The Next Catastrophe: Reducing Our Vulnerabilities to Natural, Industrial, and Terrorist Disasters

The Next Catastrophe

The Next Catastrophe

Reducing Our Vulnerabilities to Natural, Industrial, and Terrorist Disasters

With a new preface by the author

Charles Perrow

PRINCETON UNIVERSITY

PRESS PRINCETON AND OXFORD

Copyright © 2007 by Princeton University Press

Published by Princeton University Press, 41 William Street, Princeton, New Jersey 08540 In the United Kingdom: Princeton University Press, 6 Oxford Street, Woodstock, Oxfordshire OX20 1TW

press.princeton.edu

All Rights Reserved

Third printing, and first paperback printing, 2011

Paperback ISBN: 978-0-691-15016-1

The Library of Congress has cataloged the cloth edition of this book as follows Perrow, Charles.

The next catastrophe : reducing our vulnerabilities to natural, industrial, and terrorist disasters / Charles Perrow.

p. cm.

Includes bibliographical references and index.

ISBN-13: 978-0-691-12997-6 (cloth : alk. paper)

ISBN-10: 0-691-12997-5 (cloth : alk. paper)

1. Emergency management—United States. 2. Disasters—Government policy— United States. 3. Risk management—United States. 4. Hazard mitigation—United States. 5. Terrorism—United States—Prevention. 6. Infrastructure (Economics)— Security measures—United States. I. Title

HV551.3.P45 2006

363.34'7—dc22 2006037984

British Library Cataloging-in-Publication Data is available

This book has been composed in Sabon with Helvetica Neue Heavy display.

Printed on acid-free paper. ∞

Printed in the United States of America

10 9 8 7 6 5 4 3

Contents

Preface to the Paperback Edition

Acknowledgments

Part One: Introduction and Natural Disasters

Chapter 1 Shrink the Targets

Chapter 2 Natural Disasters?

Part Two: Can Government Help?

Chapter 3 The Government Response: The First FEMA

Chapter 4 The Disaster after 9/11: The Department of Homeland Security and a New FEMA

Part Three: The Disastrous Private Sector

Chapter 5 Are Terrorists as Dangerous as Management? The Nuclear Plant Threat

Chapter 6 Better Vulnerability through Chemistry

Chapter 7 Disastrous Concentration in the National Power Grid

Chapter 8 Concentration and Terror on the Internet

Part Four: What Is to Be Done?

Chapter 9 The Enduring Sources of Failure: Organizational, Executive, and Regulatory

Appendix A Three Types of Redundancy

Appendix B Networks of Small Firms

Bibliography

Index

Preface to the Paperback Edition

Continuing Catastrophe

The Next Catastrophe argues that concentrations of hazardous materials, populations, and economic power in our critical infrastructure make us more vulnerable to natural disasters, industrial/ technological disasters, and terrorist attacks. Since its publication the fearful concentrations have only increased, exposing us to more risks, including those of a catastrophic scale. Recent years have seen increased concentration in industries that utilize hazardous materials; population density has increased in risky areas such as floodplains, areas prone to earthquakes, and coastal areas subject to storms and flooding; and economic concentration has increased in electric power generation, banking, telecommunications (including increased risks of cyberwarfare), and other parts of our critical infrastructure. This was to be expected; it is the path our nation has been on since the 1970s, but now speeded up by two decades of deregulation by Congress and free-market Supreme Court rulings.

*Matt Lucky, at the time an undergraduate at Stanford University, was a superb research assistant on the global warming section. Faculty seminars at the Center for International Security and Cooperation, Stanford University, where I have a visiting appointment, critiqued the meltdown and global warming sessions fruitfully. Lee Clarke and Ezra Zuckerman gave thoughtful critiques of the manuscript. I would like to dedicate this preface to my mentor on climate change, the late Steven Schneider, of Stanford.

In this preface I will explore two catastrophic failures that were not discussed in the original edition of The Next Catastrophe: the 2008 economic meltdown and the 2010 oil spill in the Gulf of Mexico; and a third: our failure to respond to the impending threat of catastrophic global warming, as well as our continuing outstanding contribution to it. Especially in the case of the meltdown and the oil spill I will expand upon a theme introduced in The Next Catastrophe, the idea I named, for lack of a better term, executive failure. Now, to emphasize that more than a failure of proper executive behavior is involved, I will use the label executive malfeasance. It has a broader reference to illegality. In addition to support for the notion of executive malfeasance, analysis of all three areas illustrates the dominant theme of The Next Catastrophe: the dangers of concentration, particularly that of economic power.

