1

Engineers Who Kill: Professional Ethics and the Paramountcy of Public Safety Author(s): Kenneth Kipnis Source: Business & Professional Ethics Journal, Vol. 1, No. 1 (Fall 1981), pp. 77-91 Published by: Philosophy Documentation Center Stable URL: http://www.jstor.org/stable/27799733 . Accessed: 29/03/2014 23:17

Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at . http://www.jstor.org/page/info/about/policies/terms.jsp

. JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of content in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new forms of scholarship. For more information about JSTOR, please contact [email protected].

.

Philosophy Documentation Center is collaborating with JSTOR to digitize, preserve and extend access to Business &Professional Ethics Journal.

http://www.jstor.org

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill: Professional Ethics and the Paramountcy of Public Safety

Kenneth Kipnis

Thou shalt not kill.

Exodus, Chapter 20.

Engineers shall hold paramount the safety, health and welfare of the public in the performance of their professional duties.

Engineers' Council for Professional Development, Code of Ethics.

The codes of ethics of a number of engineering professional societies1 begin with

language that states that engineers are required in their professional work to hold

paramount the safety of the public. It is not difficult to appreciate why those in

engineering should feel obligated to endorse such a statement nor is it hard to

understand why it is generally placed first in the codes. For whenever we drive a car, or fly in an airplane, or take an elevator, or use a toaster, or cross a bridge, or do

The work upon which this paper was based was supported in part by the National Science Foundation and the National Endowment for the Humanities under Grant Number OSS-7906980. Some of the ideas here were developed during participation in the National Project on Philosophy and Engineering Ethics (at Rensselaer Polytechnic Institute), funded by the National Endowment for the Humanities. For comments and encouragement, I am indebted to Stephen H. Unger, David Davis, Sandra Ward, Robert Bruder, Vivian Weil, Patricia Werhane, T. Paul Torda, Andrew G. Oldenquist, Victor Paschkis, Edward E. Slowter, Win Nagley, Frank Tillman, Eliot Deutsch, Edward D. Harter, Fred Bender, Deborah Johnson, and Sara Lyn Smith. Earlier versions of this paper have been read at the American Society of Mechanical Engineers Century 2 Conference in San Francisco (August, 1980) and at the Conference on Business and Professional Ethics sponsored by Loyola University and University of Illinois at Chicago Circle (May, 1981).

Copyright Kenneth Kipnis

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

78 Business & Professional Ethics Journal

any one of a thousand daily tasks, we are relying upon the work that engineers have

done, entrusting our lives to the products of their special skills. As a profession?or

perhaps, more properly, as a profession in the making?engineers want to alert

themselves to the responsibilities created by the public's reliance upon them. A world

in which the safety of the public was routinely subordinated to other concerns would

likely be a very dreadful world indeed. And so members of the community need to

be assured that engineers?who can both cause and avert grave public damage?have the same concern for safety that others are expected to have, especially those others

in positions of trust. Andrew G. Oldenquist and Edward E. Slowter have seen the

codes as emerging from the stewardship bestowed upon the profession by society: The public's health, welfare and safety depend on the knowledge, competence, and integrity of all engineers responsibly involved in any given engineering activity. These engineers do not merely possess special knowledge and capabilities; like judges and physicians they have exclusive stewardship over their special knowledge. Our society has said that one must be an engineer in order to do certain activities, and that only other engineers are in a position to evaluate the quality of the engineer's performance. Professional integrity is especially vital for any professional group that is self-regulating on expert matters and to whom society has given stewardship over important knowledge and activities. A code of ethics serves to remind individuals how important integrity is in a self-regulating profession. It lays out the specific matters deemed most important in the collective wisdom of the profession, and in solemnly promul gating and enforcing the code, notice is served that the elements of the code are to be taken seriously.2

Professionalism thus involves more than simply expertise; it involves a public commitment to some set of significant social values. This commitment forms a part of the reason for public reliance upon the profession as the means by which certain

skills and knowledge are applied within the community. Hence, if engineers wish to

be recognized as professionals, it is necessary for them to declare publicly their

allegiance to certain norms that define their commitment to the public.3 These norms that are articulated in codes of ethics are of two basic types: what

we may call ideals of the profession in the one case and principles of professional conduct in the other.4 The ideals are aspirational in nature, calling attention to the

central goals of the profession. They are important because they provide guidance in

the development of an exemplary professionalism. But while they can be flouted and

ignored, they cannot, strictly speaking, be violated. You can choose not to follow the

path indicated by a statement of the profession's ideals, and if you do you may never

become an exemplary professional. But that does not mean that you have broken

some rule. Principles of professional conduct, however, do provide criteria for judging when a professional has fallen culpably short of acceptable standards for the

profession. Unlike an ideal, a principle of professional conduct can be violated. It

specifies conditions under which a practicing professional violates the public trust

undertaken when he or she became a professional. While the failure to realize one's

