The Door Marked Safe
What the autopsies of the space age can teach a correctional officer about the disease we all carry
The Door Marked Safe
I have written extensively about complacency. I have lectured on it, and I have written a book about it. One finding comes back to me over and over, no matter how many times I turn it: complacency is pervasive, and it is endemic to all of us. It is not a defect of the lazy or the careless. It lives in the tissue of good, capable, conscientious people, and it waits.
In the book and in the classroom I have relied on autopsies — not of bodies, but of events. I take a national critical incident, lay it open, and trace how the mistakes were made, how they compounded, and where the door stood open that let the calamity walk in. Then I try to hand correctional staff a framework to kill or mitigate that same process at their own institutions. The human decision-making machine fascinates me, and the roots of complacency stay the same, or close to it, no matter the profession.
So here is my question. Can we learn from mistakes that have nothing to do with corrections — and in doing so, expand our psychological tools in ways that a narrower focus on only correctional incidents never could? Space, aeronautics, and astronomy have been lifelong interests of mine, and I have spent real time researching the tragedies of the nations that have put human beings on top of a rocket. Right now that means the United States, Russia, and China, primarily.
Space exploration is a risk business. So is corrections. The surface similarities are few. But the roots — normalcy bias, confirmation bias, the complacency of routine, the complacency of success, hindsight bias, and the rest of the family — are the same roots, and they are worth examining through a new and unfamiliar lens. Not because we plan to fly to the Moon. Because a lens ground for a different world sometimes reveals the flaw in our own that the familiar mirror has stopped showing us.
Complacency, as I define it, is situational awareness perceived but not achieved. We are going to watch several very intelligent organizations perceive it, fail to achieve it, and pay. And then we are going to talk about what actually stops that — not the review we conduct after the funeral, but the discipline that acts before the door swings shut.
The fire before the fire
In March of 1961, a young Soviet cosmonaut trainee named Valentin Bondarenko sat in a low-pressure isolation chamber running an endurance experiment. The chamber’s atmosphere was enriched with oxygen. After some time under medical sensors, he wiped his skin with a pad soaked in alcohol and tossed it aside. It landed on a hot electric coil. In an oxygen-rich atmosphere, a spark that would sputter and die in ordinary air becomes an inferno. Bondarenko was badly burned and died hours later. He was twenty-four. Roughly three weeks later, Yuri Gagarin became the first human being in space, and the world celebrated a program that had, in secret, just burned one of its own to death in a training rig.
The Soviets buried it. Bondarenko’s name was scrubbed, his image removed from the group photographs, his death hidden for nearly two decades until it surfaced in the Soviet press around 1980.
Now hold that against January 27, 1967. Gus Grissom, Ed White, and Roger Chaffee, sealed inside the Apollo 1 command module for a “plugs-out” test on the pad. The rocket was unfueled. The test was classified as non-hazardous — because what is the danger in a rehearsal? The cabin was pressurized with pure oxygen above sea-level pressure. An electrical fault threw a spark into an enclosure full of flammable material bathed in that oxygen, and three men died in seconds behind a hatch that opened inward and could not be beaten against the pressure inside.
Six years apart, two rival programs, two different worlds — and the identical anatomy. An oxygen-enriched atmosphere treated as a routine test condition. A fire hazard that was never war-gamed to the point of catching the combination. And the calamity arriving during the part everyone had agreed was safe.
It is tempting to draw a straight causal line — that if NASA had known about Bondarenko, Apollo 1 would not have happened. I do not think the evidence supports that, and I think the honest version is more damning. The Soviets hid the death so well there is no reason to believe it reached NASA at all. But here is the thing: NASA did not need Bondarenko. The lethality of a pure-oxygen atmosphere is a fact of chemistry, knowable from first principles by every engineer in the building. The Soviet data point would have been a warning. Its absence was not the failure. The failure was the same complacency about a known hazard class — the willingness to call a test non-hazardous because nothing had gone wrong yet.
And that is the first lesson the space age hands the tier. The concealed mistake does not just hide a death. It disarms the warning. A signal a program refuses to publish cannot warn anyone — not its rivals, not its own future crews. Every time an institution buries an incident to protect its reputation, it strips that incident of the one thing that could redeem it: its power to teach the next person before they walk through the same door.