ECONOMIC MELTDOWN, 2008

The Theories

The economic meltdown has been attributed to the complexity and tight coupling of the financial sector; to the free-market ideologies that have dominated our economy since the 1980s; to the deregulation efforts of Congress over the past twenty years; and, of course, to mounting greed by key actors. There is evidence for all of these, and combinations of them. I will explore them all briefly, and formulate the last, greed, more specifically.

Some sociologists and journalists have linked the economic meltdown to Normal Accident Theory, citing the immense complexity of the financial system and its tight coupling. Complexity and coupling played a role in the meltdown but largely because the complexity masked the malfeasance traders were able to engage in, and the coupling enabled failures caused by the malfeasance to propagate throughout much of the system. To be a normal accident as I defined it back in 1984 (Perrow 1999; Perrow 1984) would require that in a system such as a firm there were unwitting failures that interacted in a way that could not be anticipated or perceived. Since nothing is perfect, there are bound to be failures, and since we try to avoid failures, most will be unwitting. If, however, people took steps that they were warned could be damaging to the firm’s interests, the failures would not be unwitting. (The U.S. Occupational Safety and Health Administration uses the term egregious willful violations, which I would label as malfeasance.) If there were ample warnings but the executives dismissed them we cannot blame the failures primarily upon the complexity and coupling of the system, though complexity and coupling made the failures more likely and consequential.

A second and more dominant sociological interpretation of the crash is the influence of the reigning ideology of free markets or market fundamentalism, the norms and beliefs that sustain this ideology, and the mimicry organizations are prone to in order to catch up to industry leaders. I also challenge this neoinstitutional interpretation, arguing that key economic actors in firms, Congress, and government agencies created and promoted the ideologies to serve their private interests, and the interests of the organizations they represented. Once broadcast and established, the free-market ideology provided cover and justification for behavior that eventually harmed the firms, their clients, and the public in general.

Neoinstitutional theory dominates economic sociology and has helped it make the cultural turn that has occurred in most other parts of sociology. In this view, power and interests—self- or organizational—are downplayed, while culture, norms, and values are emphasized. The economic meltdown, in this view, was inadvertent; executives were gripped by a free-market ideology and this made them oblivious to warnings and long-term considerations. The ascendancy of shareholder value at the expense of a concern for other stakeholders, an ideology growing out of economic theory, came to dominate. In this view, executives were victims of an ideology.

I have laid out my objections to both the neoinstitutional argument and the normal accident argument in a chapter in Lounsbury and Hirsch 2010, where one may find an elaboration of my argument and supporting references. (Perrow 2010b) Three other chapters in this volume explicitly use the normal accident perspective—the complexity and tight coupling of the financial system—to explain the crisis. Several others use the neoinstitutional perspective— ideology, norms, and imitating successful firms. I summarize my argument and its divergence from both views here, and argue that deregulation was neither accidental nor normative, but a deliberate effort to enhance self-interest. Since it knowingly did harm to the organizations, their clients, and the economy, this deregulation illustrates the idea of executive malfeasance—a broader term than simply greed. The meltdown also illustrates the main theme of The Next Catastrophe: concentrations of power produce more significant targets for failures.

Creating the Ideology

In the 1980s and 1990s the United States was awash in money as a result of the savings glut of China, where the lack of social security forced citizens to maintain a very high savings rate. The Chinese government placed these funds in the country with the soundest currency, the United States. Deregulation of U.S. industry had started during the administration of President Carter, and was furthered when President Reagan allowed antitrust laws to go unenforced. The U.S. government, with investments from China rolling in, kept interest rates low and promoted home ownership. For the financial sector, awash in funds, deregulation took a giant leap in just ten years, from 1998 to 2007. There was an insistence upon the free movement of capital across national borders; repeal of the 1933 act separating commercial and investment banking; a congressional ban on the regulation of credit-default swaps, a profitable new device that spread widely; major increases in the leverage investment banks could use, allowing a 3,000 percent increase by firms such as Goldman Sachs; decline of regulatory enforcement in government agencies, particularly the Security and Exchange Commission (SEC); little updating by all regulatory agencies of regulations to cope with the increasing pace of financial innovations; an international agreement that allowed banks to measure their own riskiness; and allowing financial service firms to shop around for the most lax regulatory agency. The government-supported housing market was the prime beneficiary of financial deregulation.