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill 79

full potential as a professional may be lamentable, the violation of a principle setting forth the minimum requirements for acceptable professional practice is a very serious

matter, one that should merit the attention of all professionals with a stake in the

quality of their profession. When an engineering professional society asserts that engineers shall hold

paramount the safety, health and welfare of the public, it is not at first glance clear

whether what is being said represents an ideal to which engineers ought to aspire or

whether it represents a principle that engineers violate at the cost of their

professional integrity. But not much reflection is required to see that both ideals and

principles are involved. It is arguable that the very highest achievements in

engineering have been those in which the ambient levels of safety, health and welfare

have been improved. And it may well be that engineers share a common and firm

commitment to continued progress in these areas. In these two ways, the profession

may have as an ideal a devotion to the furthering of these goods. And yet, because

it is an ideal, the engineer who cannot point to any way in which he or she has

contributed to improving safety, health or welfare is not thereby convicted of

unprofessional or unethical conduct. If a charge of unethical conduct is to be

warranted, there must be a principle of professional conduct that can be violated. If

engineers are required to hold paramount the safety, health and welfare of the public, does that mean that there are specific acts that engineers are not permitted to

perform? Is there a point at which the conduct of an engineer is professionally

unacceptable, given the language of the codes? The answer seems to be that, though

engineers are not culpable if they merely fail to make contributions to public safety and the rest, they are culpable if they act as a clear menace. To hold paramount the

safety, health and welfare of the public precludes, at least in most cases, acting so

as to undermine those values.

In what follows, I shall begin the task of fleshing out what is meant by "acting as a menace." The aim will be to articulate some of the principles of professional conduct that are implicit in the provision that engineers hold paramount the safety of

the public. I do not propose to cover all of the principles but, rather, I shall confine

myself to those addressed to the very clearest and most pressing cases of professional misconduct in engineering. Accordingly, because the concepts of health and disease

are both controversial and complex, I shall not discuss them at all in what follows.

And with respect to the remaining notion, safety, I shall consider only those incursions

upon safety that are reflected in an increased expected incidence of death or a higher

mortality rate. For a concern with public safety has to mean, at a minimum, that

one will not participate in the killing of others. To be as clear as possible, I am fully aware that there are more ways of being an unethical engineer than are discussed in

what follows. The claim I make is that the principles set out below, as explained, will

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

80 Business & Professional Ethics Journal

pick out only serious cases of professional misconduct. This work will show, I trust,

that the derivation of the remaining principles is a task worth undertaking. We are

concerned here, at the outset, with those engineers who represent the most serious

threat to public safety: those who kill.

Leaving engineering, let us consider a clear case of someone acting as a menace:

a man who knowingly fires a rifle at the crowded bleachers at a baseball game. The

sniper subjects a thousand innocent unsuspecting people to a risk of death and, even

if no one is killed, the public is endangered in a most serious way. Even if the

rifleman has some innocent purpose?say he is testing the rifle or trying to kill a

mosquito?he is nonetheless a palpable menace to public safety. Reasonable people do

not want others to act in this way. So it would seem that a principle committing the

engineering profession to the paramountcy of public safety would prevent one from

imposing the risk of death upon others. We might thus consider Pf as an appropriate

principle of professional conduct for engineers: P': Engineers shall not participate in projects that subject others to a risk of death.

But this principle will not do. For there are situations in which it is morally

acceptable to impose a risk of death upon another. A surgeon, for example, may

subject a patient to a 25% risk of death in an operation. If the operation provides a 75% chance of curing a condition that is 100% fatal, then, even though the surgeon kills the patient on the operating table, she is not thereby culpable. One must

consider the effects of the risky operation upon the patient's "background" risk. The

patient is safer with the operation that without it. Similarly, a community may be

plagued by mosquitoes carrying a disease that kills ten persons per year. The only way to eliminate the disease is to spray a chemical into the air that will kill the

mosquitoes. But the spray can be expected to kill one of the thousand members of

the community.5 Since, in this case, the community would enjoy an improved level

of safety despite the single expected fatality cause by the spray, the killing would, it seems, be justifiable. And so it would seem that a commitment to the paramountcy of public safety would imply a commitment to P":

P": Engineers shall not participate in projects that degrade ambient levels of public safety.