The deviance that became normal
If Bondarenko and Apollo 1 are the disease at creation, the Space Shuttle is the disease learning nothing.
Challenger, January 28, 1986. The cause was an O-ring seal in a solid rocket booster, stiffened by unusual cold, that failed to contain the burning gas. But the O-rings had been telling their story for years. Erosion and blow-by had shown up on earlier flights and been accepted each time as within the range of experience — “in-family,” in the language of the program. Engineers warned, the night before, that the cold was outside anything they had tested. Management weighed the warning against a schedule and launched. The sociologist Diane Vaughan gave this its permanent name: the normalization of deviance. A deviation observed often enough, without immediate punishment, quietly gets reclassified as normal. The alarm stops being an alarm.
Columbia, February 1, 2003. A piece of foam broke off the external tank during launch and struck the wing’s leading edge, opening a hole that let superheated gas into the wing on reentry seventeen days later. And the foam, too, had been shedding for years — observed, documented, accepted as in-family. On orbit, engineers asked to have the wing imaged to assess the damage. Management declined. The accident board did not mince words: the cultural failure that killed Columbia was the same one that had killed Challenger seventeen years earlier. The organization had held the autopsy, written the report, absorbed the lesson — and then run the identical play.
This is the complacency of success in its purest institutional form. It worked last time. It has worked every time. The foam always shed and the shuttle always came home, so the watch stood down, not through negligence but through the slow erosion that repeated success works on vigilance. Two crews, fourteen people, one lesson the agency had already paid for once.
(A word on China, since I named all three programs. China’s crewed program is young — it did not put a human in orbit until 2003 — and, fortunately, it has no crewed fatality to autopsy. I will not manufacture one. But the informational instinct is worth flagging: the 1996 Long March 3B disaster, which killed people on the ground and whose true casualty count was tightly controlled, rhymes with the Bondarenko reflex. Where the record is sealed, the pattern is harder to read — which is precisely the point about concealment.)
The one who nearly drowned where there is no water
Now to the incident that started me down this whole road, because it is the cleanest specimen I have ever found of complacency caught, and nearly not caught, in real time.
July 16, 2013. Italian astronaut Luca Parmitano is on a spacewalk outside the International Space Station when water begins pooling inside his helmet. It is coming from a leak in the suit’s cooling system, backing up through the ventilation loop. On the ground you would feel it run down your chin and off your face. In microgravity there is no down. Surface tension holds the water as a film clinging over his eyes, his nose, his ears. He goes blind. He can barely hear. He is, in the most literal and terrible sense, drowning — in vacuum, in the one place there is supposed to be no water. He feels his way back along the tether to the airlock and survives.
Here is the part that belongs in every complacency class ever taught. Six days earlier, on the previous spacewalk, the same astronaut had reported water in his helmet. The ground team investigated — they did not ignore it — and closed the item out as a leaking drink bag or ordinary sweat. Premature closure. They reached for the plausible, benign explanation, it fit the routine, and they shut the file. So when the real event came on the next walk, the precursor had already been waved away. The mishap board that investigated it reached, once again, for the same phrase: normalization of deviance. Same disease. The parallel to Columbia was drawn explicitly.
Two things about this that I cannot let pass.
First, the failure mode is a fingerprint of the real thing. Water that clings to a man’s face instead of draining off it is only possible in genuine microgravity. Run that identical leak in a swimming pool and it sheets off his chin and disperses — a non-event. The single near-drowning in the history of spacewalks happened in the one environment where there is no water. Sit with that. After all those spacewalks, across all those decades, not one drowning — except the one that occurred where there is nothing to drown in.
Second, and this is the correctional heart of it: the item they should have caught was the cheap one. Not a dramatic red flag. A minor anomaly on a routine day, closed with the comfortable answer. The disease did not force the front door. It slipped through the small side door marked probably just the drink bag.
What actually stops it: dissent before the door closes
So what do we do? Not with the astronaut — with ourselves, on our own tier, on the ordinary Tuesday.