It is important to see that these changes and innovations were not the result of the spread of an ideology of free markets; that ideology had been around for most of the century. It only spread after the 1970s, and, I argue, was promoted to justify deliberate efforts of the financial institutions to loosen regulations, many of which had been in place since the Great Depression, and thus increase profits. A key regulation was the Glass-Steagall Act of 1933, which separated commercial and investment banking. While Texas Republican Senator Phil Gramm had the proper credentials to support a free-market ideology, having been an economics professor, it is likely that the banks came to him and suggested the repeal. He had important company. A strong supporter of the bill was the otherwise liberal Democratic senator from New York, Charles Schumer, who received spectacular campaign contributions from the financial industry that was central to his state’s economy. In 2001 Schumer and Gramm, finding the SEC unresponsive to additional deregulatory efforts on their part, introduced a bill to cut the agency’s funding in half. The SEC acceded to their requests.

In many of these deregulation acts financial industry leaders actually participated in the drafting of the legislation as well as making ample campaign contributions to key congresspersons. Editorials, congressional hearings, and financial reporters trumpeted the triumph of free markets, as if it was the belated recognition of an economic law, but it was lobbying by financial institutions that freed the markets and created new norms, not the ideology.

It took more than congresspersons to deregulate; appointed officials also played a role. But since these officials are not subject to bribes via campaign contributions, this cannot be a motive. I argue instead that their high degree of embeddedness in the financial industry (e.g., years spent working for Goldman Sachs) overwhelmed the oath they took to serve the public interest. It is striking that the major regulatory heads so vigorously attacked those who were sounding warnings about the deregulation legislation and were calling for new tools to rein in the new, dangerous instruments. One official who opposed deregulation and feared for the health of the economy was the head of the Commodities Future Trading Commission (CFTC), Brooksley Born. Born attempted to control trading in derivatives because they lacked transparency and basic information, and this, she held, could threaten markets and the economy as a whole. In 1998 she issued a warning to the President’s Working Group on Financial Markets (which included the three key federal officials responsible for regulations, Federal Reserve Board Chairman Alan Greenspan, Treasury Secretary Robert Rubin, and SEC head Arthur Levitt). They dismissed her warning with contempt. She went public, proposing a ruling by the CFTC to control derivative trading, and Greenspan, Rubin, and Levitt, along with Deputy Treasury Secretary Lawrence Summers, not only forced her to desist, but marginalized her sufficiently that she resigned the next year. Just to make sure that there would be no increased regulation of derivative trading, they got her replacement to make a CFTC ruling to that effect. Since Brooksley Born’s warning was only one of many, it is hard to explain the behavior of these agency heads as carrying out an ideological commitment to free markets rather than carrying out the regulatory duties their agencies were expected to perform.

Repeated Warnings

Multiple warnings had been mounting since the 1990s about the dangers of nontransparent credit default swaps, derivatives and other new financial instruments, and low capital reserves. Here are a few: In 1993 a Republican congressman issued a 902-page report warning against systemic risk in the financial sector. In 1994 the risk was featured on the front pages of Fortune magazine and the Washington Monthly. Federal Reserve Chairman Greenspan said in response that the Feds and the Treasury were ahead of the curve on derivatives and not to worry. Two regulatory bills introduced that year by Democratic representatives went nowhere. A senior Federal Reserve official warned the Federal Reserve Bank (headed by Greenspan) and others about the astoundingly high debt-to-capital ratio of Long-Term Capital Management in September of 1998 shortly before it collapsed, the first warning shot across the industry’s bow. Prominent newspapers, surely read by regulators, congresspeople, and financial firms, spoke of a housing bubble 1,387 times between 2000 and 2003, and 5,535 times over the next three years. (Zuckerman 2008) Financial experts such as George Soros in 1997 and Warren Buffett in 2003 sounded warnings, the latter calling derivatives weapons of mass destruction.

When Republican-sponsored legislation was proposed in 2005 to rein in Freddie Mac’s mortgage practices, Freddie Mac secretly paid a public relations and lobbying firm $2 million to help kill the legislation. (Neither ideology nor the complexity of the system can explain this act.) Three years later Freddie Mac collapsed and was bailed out by taxpayers. (I will ignore the complicity of rating agencies and their conflicts of interest.) Finally, a few obscure hedge funds did due diligence, largely because of the press stories that were emerging about a bubble, and bet that there would be a crash of the housing market. They profited handsomely by examining the products that regulators were ignoring, and betting against them. It was not a case that no one could have foreseen, as neoinstitutional accounts argue, or that the instruments were all too complex to understand.