But this won't do either. The patient of the surgeon may not have a fatal disease

but, rather, one that causes great discomfort. If the patient is willing to assume a

10% risk of death (as a consequence of the operation) in order to have a 90% chance

of relief from his painful but non-fatal condition, then though the patient is killed by the operation, the surgeon is not thereby culpable. This means, of course, that the

patient has to have available to him information about the risks and benefits

associated with the surgeon's treatment. Thus, though the surgery increases rather

than reduces tne patient's overall risk of death, the surgeon's action may be morally

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill 81

acceptable if full and accurate information has been made available to the patient and

the patient consents.6

However, in the chemical spray case, securing consent can be more complicated. Let us consider three variations.7

Case i: In this case and the ones to follow, the mosquitoes are merely very

annoying. They do not carry a fatal disease. The spray will harm none of the

thousand members of the community except for one: this is you. Because of a

congenital sensitivity you will die. Leaving the community is not a possibility and

you know of your special vulnerability as does everyone else.

It would seem that, in a case such as this, you ought to have a veto over the spraying if it means you will lose your life if it takes place. The others will enjoy the benefits:

you will assume the gravest costs. If someone were willing to lay down his life so

that others might enjoy a mosquito-free existence, then perhaps the spraying should

occur. But no one should be required to die merely to improve somewhat the lot of

others.8 Here the consent that is crucial is the consent of the individual placed at

risk. Thus, information about the nature of this increased risk, if it is available at

all, should be available to that person. Case 2: The spray will have no effect on 997 of the thousand members of the

community. For three members there is, for each, a one-in-three chance that he

or she will die. (There is thus a 1/27 chance that all three will die and a 8/27 chance that none will.) You are one of the three.

Once again it would seem that those placed at heightened risk ought to have a veto.

But should the veto be exercised individually or collectively? Suppose, to focus

matters, the other two are willing to consent to the spraying but you are not. Should

you be compelled to go along with the majority in this case? I would think not. That

two others are quite willing to risk their lives seems to have nothing whatever to do

with your right to risk or not to risk your life as you see fit. And so in this case

it would appear that unanimous consent of those placed at increased risk would be

required if the spraying were to be undertaken in a morally acceptable way.9 Case 3: Each of the thousand has a 1/1000 chance of dying from the chemical

spray.

By analogy with case 2, each of the thousand is placed at heightened risk and should

therefore have a veto over the spraying. That means that each of the thousand must

be informed (or waive the right to be) and must consent if the spraying is to take

place in a morally acceptable way. And so it would seem that a commitment to the

paramountcy of public safety would imply a commitment to Pm:

Pm: Engineers shall not participate in projects that degrade ambient levels of public safety unless (1) appropriate information concerning those degradations is made generally available and (2) each of those placed at increased risk consents.

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

82 Business & Professional Ethics Journal

Pm, though it may be sound in some ultimate sense, appears to pose serious

theoretical and practical problems. These center around the condition that consent

be secured from each of those placed at increased risk. In the first place, not

everyone at risk would be in a position to grant or withhold consent. It is possible for engineering projects?nuclear devices, for example?to jeopardize unborn genera

tions, persons who cannot consent because they do not yet exist. Still other people

may be unable to consent because of incompetence: children, the retarded, the

mentally ill, the comatose. Consent from others may be invalid because of duress,

undue influence, or the high cost of withholding consent: consider the plight of

draftees ordered to use an unreasonably hazardous piece of military equipment. More

generally, it should be remembered that consent is frequently exercised in some sort

of political process. But clearly some political systems do not provide everyone

involved with a real capacity to withhold consent. The problem plainly arises within

tyrannical forms of organization but it may exist in other contexts as well. I am

uncertain, for example, that each of us has consented to the "acceptable" risk-levels

allowed by the Atomic Energy Commission. These problems, concerning the conditions

under which valid consent may be said to have been given, have been deeply

perplexing to specialists in legal and political theory.10 Protests over nuclear power installations suggest that the problems are unsettled in the political arena as well.

