The FAA gave up trying to make pilots confess to its own inspectors and paid NASA to hear the confessions instead

the problem

Pilots and controllers who spotted a near-miss had no safe way to report it, because the only agency positioned to collect that information was also the one licensed to suspend them for it

background

what everyone would do

Make hazard reporting mandatory and enforce it — the default response of any regulator that wants more data. It backfires precisely because it works as intended: a mandatory report to an enforcement body is evidence, so the rule trains the regulated population to report less, not more, and near-misses like United's stay locked inside one airline's private memory.

what they saw

The FAA recognized the blockage was never the absence of a reporting form — United already had one — it was that the FAA itself could never be a safe recipient of a confession, no matter how the form was worded, because it also held the power to punish whatever the form revealed. The fix had to separate who collects the hazard data from who holds power to act on the reporter, not just promise the two would stay separate inside one agency.

the move

The FAA funded a national incident-reporting system but handed its entire operation to NASA — an agency with no licensing or enforcement power over pilots or controllers — through a 1976 interagency Memorandum of Agreement. NASA collects reports directly, strips identifying information before any FAA or industry party sees the data, and the FAA in turn grants reporters limited immunity from enforcement action for whatever they voluntarily and promptly confess to NASA (carving out criminal acts, intentional violations, and legally defined accidents).

why it works

NASA has no licensing or enforcement authority over pilots or controllers, so a report filed with NASA cannot become an FAA violation charge through NASA's own hands — the punitive lever the reporter fears simply is not present on the receiving end. The FAA's immunity grant then removes the remaining risk: whatever the reporter voluntarily and promptly discloses to NASA cannot be used against them by the FAA either, as long as it isn't a criminal act or an accident already under investigation. NASA de-identifies every report before publishing patterns or issuing alerts, so even systemic findings never trace back to an individual. Each piece — the neutral collector, the immunity grant, the de-identification — closes off a distinct path back to punishment; remove any one and the reporter's calculation reverts to United's crew: report internally at most, and stay silent to everyone else.

the payoff

The Aviation Safety Reporting System (ASRS) began operating April 15, 1976, passed 500,000 processed reports by its 25th anniversary in 2001, and had exceeded 558,000 within a year of that milestone. NASA has never breached a reporter's identity. The program is credited as a major contributor to commercial aviation's long-run safety record and has continued issuing safety alerts and special studies drawn from the de-identified data for five decades.

where it breaks

The immunity is deliberately narrow: it excludes criminal acts, intentional violations, and events that are already legally defined accidents, so it does nothing for the reporter who most needs cover for something serious. The model also depends entirely on the third party's actual independence — if the collecting body has any back channel to the enforcer, or can be subpoenaed to unmask a reporter, trust collapses the first time it happens and does not rebuild quickly. And a closed, single-organization version of the same idea (an airline's own internal ASAP program) inherits a weaker version of the original problem: employees still know their own employer holds the disciplinary power, even under a compliance department's immunity promise, so a closed system captures less than a truly external one and its data never reaches anyone outside that one organization.

what came after

The FAA later let individual airlines run their own closed version (Aviation Safety Action Partnership programs, with the same immunity-for-voluntary-disclosure structure), and the same independent-third-party-plus-immunity model has since been adopted outside aviation by rail, maritime and highway transportation regulators and by hospital and veterans'-health error-reporting systems facing the identical problem: people will not confess to the party that can punish them for confessing.

references

1. [1]ASRS: The Case for Confidential Incident Reporting Systems (NASA ASRS Pub. 60)NASA / FAASafety.gov, 2002faasafety.gov
2. [2]ASRS Program Overview — SummaryNASA Aviation Safety Reporting System, 2020asrs.arc.nasa.gov

keep it

same kind of clever

• 2011 · Accessible Icon Project (Sara Hendren, Brian Glenney)Changing the official wheelchair symbol would have meant years lobbying a standards body with no reason to act — so the designers skipped the committee and just stuck the new one over the old ones themselves.
• 1979 · NASA / United Airlines (Crew Resource Management)Aviation stopped losing planes to captains who wouldn't listen by making it a subordinate's job to make them
• 1900 · Sanitary District of ChicagoChicago's drinking water was being poisoned by its own sewage at the intake point — so instead of filtering the water after the fact, the city just made its river flow the other way.