Profits

Most firms were profiting immensely from their risky behavior and almost none wanted to stop, even though in some cases their own officers and risk managers warned of the danger to the firm. To take just one example, in 2005 an officer of Countrywide Insurance warned that the mortgage boom was plainly over and the company should tighten its guidelines and plan for reduced volume. The chief risk officer in Countrywide warned repeatedly in 2005 and 2006 that Countrywide’s standards were being compromised by its aggressive approach. The head of the firm ignored the warnings, and the firm collapsed in January 2008.

Goldman Sachs was more strategic. Warned repeatedly of the impending meltdown by an obscure hedge fund owner, John Paulson, it continued to sell toxic mortgages to its clients but also took out insurance in case its recommended products failed. The more its clients bought, the more the clients lost, but the more Goldman Sachs made on its insurance. It has, until this writing, refused to estimate the profits this unethical maneuver produced. But it made sure that the government bailed out the insurer, AIG, and that it received all its insurance payments from the taxpayers’ bailout of AIG.

One justification of this behavior is that everyone was doing it— neoinstitutional theory credits the force of mimetic behavior. In this view, a firm that pulled back from the risky subprime mortgage market would see its stock go down and its top traders leave for other firms. But note that despite the warnings, key economic actors did not just go along with everyone, but actively prevented regulators from reducing the risks their firms were facing. Stronger regulations would affect all firms alike, and not affect competitive behavior. The proposed bills requiring higher liquidity, for example, would spread the short-term pain over all banks, making the competition argument inapplicable. The industry is small enough and heavily interconnected enough for a few leaders to say: We are running high risks here; perhaps we should listen to the congressional warnings and the regulatory agencies that are saying the leverages are out of hand and derivative trading should be more transparent and regulated. We would all benefit if this reduces the chance of a crash. The industry has powerful associations that recommend accepted practices; they could have stepped in if their members wanted them to do so.

The meltdown is neither a normal accident nor a product of an ideology. The free-market ideology the firms and government agents cited as justification for malfeasant behavior was deliberately selected, developed, and promoted. The growing complexity of the financial system made malfeasance easier and its tight coupling magnified its consequences, but it was agents, largely top executives, who increased the risky behavior, and did so knowing the risks. They spread the ideology through the economics profession with research grants and consultancies, and through the business schools with gifts, funding of research projects, and consultancies for faculties, and through the media, which they owned. Always one of many economic theories, the free-market ideology came to the fore only in recent decades, when business actively developed it and promoted it as a justification for deregulation and consolidation.

It is a case of executive malfeasance, where executives who were warned knowingly put their clients, their firms, and the economy at risk for their own private interests. I would indict government regulators and many congresspersons as well. Regulatory efforts in 2010 have been weak, and consolidation of the financial sector continues, perhaps setting the stage for further economic catastrophes.

THE GULF OF MEXICO OIL SPILL

BP: Profits over Safety

The April 20, 2010, oil spill in the Gulf of Mexico is one of the largest ecological disasters the United States has ever experienced; its extent is still unfolding. It also may be the most well-documented case of executive malfeasance by a corporation that we have seen since the tobacco-industry disclosures. While the theme of this book, concentrated vulnerabilities, plays a role here as well, it is a more ambiguous one. A fair degree of economic concentration is required for deepwater drilling, and concentrated human populations play a more remote role. But the Gulf of Mexico can be said to be a concentrated ecological system, with about fifty current vulnerabilities in the form of operating deepwater wells and thirty-three exploratory wells, which are more likely to have failures, and the health and economic opportunities of shoreline communities can be affected.

The spill story starts with John Browne, who rose to chief executive officer of BP in his forty-one years with the company. Until his resignation in 2007 he had transformed a sleepy oil company into the second-largest independent oil company in the world. In his ten years as chief executive the firm had increased in value fivefold. Its growth was largely through mergers (Standard Oil, Arco, Amoco), and Browne is credited with starting a trend toward megamergers in the industry, leading to the concentration The Next Catastrophe is so concerned about. After taking over Amoco in 1999 Browne started an ambitious cost-reduction program, ordering 25 percent cuts in refineries and pipelines that led, according to various reports, to a major accident at Texas City, Texas, in 2005 (fifteen deaths and 180 injuries) and a major spill the next year at a Prudhoe Bay, Alaska, pipeline.