Thus, given the present uncertainty surrounding the issues here, it would be

unreasonable to expect engineering professional associations to make responsible authoritative judgments on issues involving the adequacy of consent. And even if we

were sufficiently clear about the issues, it would not be plain that engineers would

have responsibility as engineers to insure that risks not be imposed without proper consent: if engineers have this responsibility, they may have it as citizens, sharing it with others. What we can say is that, regardless of consent, information about risks

should not be withheld from the public. Once the information is made generally

available, the question of consent can be raised. The question cannot even be taken

up if the risk is concealed.

And so we are brought to our First Principle: First Principle: Engineers shall not participate in projects that degrade ambient levels of public safety unless information concerning those degradations is made generally available.

Notice that this principle does not require that engineers convey information about

hazards to either the public or appropriate public officials. (Engineers could, however,

comply with the principle by doing so.) The principle requires merely that engineers not participate in the covert degradation of public safety. The obligation not to

participate in the killing of others is much stronger than the obligation to prevent others from killing. But the line between these two obligations may be blurred in

cases where one discovers that one has participated in the covert degradation of

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill 83

public safety. It is now too late to withdraw: one's job is completed. In these cases,

where one shares responsibility for the creation of a life-threatening hazard, the

principle does create a duty to warn those at risk. This is not to say that engineers

are never obligated to publicize hazards that they did not help to create. To specify

the conditions under which engineers have such obligations would require analysis and

principles that are beyond the scope of this paper.

If a professional association were to adopt the First Principle as a principle of

professional conduct, one would expect it to be applied in two distinct ways. In the

first place, the principle could be used to warrant a decision to censure or discipline

the engineer who violates it. What would need to be shown in these cases would be

that the engineer either understood or should have understood that the project he or

she was working on had increased the risk of death from some above pre-existing

background levels, and that information about that increased risk had not been made

generally available. In the second place, the principle could be used to warrant a

decision to protect or defend an engineer who has been required by his or her

employer to violate the obligation specified by the First Principle but had refused to

do so.11 What would need to be shown in these cases would be that the engineer had

made a reasonable professional judgment that the project that he or she was working on was likely to increase the risk of death for some above pre- existing background

levels, and that information about that increased risk was not to be made generally

available. Professional associations must be careful not to impose a superhuman

standard of omniscience before deciding to come to the assistance'of the engineer

endeavoring to comply with the First Principle. Engineers cannot be required to know

for certain that public safety will be degraded. All that can be required is that the

engineer have made precisely the same type of informed and professionally responsible

judgment that he or she has been trained to make and hired to make. We rely upon

that developed capacity for judgment all of the time. One must be suspicious of

efforts to call that judgment into doubt and to demand more only when the safety of

the public is being judged to be at heightened risk. As the likelihood of a heightened

risk increases, and as the magnitude and probability of the damage increases, the

needs for support and involvement of the profession become more pressing. For clarity, some commentary on the language of the First Principle is in order.

"Engineers." This would include all engineers: not just those belonging to

professional associations, state registered and otherwise. It is engineers in general

who are capable of eroding public trust in engineering; not simply engineers who are

members of societies. Possibly there would be differences in the way the principles

would be enforced (non-members could not be expelled from associations), but there

might not be differences if action by professional associations took the form of public censure of unethical engineers or employers who require engineers to violate the

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

84 Business & Professional Ethics Journal

principles of professional conduct. This latter type of censure could at least serve to

warn engineers against working for such employers. These warnings are particularly

appropriate in the case of engineering students, interviewing for their first job.

Engineering professional schools might refrain from assisting these censured employers in arranging interviews with graduating students.

"[S]hall not participate in projects." There is room for some flexibility in

interpreting this clause. Construed broadly, it might mean that the practicing

engineer could no longer work for the employer once he or she had formed the

judgment that the organization was degrading ambient safety levels without making the facts known. Construed narrowly, it might mean that the engineer is required

only to withdraw from a particular subtask of a larger activity if that is where the

hazard is localized. I would expect that discretion here could best be left to the

practicing engineer, at least until the difficult problems surrounding the concept of

"complicity" were worked out. There is also the question of when withdrawal is

required. The engineer may understand merely that there is some likelihood that a

risk of unknown probability or magnitude may be imposed by a project just in the

planning stage. Or it might be understood that the organization is actively involved

in the degradation of public safety. It should be remembered that as projects get

underway, it becomes more costly and difficult to alter course. For purposes of

protecting employed engineers, withdrawal would be justified at the point where it

becomes clear that the employing organization is likely to impose covert risk. For

purposes of disciplining engineers, failure to withdraw would be culpable at the point where covert risk is imposed.

