What Airport Security Can Teach Us About Managing Risk

We recently discovered a critical bug in our product. It was in production for about two weeks and almost certainly cost us a lot of money 💰

In the immediate aftermath of a situation like this, there’s a strong urge to prevent it from happening again. Ideas to add safeguards are readily available, and the idea of ever repeating the issue is nauseating.

What most of us fail to consider in these situations is the *full* cost of implementing the systems and rules to prevent bad things from happening. I’ll explain this anti-pattern by looking at the history of airport security. I’m going to go into a little bit of detail here, but I promise I'll eventually get back to management.

In the 60s taking a local flight was similar to taking a bus. You’d show up at the airport, buy a ticket and then just walk onboard. No security check.

Unsurprisingly, those were also the golden years of flight hijackings: in the first 6 weeks of 1969, there were 11 hijackings in America!

Then in 1973, the FAA started requiring every passenger to go through metal detectors and have their bags searched. This made it much harder and riskier to bring a weapon or bomb on a plane, and it dramatically reduced the number of hijackings.

Things remained much the same for the next few decades - at least until 9/11 happened. The FAA went into security overdrive following the attacks and set the goal of having zero incidents.

Over the next few years, they started doing pre-flight background checks, required you to remove shoes, and limited the amount of liquid you could bring. That’s in addition to implementing full-body scanners that do a kind of virtual strip search.

The FAA made all these changes with the goal of saving lives, and it would be hard to argue that they failed considering how few security incidents there are now. Well...it would be hard to argue unless you consider the second-order effects of their actions.

See, by making it so time-consuming, invasive, and expensive to fly (all that security costs money), a lot of Americans started choosing longer car trips instead of flying. And, as it turns out, driving is far more dangerous than flying.

In their attempts to reduce deaths on airplanes, they unintentionally increased deaths in cars without even realizing it.

So what does all this have to do with management?

Most people want to create new rules and procedures when bad things happen at work. I used to respond in precisely this way - I felt I needed to do *something*.

But as we learned from airport security, any system with the goal of having no mistakes has a huge cost.

Over time, companies that respond to bad events with new rules end up draining their team’s energy and creativity. More often than not, this is how innovative cultures die.

All this isn’t to say that you should do nothing when bad things happen. Instead, it’s about saying that new rules and processes aren’t necessarily the best solution 🙂