The details of the Texas City refinery accident, as documented by the U.S. Chemical Safety and Hazard Investigation Board (CSB), are devastating. (Chemical Safety and Hazard Investigation Board 2007) Executives at the facility repeatedly warned top management of the risks they were running because of budget cuts, particularly in process safety. One plant meeting organized by plant management even showed a slide saying that the Texas City plant was an unsafe place to work, and documents show that for two years prior to the accident plant management warned that people were going to die because of cuts in personnel, poor maintenance, run-down equipment, and lack of process safety. Regulatory agencies were at best somnambulant. BP top management took no action and insisted upon carrying out the cuts at the refinery fully. The explosion cost the company $1.5 billion, and initial fines were $2.1 million, but third-quarter profits that year were up 34 percent, to $6.46 billion. (They climbed to $16.6 billion in 2009.)

A similar script played out the next year in BP’s Prudhoe Bay pipeline facilities, while the company was still under a court-ordered probation. (Alaskan oil was the major source of BP’s profits at the time.) Again there were warnings from local workers and managers that the severe cuts were endangering pipeline integrity and risking expensive and ecologically damaging spills. Injecting a corrosion inhibitor was discontinued as a cost-saving step, and investigating corrosion with a device (a smart pig) was not called for. Four times the leak detection alarm sounded in the week before the spill was discovered, but these were considered false alarms by management. The spill was discovered when an employee driving by smelled the oil and stepped into it when leaving the truck to investigate.

It was huge, 212,252 U.S. gallons, covering two acres. A small fine of $20 million (a little more than a day’s profit) was levied, and the local subsidiary, BP Exploration (Alaska) Inc, went on three years’ probation. Shortly after the accident it was discovered (and then only because the U.S. government ordered a smart pig inspection) that another six miles of pipe were so corroded that much of the Prudhoe oil field had to be shut down. (Wikipedia 2010) Another large spill occurred on November 29, 2009, which is still under criminal and civil investigation, and a blog by Jason Leopold notes that before the spill, worker reports and BP documents indicated that there were hundreds of miles of rotting pipe, as well as inadequate emergency facilities to deal with the next spill. The budget for the Alaska facilities has been cut each year since 2008. (Leopold 2010)

The Occupational Safety and Health Administration (OSHA) found that BP accounted for nearly half of all safety citations to the entire refining industry between mid-2007 and early 2010, and three times as many willful violations—executive malfeasance— as the rest of the industry combined. (Morris and Pell 2010) But forceful testimony by an OSHA official, Jordan Barab, indicts the whole refining industry. Barab finds that the petrochemical industry is repeating the same glaring mistakes despite their losses and the fines they receive. He gives several instances of ignored warnings; is concerned with worker harassment; and cites the inadequacy of measuring safety with hard hat requirements and workdays, noting a twenty-year-long effort by OSHA to get companies to focus on process safety rather than just individual safety. In the past decade deadly accidents have been especially pronounced. It is not a case of a few bad apples, even if BP is the worst. He finds the same violations committed by multiple refineries, and in multiple parts of a single refinery. (Barab 2010)

The Gulf of Mexico Spill

The Macondo well spill in the Gulf of Mexico on April 20, 2010, is being extensively investigated at the time of this writing (August 2010), but enough has been documented to show a continuing failure of top executives at BP to put safety at least on a par with profits. Management of the Macondo well was under pressure from above to cut costs and take risks that their own employees and the subcontractors (Transocean, Halliburton, and consultants) warned against.

The House Committee on Energy and Commerce sent a letter, signed by Representatives Henry Waxman and Bart Stupak, to the CEO of BP, Tony Hayward, on June 15, 2010. (Waxman and Stupak 2010) This letter very conveniently sums up evidence of willful, knowing risk taking in the face of credible warnings from employees and the staff of consultants and contractors. The letter states in part:

On April 15, five days before the explosion, BP’s drilling engineer called Macondo a nightmare well. In spite of the well’s difficulties, BP appears to have made multiple decisions for economic reasons that increased the danger of a catastrophic well failure. In several instances, these decisions appear to violate industry guidelines and were made despite warnings from BP’s own personnel and its contractors. In effect, it appears that BP repeatedly chose risky procedures in order to reduce costs and save time and made minimal efforts to contain the added risk.

At the time of the blowout, the Macondo well was significantly behind schedule. This appears to have created pressure to take shortcuts to speed finishing the well. In particular, the Committee is focusing on five crucial decisions made by BP: (1) the decision to use a well design with few barriers to gas flow; (2) the failure to use a sufficient number of centralizers to prevent channeling during the cement process; (3) the failure to run a cement bond log to evaluate the effectiveness of the cement job; (4) the failure to circulate potentially gas-bearing drilling mud out of the well; and (5) the failure to secure the wellhead with a lockdown sleeve before allowing pressure on the seal from below. The common feature of these five decisions is that they posed a trade-off between cost and well safety.