"[Information." This would include both information about the type of threat

imposed upon the safety of the public and the magnitude and probability of the risk.

"[Glenerally available." With few exceptions, this condition would be satisfied if

the information were conveyed to a governmental authority with responsibility for the

type of threat imposed by the project: the FAA with respect to aviation safety, the

EPA with respect to environmental hazards, and so on. The most glaring cases seem

to be those in which organizations endeavor to keep such information concealed from

people with an interest in it. Such an effort typically requires not merely that one

refrain from making it available to appropriate governmental officials but that one

also prevent it from leaking out. Certainly if an organization fires or threatens to

fire an engineer for making available appropriate information about a threat to the

public safety, that would be a conclusive reason to believe that the organization is

concealing the facts itself. Complications arise where government officials ignore

their responsibilities, abuse their authority, or are major perpetrators in the concealed

degradation of public safety. Suffice it to say that the test is the availability of the

information to those placed at increased risk. Where it is not reasonable to believe

that the appropriate information is available, this condition is not met.

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill 85

One major exception to the First Principle involves the intended harmful effects

of national defense weaponry. It is persuasively arguable that mortal enemies may not

be entitled to a full account of the risks to which they might be subject. Some degree of secrecy may be permitted here. For this reason, the First Principle does not

require that organizations producing weapons for national defense purposes make

generally available information about the risks these weapons may impose upon enemies. Other risks however?those imposed upon ourselves or upon those who handle

the weaponry?must not be concealed.

Let us look at a specific case to get a feel for the way this principle would apply.

By June of 1972 it had become quite clear to F. D. Applegate, Director of Product

Engineering for Convair, that the McDonnell-Douglas DC-10 upon which he was

working (Convair was a major subcontractor) was a seriously flawed aircraft. The

immediate problem was a badly designed latching mechanism for the cargo doors.

Though corrective "bandaids" had been applied, the mechanism was far from

"fool-proof" and Applegate anticipated that the cargo doors would continue to open when the plane became airborne. There had already been two such failures. But the

failure of the cargo door was not itself the central cause of concern. As the cargo

compartment lost pressure, the floor of the pressurized passenger compartment above

would collapse downward into it. Because the main control lines to the rear of the

DC-10 were positioned just below the cabin floor, such a collapse could be expected to disable controls to the rear of the plane. One of the engines is in the rear as are

many of the control surfaces. In a memorandum expressing his, concern to the

Manager of Convair's DC-10 Support Program, Applegate wrote that the plane had

"demonstrated an inherent susceptibility to catastrophic failure." "It seems to me

inevitable that, in the twenty years ahead of us, DC-10 cargo doors will come open and I would expect this to usually result in the loss of the plane." Applegate concluded his memorandum with the suggestion that certain changes be made in the

design of the cabin floor that would prevent catastrophic failure. In his reply to

Applegate 's memo, the Program Manager did not take issue with any of Applegate 's

factual claims but made it clear that no effort would be made to correct the problem or even to report it to McDonnell-Douglas. Needless to say, the substance of

Applegate's memo was not made available to the FAA.12

Upon receiving his reply from the Program Manager, it should have been clear to

Applegate that the continuing introduction of DC-ios into the stream of commerce

represented a substantial degradation of the ambient safety levels for air travelers.

One must assume here, as seems reasonable, that Applegate understood that such a

degradation would occur whenever an aircraft with an "inherent susceptibility to

catastrophic failure" was introduced. It was likely clear as well to Applegate that

information about the nature and magnitude of these risks was not being made

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

86 Business & Professional Ethics Journal

available to the FAA. Indeed, Convair was forbidden, under its contract with

McDonnell-Douglas, from contacting the FAA about the matter.13 To put the matter

bluntly, Applegate was almost certainly aware that he was involved in a project that

would inevitably kill people, people who were not aware, who could not be aware, of

the risks to which they were subject. It appears that Applegate did not quit the DC

io Program.*4 If all this is correct, Applegate understood that he was participating in a project that degraded ambient levels of public safety without information about

that degradation being generally available. Though there are others who would likely share blame in this case?engineers, managers, government officials?Applegate

probably deserves some of it. Twenty-one months after Applegate sent his memo, a

Turkish Airlines DC-io lost a rear cargo door 11,500 feet above Coulommiers, near