Most institutions answer this with the after-action review, and I want to be careful here because the AAR is a good and necessary thing. But notice what it is. The after-action review is retrospective. It is an autopsy. By definition it operates on a corpse. It can only teach the next situation, and only if the lesson transmits — and it arrives contaminated with hindsight bias, because in the rearview mirror every missed signal looks obvious and every fork in the road looks clearly marked. The AAR is always exactly one disaster late. Every incident I autopsied above was followed by a superb after-action review. The reviews did not save the next crew. Columbia proves it: the report on Challenger was excellent, and it did not prevent the identical failure.
What does prevent it is a different animal entirely, and it is prospective. It acts before closure, while the decision is still alive and the item is still open. Its formal name is structured dissent, and the discipline is old.
The Catholic Church built it into canonization for centuries: the Devil’s Advocate — the advocatus diaboli, formally the Promoter of the Faith — a person whose actual assigned job was to argue that the candidate should not be made a saint. Not because he necessarily believed it, but because the institution understood that consensus needs a professional opponent or it will canonize on the cheap.
The military learned the same thing in blood. After the intelligence catastrophe of the 1973 Yom Kippur War — a surprise attack that a confident consensus had ruled out — Israeli intelligence institutionalized dissent in a doctrine sometimes called the Tenth Man: if nine analysts agree, the tenth is obligated to take the opposing view and build the strongest case for it. The IDF gave it a working home in a devil’s-advocate office they call Ipcha Mistabra — Aramaic for “the opposite is true” — a unit whose entire function is to argue against the prevailing assessment. In the security world you know the same instinct by a third name: the red team.
Devil’s Advocate. Tenth Man. Red Team. Three names, one idea: you do not wait for someone to spontaneously feel skeptical, because under routine and time pressure nobody does. You assign the skepticism, so it cannot be normalized away.
But here is the piece people skip, and it is the piece that makes the difference between theater and an engineering control. A designated dissenter with no teeth just gets thanked for his input and talked past — the room closes the item anyway. What gives dissent traction is tying it to a falsifiable test the group must run before it is allowed to move on. Dissent without a disconfirming test is theater. Dissent that names the measurement is a lock on the door.
Go back to the drink bag. Structured dissent, done right, is not a man in the room feeling uneasy about the water in the helmet. It is a rule that an unexplained fluid intrusion cannot be closed on the most benign candidate cause — it stays open, and it constrains the next spacewalk, until the cause is affirmatively demonstrated. And it is a person whose assigned job is to say: you think it’s the drink bag? Weigh the bag. Prove it lost the volume he swallowed. If you can’t, it isn’t the bag. That is the whole ballgame. Not more opinions. One assigned opponent, and one test that has to pass before the file is allowed to shut.
That is the difference from the AAR stated plainly. The after-action review diagnoses the disease at autopsy. Structured dissent is an immune response at the moment of infection.
Bringing it home
None of these organizations were staffed by fools. That is the whole point, and it is the only reason the exercise is worth anything. NASA is one of the most capable institutions in human history, and it ran the same play four times — Apollo 1, Challenger, Columbia, and the near-drowning that should have been caught six days early. If it were incompetence, we could dismiss it and feel safe. It was the opposite of incompetence, and the disease still found a way in every time.
Because that is what it does. Complacency is constitutional — it is in the tissue, present at creation, and there is no immunity to be had, because the same routine and habit that make a veteran functional are the same routine and habit that let the anomaly slip past. You cannot excise it. But you do not have to. The disease needs a way in. And a way in is a finite, inspectable, nameable thing. The assumption. The cheap explanation. The deviation reclassified as normal. The test labeled non-hazardous. The success that stood the watch down. Those are doors, and doors can be watched and doors can be locked.
Good habits, done right, are a load-bearing wall — they hold the structure up while the tired mind wants to let the anomaly close the file and go home. Structured dissent is how you install that wall in an organization that cannot count on any one person being sharp on any given day.
The officer on the tier is not investigating a spacecraft. But he is closing items every shift — the count that’s a little off, the inmate whose behavior is probably nothing, the door that’s usually secured, the routine that has worked ten thousand times. Every one of those is a small file waiting to be shut on the comfortable answer. The space program’s dead have already shown us, at the highest imaginable price, exactly how that file gets closed and exactly what walks through the door when it does.
The lens ground for the Moon shows us the flaw in the tier. Not because the two worlds are alike. Because the disease does not care which world you are standing in. It is always there. It is waiting. And it only needs a way in.