The committee letter goes into detail on these and other failures, noting the warnings received and ignored. For example, quoting from the House committee letter: Despite this and other warnings, BP chose the more risky casing option, apparently because the liner option would have cost $7 to $10 million more and taken longer. Their own Plan Review recommended against it. Halliburton, a contractor on the job, warned them of SEVERE gas flow problems if BP used six rather than twenty-one centralizers on the final string of casings. A BP drilling engineering team leader agreed, noting similar problems with their Atlantis project, but upper management at BP rejected the advice, an official explaining in an email that It will take 10 hours to install them. . . . I do not like this. Another official recognized the risks but emailed, Who cares, it’s done, end of story, will probably be fine. (Waxman and Stupak 2010)

They had reason to worry about costs in their operation; as noted, BP was severe on cost reduction, even though the company was immensely profitable. In 2009, because of a hurricane, they had to abandon an exploratory well that had been started two months earlier, and they resumed drilling it with the Deepwater Horizon rig. But the drilling was already forty-three days behind schedule at the time of the explosion, which is serious since the rig rents for approximately $500,000 a day, though friendly tax laws allow 70 percent of that as deductible. The House Committee letter notes the cost savings for other areas they covered; for example, a cement bond log was required by Minerals Management Services and recommended by contractors, but would have cost the company over $128,000 to complete and taken an additional nine to twelve hours. A top contractor had a crew on the rig ready to do it, but they were sent home ten hours before the explosion. An independent engineer asked by the committee to comment said it was unheard of to not have the cement bond log when using a single casing approach; the decision was horribly negligent.

Journalists have turned up other warnings and corner cutting by both BP and Transocean, the owner of the rig BP was leasing. For example, a detailed story by Ian Urbina in the New York Times notes the warning signs that started some months before the accident, increased in the five days prior to the blowout, and were physically strident with bumps, pops, and alarms the day of the accident. (Urbina 2010a) A three-part series in the Wall Street Journal provides revealing details of the drama and the conflict between BP as owner and Transocean as contractor. (Blackmon et al. 2010; Casselman and Gold 2010; Gold and Casselman 2010) (The lack of contingency plans should there be a blowout and the ineptness of the MMS are also well summarized by Urbina, but that is not our concern here. For an account of fantasy documents by government and oil companies that promise rapid responses to disasters, brought up to date with the Gulf spill, see Clarke 2010a. For an account of Secretary of the Interior Ken Salazar’s pro-oil stance and the failure to reform the MMS as President Obama had promised to do, see Tim Dickinson’s depressing account. (Dickinson 2010)

Transocean’s Role

Most of the workers on the rig were employed by Transocean, which is the largest offshore drilling company in the world and has fourteen rigs operating in the Gulf. Transocean was concerned enough about safety to hire Lloyd’s Register to do a safety survey of three of its deepwater rigs operating in the Gulf a few months before the disaster. This was in response to a series of serious accidents and near-hits within the global organization. (Urbina 2010b) Among those accidents was the near sinking of the Horizon rig in 2008 as the result of a ballast system failure that flooded the rig. Why the Horizon rig sank in the April 2010 disaster is still a mystery, but the survey turned up continuing stability problems on Horizon—for example, ballast doors that would not close automatically.

Transocean does not come out well in this disaster, especially since their own evaluations showed so many equipment and personnel problems. Workers noted that the rig had not been in dry dock for nine years despite equipment problems that BP and Transocean’s surveys had signaled. The Transocean safety study referred to at least thirty-six pieces of equipment in ill repair on the Deepwater Horizon that may lead to loss of life, serious injury or environmental damage as a result of inadequate use and/or failure of equipment. (Urbina 2010b) This and other surveys revealed a culture of fear (over half of the Horizon crew were fearful of reporting safety problems because of reprisals), inaccurate reports, and warnings dismissed. There was also considerable tension between personnel on the rig and the BP shore offices.

Transocean has been cited twice in recent years by authorities in Britain for failing to properly maintain a blowout preventer and related testing equipment on an offshore drill site there, with officials saying in November 2006 that the device failed in service, exposing persons to risks that endangered their safety. (Lipton 2010)

Public Officials

Executive malfeasance appears to be widespread in the oil industry. It is possibly aided by the interests of the judiciary and members of Congress. The federal judge that blocked President Obama’s moratorium on exploratory deepwater drilling had large personal investments in the oil industry, and specifically with the corporations funding the Horizon operation. As William Freudenburg and Robert Gramling note in their important history and diagnosis of the accident, Blowout, Thirty-seven of the 64 active or senior judges in key Gulf Coast districts in Louisiana, Texas, Alabama, Mississippi and Florida have links to oil, gas and related energy industries, including some who own stocks or bonds in BP PLC, Halliburton or Transocean—and others who regularly list receiving royalties from oil and gas production wells. (Freudenburg and Gramling, forthcoming) The Congressional committees charged with keeping watch over the oil and gas firms had nearly thirty members with at least $9 million in investments in the firms they were overseeing. (Anderson and Kunzelman 2010)

Is BP an Exception?