Paris. As Applegate foresaw, the cabin floor collapsed, the controls to the rear of

the plane were disabled, and the aircraft, with 346 persons on board, hit the ground at 497 miles per hour. It was the first crash of a loaded jumbo jet. To say there

were no survivors would be to understate the dimensions of this tragedy. There is an important type of case, however, that the First Principle will not

reach. In 1972 a train on the Bay Area Rapid Transit system (BART) overran the

Fremont station and crashed into a sandpile^S There were injuries though no one was

killed. An investigation showed that an oscillator had failed in the train's control

system and that, as a consequence, the system had read a signal to slow down as a

signal to speed up. Two facts make the case an interesting one from the present

perspective. First, the introduction of the BART system probably represented a very

substantial improvement in the ambient levels of safety in the area. Public

transportation?even defective public transportation?is substantially safer than the

automobile. So in this case it would have been persuasively arguable that there was

no degradation of ambient safety levels; that, on the contrary, there was improvement

despite the crash. Second, it is an accepted standard in the engineering of public

transportation systems that they be designed so that when a part fails, as might be

expected in the life of the system, that failure does not precipitate a life-threatening

occurrence; that they be designed, in other words, to be "fail-s?fe." Knowing that

oscillators fail, the engineers working on the control system should have designed it

so that when the failure occurred, the train would slow down or stop?not accelerate

and crash. In this case that standard was violated and the "Fremont Crash" was the

result. It would appear that the engineers who violated that standard could be held

to be responsible for the hazards that resulted. There might be engineering

malpractice here. But the First Principle cannot be appealed to in condemning what

the engineers did. This is because there was no degradation of ambient safety levels

as there must be if the First Principle is to apply. One cannot justify a needless,

negligent threat to public safety by pointing out that one has saved several other

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill 87

lives. And yet, in the Fremont Crash, precisely the latter type of fact foils the

applicability of the First Principle. Accordingly, another principle must supplement the first.

Second Principle: Engineers shall not violate accepted or acceptable standards of professional practice in cases where the safety of the public would thereby be placed at heightened risk.

Needless to say, the Second Principle creates a special obligation to apprise oneself

of all applicable professional standards in projects that affect the public safety. It

creates as well an obligation to withdraw from a task if it turns out not to be possible to adhere to accepted or acceptable standards in the course of it. Although there are

many occasions in which it might well be appropriate to cut corners, the Second

Principle provides a guarantee that engineers will not do so where the public safety is thereby placed at greater risk.

Again some commentary is indicated.

"[A]ccepted or acceptable standards of professional practice." These are and

would continue to be defined by the engineering profession. Although the profession

may and does define standards in various areas, it should be open to engineers to

depart from these if they can demonstrate that the ones they are adhering to are at

least as respectful of public safety as the accepted ones. The burden of proof, of

course, is upon the engineer who departs from the accepted standards.

"[Qases where the safety of the public would thereby be placed at heightened risk." Here the risk created by the violation of the safety standard is to be compared with the risk that would exist in the absence of the violation. In the Fremont Crash, we would be comparing the risk imposed by the defective train with the risk that

would be imposed by the train had it been properly designed. We are not

comparing?as we would with the First Principle?the risk imposed by the system with

the pre-existing background risks imposed in the absence of the system.

* -* *

The upshot of this paper so far has been to sketch why and how engineering

professional associations might take an expanded role in setting the conditions of

professional practice. It is time now to consider some of the main objections to this

view.

"When engineers kill others, that is a legal problem: not a moral one. It is a

problem for the legal system: not for the professional association. Engineers need

take into account only what the law requires. There is no need for professional associations to take action here."

In practice, there are several reasons why the criminal law is not (and, for the

foreseeable future, will not be) used against engineers who participate in the

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

88 Business & Professional Ethics Journal

concealed degradation of public safety. Prosecutors are under substantial pressure to

attend primarily to a very different type of wrongdoing: street crime. The

inadequacy of their resources has meant that they ignore some crimes on the books

and offer substantially reduced sentences to the wrongdoers who are caught in order

to persuade them to plead guilty and waive their right to trial. Trials exact a

frightful toll on the prosecutor's meager resources. If a prosecutor were to proceed

against an engineer, it would be expected that the employing organization would come

to the defendant's rescue. (Corporations worry that the employee will try to shift the

blame to them.) Once the corporation has entered the legal arena, the prosecutor can

count on very pressing demands being placed upon the scant resources of the office, which is simply not geared to handle this type of case. The Ford Motor Corporation

spent many times what the prosecution did to defend itself in the Pinto "exploding

gastank" case. Additionally, it is often difficult for prosecutors to be fair in including as defendants some of the participants in a fatal project but not others. For these

reasons and others, engineers who participate in the covert degradation of public

safety have little to fear from the criminal law. They are effectively insulated from

its requirements.

