of 25 hours it's no longer recording as there is no chance of anything relevant still being said at that time.

Could even have some indicator in the cockpit that it's in emergency mode for the pilots to turn it back to loop mode in case of a false positive.

Pilots aren’t stupid. You have created a disincentive to declare an emergency and added to the crew workload in an emergency. Human systems are complicated.