Normal Accident Theory (NAT) argued that if we had systems with catastrophic potential that might fail because of their sheer complexity and tight coupling, even if everyone played as safe as is humanly possible, these systems should be abandoned. Catastrophes would be rare, but if inevitable, we should not run the risk. Redesigning such systems to reduce complexity and coupling to tolerable levels is one alternative, generally by using modular rather than integrated design, as argued in chapter 8 of this book and particularly in my discussion of global firms. (Perrow 2009) This hardly seems possible with deepwater wells. Another way to reduce our vulnerability is to limit the concentrations of hazardous substances, so accidents will be less severe, as I argue for many systems with catastrophic potential in this book. Again, this will not work with shallow or deepwater drilling; maximizing the amount of crude flowing is the whole point, and the hazardous substances are bound to affect the ecology and nearby communities, with some effects lasting for decades. Though this suggests that the complex and tightly coupled practice of deepwater drilling should be abandoned because of the catastrophic potential of an accident, there are other arguments to consider.

Perhaps BP is the exception, and other drilling firms take the obvious safety steps it failed to take. A cryptic statement in July 2010 by Attorney General Eric Holder, however, is not reassuring. When asked if BP was doing anything different from others in the industry, Holder said he observed a certain commonality of the way oil companies had been operating in the Gulf. Because the investigation was ongoing, he couldn’t go into specifics. (Raju 2010) This possibility, that other firms are just as profit-oriented at the expense of safety as was BP, should be seriously considered. If BP is an outlier, it is not likely that the newly reformed Minerals Management Service (now renamed the Bureau of Ocean Energy Management, Regulation and Enforcement) is likely to discover that. The MMS inspected twenty-nine of the thirty-three deepwater exploratory wells after the BP explosion. (Exploratory wells are the most dangerous; production wells even survive hurricanes without having spills. Exploratory wells may be reopened as production wells, but generally new wells are drilled close by for production.) Their inspection found no serious violations. One may be skeptical of their finding. For example, MMS only recommended, but did not require, a backup blowout preventer (the preventer failed in the Horizon explosion and spill). It did not set or enforce specifications for pipes, allowing BP to use a less safe design in its rig. It did not know that many key alarms were routinely disabled. It often approved dangerous practices, such as having few centering rings. Furthermore, many unsafe practices in the Horizon rig occurred when the rig ran into trouble; inspection would not catch such risky practices. We cannot be reassured that BP is an outlier and the other twenty-nine drilling operations would operate safely.

But the slim data on our experience with two decades of deepwater drilling make it hard to judge the degree of danger. A Transocean rig in the North Sea had an emergency that resembled the Horizon one in 2009, but a Halliburton adviser working on the Horizon rig was not even aware of it. (Brown 2010) There have not been many major blowouts in the Gulf, though there are still residues on the coast of Mexico thirty years after the Ixtoc disaster in 1979. Blowout preventers are supposed to be the last line of defense, but one study of wells in North America and the North Sea found that in eleven cases of their being used, they were successful in only five. (Barstow et al. 2010) In June 2007 there was a blowout at the Cote de Mer field in Louisiana; a surge of gas blew through the blowout preventer, 22,261 feet down. It cost $75 million to bring it under control. (Carroll, Polson, and Klimasinska 2010) News accounts are few and do not estimate the amount of oil spilled. There may have been other Gulf blowouts that have not made it onto Google.

Is Exxon the Model?