"What about the civil law? Can't engineers be sued and held liable for damages? Can't they be made to pay for the deaths they help to bring about? Damages in the

type of case we have been considering are typically very substantial; far, far beyond the capacity of even very successful engineers. The awards in the DC-io case have

exceeded 100 million dollars already. Working engineers are what plaintiffs' attorneys call "judgment proof." It does not make sense to sue them because they cannot begin to pay for the harm they have done. And so, as a matter of fact, engineers are insul

ated from the obligations imposed by the civil law as well.1^

Though engineers may not be held criminally responsible for the deaths of others,

though they may not be held civilly responsible, they may yet be held morally

responsible. Professional associations have both the competence and the standing to

make authoritative judgments in these cases. It is not likely that the law can do an

acceptable job in securing a tolerable level of ethical behavior among engineers. But

the profession has, as part of its socially bestowed stewardship, the obligation to see

to it that engineers show a civil respect for the public safety. And, acting through

organizations, the profession can secure a substantial level of compliance with

appropriate principles of professional conduct.

"But aren't the employers of engineers the ones with responsibility for these

deaths? Doesn't that fact make a difference?" Although the corporation may own

what the engineer produces, the engineer does not cease to have responsibility for the

reasonably foreseeable consequences of his or her acts. Certainly if a corporation

paid an engineer to test-fire a rifle at a crowd in a baseball stadium, the engineer

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill 89

would be responsible for the deaths. The fact that he was paid to do the job is simply irrelevant to the question of his responsibility (though it would be relevant to the

employer's). Moral responsibility for one's actions is not given up when one becomes

an employee. The fact that engineers are not criminally prosecuted and the fact that

it has been corporations that have faced civil liability have, I believe, tended to blind

engineers, like Applegate, to their own moral responsibility for the deaths of others.

"But don't engineers have a competing duty of loyalty to their employers and to

their co-workers?" Loyalty alone is not a virtue, for it can be blind and misplaced. The loyalty that one may find in a gang of cutthroats is a part of what makes them

wicked. Loyalty becomes a virtue when it is coupled with discernment in the choice

of its object. The reminder that enginers hold paramount the safety of the public can

be a great help to young engineers in the development of that discernment.

"What about the working engineer with a family to support? One cannot expect these engineers to walk off their jobs." I do not think that obligations to family are

strong enough to permit one to take a job in an organization that kills. They would

not permit one to take a position as a highly paid assassin for the Mafia. If I have

to kill others in order to provide the very best for my family, maybe my family should

learn to do with second-best.x7 Certainly I do not do my best for my children when

I help to contribute to the world more death, more injury and more sickness. In any

case, an enhanced role by professional associations in the protection of ethical

engineers will have the effect of reducing the personal costs of ethical behavior.

These painful dilemmas may thus become less common than they have been.

"What about the problem of enforcement? Even if professional associations

merely censure engineers and employers of engineers, they will open themselves up to

libel suits that may bankrupt the associations." Here, engineering professional associations have much to learn from other organizations and professions that have

grappled with similar problems. The American Association of University Professors

regularly censures institutions of higher education for violations of the academic

freedom of faculty. Consumers Union regularly excoriates manufacturers for the

shoddy quality of their goods. Both have apparently solved the problem of libel suits.

But is the instituting of a mechanism for censuring engineers and their employers sufficient to secure adequate compliance with principles of professional conduct? This

is a question that can best be answered by experimentation of the sort that engineers are supposed to excel at. The design of an effective mechanism for securing among

professionals an appropriate level of respect for the public safety is very much like

other problems in engineering. Engineers can do what needs to be done to give concrete expression to their commitment to the paramountcy of public safety. Those

of us who look to engineering as a major source of human betterment would urge no

less.

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

90 Business & Professional Ethics Journal

NOTES

1. In addition to Code of the Engineers' Council for Professional Development, similar language also appears in the codes of the National Council of

Engineering Examiners, the Institute of Electrical and Electronics Engi neers, and the National Society of Professional Engineers. The statement

is also part of the Uniform Code of Ethics of the Engineering Profession,

Draft, by Andrew G. Oldenquist and Edward E. Slowter, presented at the

Meeting of the American Institute of Chemical Engineers, August 17-20,

1980, in Portland, Oregon.

2. Andrew G. Oldenquist and Edward E. Slowter, "One Code of Ethics for All

Engineers," presented at the Meeting of the American Institute of Chemical

Engineers, August 17-20, 1980, in Portland, Oregon.

3. The relationship between professionalism and the obligations imposed by the

codes of ethics is more fully explained in Kenneth Kipnis, "Professional

Responsibility and the Responsibility of Professions," in the proceedings of the 1978, University of Dayton Colloquium on Collective Responsibility in the Professions, University of Dayton Review, Summer, 1981, and in Joseph Ellin, Michael S. Pritchard and Wade Robison, eds., Ethics in Business and

Professional Life (Clifton: Humana Press, forthcoming).

4. The distinction is drawn similarly in codes of ethics from other pro fessions. Consider, for example, the American Bar Association Code of

Professional Responsibility, which distinguishes between Ethical Consider

ations (ideals) and Disciplinary Rules (principles). EC 2-25 provides, among other things, that every lawyer "should find time to participate in

serving the disadvantaged. "

Lawyers who fail to find such time are not

regarded as having fallen short of acceptable professional standards. DR

9-102 provides, however, that lawyers shall maintain separate bank accounts

for the funds of clients. Lawyers are regularly disciplined for violation

of that rule.

5. Problems would arise if the members of the community vastly prefer to die

of the mosquito-borne disease than to be killed by the spray. We will pass over these. They would arise as well if the people at risk from the disease

were not the same as those put at risk by the spray. (Say only adolescents

were endangered by the spray while only the very aged were subject to the

disease.)

6. Here, allowance must be made for the patient who does not want to know the

risks but is willing to let the trusted surgeon act using her best judgment. It is enough that the information simply be available; the patient need not

actually be informed. Not permitted are the exaggeration of benefits and

the failure to make available information concerning the risks. The concept of "informed consent" has been fairly well developed in the field of medical

ethics. See, for example, the anthology Contemporary Issues in Bioethics

by Tom L. Beauchamp and LeRoy Walters (Belmont: Wadsworth Publishing

Company, 1978), pages 143-168 and pages 430-441. It has not however assumed

a central place in engineering ethics although Robert Baum has appealed to

informed consent in his "The Limits of Professional Responsibility" in

Ethical Problems in Engineering, 2nd Edition, Volume One, Albert Flores, ed. (Troy: Center for the Study of the Human Dimensions of Science and

Technology, 1980), pp. 48-53.

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions

Engineers Who Kill 91

7. I owe these examples to Stephen H. Unger.

8. This is an important part of the position taken by John Rawls in his highly influential A Theory of Justice (Cambridge: Harvard University Press,

1971). The obligation to treat people as ends in themselves?not as means

only?precludes imposing "upon them lower prospects of life for the sake of

the higher expectations of others." P. 180.

9. Things might be different if everyone in the community had, with due

deliberation, agreed beforehand to go along with some majority-rule

procedure in cases such as these.

10. See, for example, the selections in Lyman Tower Sargent, editor, Consent :

Concept, Capacity, Conditions, and Constraints (Wiesbaden: Franz Steiner

Verlag GmbH, 1979).

11. Engineers in this position have historically been disciplined by their

employers, fired, and even blacklisted for refusing to comply with orders

requiring them to violate professional ethics. An important court

case?Pierce v. Ortho Pharmaceutical Corp., 417 A.2d 505 (N.J. July 28, 1980)?has recently provided a legal basis for professional associations to

assist employed professionals caught in such dilemmas.

12. The Applegate Memorandum and the reply to it are reprinted in Paul Eddy, Elaine Potter and Bruce Page, Destination Disaster (New York: Ballantine

Books, 1978), pp. 274-80.

13. Ibid, p. 268.

14. Ibid, p. 426. Applegate is still a senior executive with Convair.

15. On the BART case, see Robert M. Anderson et al., Divided Loyalties (West

Lafayette: Purdue University, 1980). For additional information I am

indebted to Stephen H. Unger and Robert Bruder, both of whom were involved in the case.

16. These considerations have not, however, prevented corporations from as

cribing responsibility to underlings when catastrophes occur. McDonnell

Douglas blamed the Paris DC-10 crash on a baggage handler at Orly Airport. Eddy, Potter and Page, Op. cit., p. 209.

17. Perhaps things might be different if the engineer's family faced starva tion. But in practice this is not an issue.

This content downloaded from 129.68.65.223 on Sat, 29 Mar 2014 23:17:20 PM All use subject to JSTOR Terms and Conditions