Journalists have suggested that BP was the risk-taking outlier and point to Exxon Mobil’s safety record, supposedly the gold standard for safety as a result of the Exxon Valdez accident in 1989. One explanation for Exxon’s unwillingness to take risks, if that is true, is that it is a highly structured organization with extensive training for everyone. A magazine story reports that in joint operations, which are common in the industry, Exxon personnel always stood out as the most knowledgeable and highly trained, and they often took charge even though they nominally should not have. (LeVine 2009) Exxon Mobil CEO Rex Tillerson told a House Committee, regarding BP’s Macondo well, We do not proceed with operations if we cannot do so safely. We would not have drilled the well the way they did. (Bea et al. 2010)

This would fit with the notion of High Reliability Organizations (Weick and Sutcliffe 2006), a theory that emphasizes the necessity and effectiveness of safety cultures, something that virtually all government and NGO reports say that BP lacked. Another explanation is that BP is more like a bank than an engineering company. In contrast to Exxon Mobil, which owns and runs almost all of its own equipment, BP relies upon outside contractors. Still another explanation is not inconsistent with these, but quite different: Exxon is so big and so rich (the richest corporation in the world for some years running) that it does not need to take chances. Smaller and poorer companies have to take chances. If this is true, it does not fare well for future drilling; concentrated as the industry is, offshore drilling still has many small and hungry firms.

An account by Jad Mouawad tells a dramatic story of Exxon’s concern with safety, and gives us a bit of a picture of all that is involved in this complex industry. (Mouawad 2010) In September 2006 Exxon, after five hundred days (!) of drilling an exploration well called Blackbeard in the Gulf, set a record: a depth of 30,067 feet. (This was not a deepwater well, but an ultra-deep well started in seventy feet of water off the Louisiana coast. The risks and complexity of drilling increase with the ocean depth, of course, but the major problems are the extremely high temperatures and pressures—enough to crush a large truck—5.7 miles beyond the ocean bottom. Ultra-deep wells have the disaster potential of deepwater wells; indeed, since they can be very close to populations, the potential is even greater.) Exxon estimated that they were within two thousand feet of a field with around a billion barrels of oil and gas, an elephant, a record for the Gulf. But they experienced a kick—a gush of natural gas such as BP experienced with its Macondo well. The higher-than-expected pressure could not be relieved with drilling mud. Engineers said it was too dangerous; the geoscientists wanted to keep going. The chairman and chief executive officer of Exxon sided with the engineers and the project was abandoned, written off as a dry well, at a cost of $200 million. (Mouawad 2010)

Does this make the case for the possibility of safe deep-well drilling, and for huge companies that can afford not to take great risks?

In 2007 a small company, McMoRan Exploration, bought the rights to the Blackbeard property and commenced drilling. James Moffett, the cochairman of MMR and a geologist, said that high pressures at thirty thousand feet would drop with more drilling because of a quirk of deep geology. In 2008, after seven months of drilling, they had gone 2,900 feet beyond Exxon. They boasted of a great find of between a half billion and several billion barrels of oil; it could be the biggest find in the Gulf (but also, so close to the shore, the biggest threat if there were a blowout). They ordered the equipment to make the well productive—which can take two years, and much additional capital. An Exxon spokesman said, We’ll see. There have been no updates as of the time of this writing. (Mouawad 2010)

Does this make the case for small and moderate-sized organizations that are willing to take big risks in the Gulf? The database is too small for confident predictions.

Other Arguments

Another argument for continued drilling is that we have learned from our mistakes, and will be safer in the future. But as Lee Clarke notes in a blog post (Clarke 2010a), the biggest lesson that BP may have learned from the ExxonValdez disaster is that although the initial punitive damages awarded by a federal jury were $5 billion, the Supreme court reduced this to $500 million. Although promises were made after Valdez to upgrade spill recovery technology and preparations, the BP spill revealed that the industry had made almost no changes since Valdez. Sometimes firms may learn something we wish they hadn’t: that courts will reduce large fines.

One argument against a ban on deepwater drilling is that the expensive rigs able to do this would simply move to other locations that have no ban. (A recent news story indicates that BP is selling its land-based drilling properties and plans to focus on ocean drilling, having signed a large contract with Egypt to drill in the ecologically sensitive Mediterranean.) This is similar to the argument against intensive policing in high-crime areas—the criminals merely move to new areas that have seen their police forces decline, so intensive policing in the Gulf does little. But since it would not diminish the policing resources of other nations, it is still a net gain. In addition, were they to move to Norway or Brazil, where much drilling takes place, they would have to have stronger safety standards—including, e.g., a backup blowout preventer—than those required in the Gulf. They might move their rigs to other nations throughout the world (especially Southeast Asia and Africa) where safety standards are presumably below those of the Gulf of Mexico, and where there may be ecosystems as vulnerable as those of the Gulf. True enough, but something is still gained by protecting the Gulf ecosystem from further assaults. It is even possible that banning deepwater drilling in the Gulf would highlight the risks elsewhere and lead to safer systems.

A further argument has been put forth by the oil industry and state governments bordering the Gulf: the economic impact upon the area would be