Start Here
Donate

Lessons from Other Fields

Commercial Air Travel

The everyday act of trusting an airplane is built on layers of independent verification we never think to question.

In Brief

When you board a plane, you trust your life to machinery you cannot inspect. You don’t check the pilot’s training, read the maintenance logs, or test the engines. You don’t have to — because behind that single act of trust stands an architecture of independent verification so thorough that flying has become the safest way to travel ever devised.

The pilot’s competence was certified by the FAA, and after the 2009 Colgan Air crash the law now requires 1,500 hours of flight time before a pilot can fly for an airline. The aircraft design passed federal certification. Maintenance is logged under auditable rules. And if anything goes wrong, an independent agency — the NTSB, which by law sits entirely outside the FAA — investigates in public, while the aircraft’s own black box preserves an objective record of what actually happened. The investigator and the regulator are deliberately kept separate, so the agency being examined can’t shape the findings.

The cautionary tale is the Boeing 737 MAX. A stretch of the certification system that let Boeing effectively certify its own work allowed a flawed flight-control system, MCAS, through with almost no scrutiny. Two crashes — Lion Air 610 and Ethiopian 302 — killed 346 people. The response was the pattern of a living safety system: a 20-month grounding, a scathing congressional investigation, a new law tightening the self-certification program, and a $2.5 billion criminal settlement — not excuses.

The transfer to elections is direct. Getting an election wrong is at least as consequential as getting a flight wrong, compounded across policy and decades — yet the verification apparatus the public demands for flight is roughly an order of magnitude more rigorous than the one in place for election reporting. Actual Vote supplies the missing equivalent of the black box: an independent, primary-source record of what each precinct’s tabulator actually reported, captured before the data leaves the precinct and held outside the custody of the parties whose work it verifies.

I. What This Domain Is

A passenger boarding a commercial flight makes a series of demands without realizing it. They expect the pilot to be competent. They expect the aircraft to have been built and maintained correctly. They expect the design itself to have been tested against rigorous standards. And they expect that if anything goes wrong, someone independent will find out why and make the answer public. The passenger cannot personally verify any of this. They cannot examine the pilot’s logbook, pull the maintenance records, audit the certification of the aircraft type, or inspect the engines on the walk down the jet bridge. Every element of their safety depends on information they have no direct access to.

This is the same epistemic structure as a citizen evaluating an election result. The voter cannot walk into the county elections office and watch the count. They cannot pull the memory cards from the tabulators or confirm that the total their state published matches the number the scanner actually printed when the polls closed. In both cases, the person whose stakes are highest is structurally unable to verify the thing they most need to trust.

Aviation closes that gap with one of the most complete verification architectures society has ever built — independent certification, auditable records, a crash-protected objective recorder, and an investigative body deliberately walled off from the regulator it scrutinizes. This entry describes that architecture, the safety record it produces, the way it responded to its most consequential modern failure, and what its logic implies for the least-verified step in American elections: the reporting layer that turns precinct tabulator totals into official results.

II. The Institutional Architecture

The architecture begins with the pilot. Flying for a scheduled U.S. airline requires the Airline Transport Pilot certificate, the highest the FAA issues, governed by 14 CFR Part 61, Subpart G. Since 2013, an ATP applicant must log at least 1,500 total flight hours, including specified cross-country, night, and instrument time — a tenfold increase over the 250 hours that could previously qualify a first officer. That floor was not an abstraction. It was mandated by the Airline Safety and FAA Extension Act of 2010, passed directly in response to the February 2009 crash of Colgan Air Flight 3407 near Buffalo, which killed 50 people. Pilots also hold FAA medical certificates issued by designated examiners, earn type ratings for each specific aircraft they fly, and must pass recurrent proficiency checks within the preceding 12 months, administered by FAA-designated check pilots.

The aircraft itself must be certified before it may carry passengers. Under 14 CFR Part 21, the FAA issues a type certificate confirming the design meets federal airworthiness, noise, and emissions standards — and the authority to issue or amend that type certificate is never delegated to the manufacturer. After certification, the FAA polices the fleet through Airworthiness Directives, legally enforceable orders issued under 14 CFR Part 39 whenever an unsafe condition is found. There is, however, a structural seam in this layer worth naming now, because it is where the cautionary case lives: the FAA’s Organization Designation Authorization program delegates specified certification functions to qualified manufacturers, whose own employees make many findings of compliance on the FAA’s behalf. The original type certificate stays with the FAA, but a great deal of the granular certification work is performed by the company being regulated.

Maintenance operates under its own documentary regime. Repairs and alterations are governed by 14 CFR Part 43, every maintenance action must be recorded, and only an FAA-certificated Airframe and Powerplant mechanic — a credential requiring 30 months of documented experience plus written, oral, and practical examinations — may approve an aircraft for return to service. The records are auditable precisely so that no individual’s say-so is the only thing standing between a defect and the next flight.

Then there is the black box — in fact two crash-protected recorders. The Flight Data Recorder continuously logs dozens of aircraft parameters many times per second; the Cockpit Voice Recorder preserves flight-deck audio. Their housings are engineered to survive crash impact and fire, and after an accident they are read not by the airline or the manufacturer but by engineers in the NTSB’s Vehicle Recorder Laboratory in Washington. The recorder exists for one reason: to create an objective, tamper-resistant record held outside the custody of any party with an interest in the outcome.

The keystone is the National Transportation Safety Board. The NTSB is, by the Independent Safety Board Act of 1974, “an independent establishment of the United States Government” — not part of the Department of Transportation, and not part of the FAA. Congress made it independent on the explicit reasoning that no agency can credibly investigate failures of systems it also operates or regulates. The NTSB runs investigations through a “party system” in which the FAA, the airline, and the manufacturer contribute technical expertise but report to the Board, which retains control; persons in litigation roles are excluded, and the factual record goes into a public docket. The Board deliberates probable cause in a public meeting and issues safety recommendations — but it cannot itself ground an aircraft, impose a fine, or mandate a design change. Those powers belong to the FAA. The separation is the point: the investigator finds the truth and recommends; the regulator acts. Neither can quietly absorb the other.

III. Why This Exists

The architecture exists because the consequences of a single failure are catastrophic, immediate, and borne by people who had no way to protect themselves. A passenger cannot price the airworthiness of the specific airframe they board, so the market cannot be left to sort it out flight by flight. Society instead requires that every layer be verified in advance and that failures be investigated in public afterward, so that the lesson of each accident is forced back into the design of the system.

The payoff is measurable. For nearly sixteen consecutive years — from the Colgan Air crash in February 2009 until a midair collision near Reagan National Airport in January 2025 — there was no fatal crash of a major U.S. scheduled airline, a span over which U.S. carriers transported roughly 8 billion passengers. That record is not luck. It is the cumulative product of certification, auditable maintenance, the black box, and the public-investigation loop, each catching failures the others might miss, and each tightened in response to specific accidents.

The same logic transfers cleanly to elections. A citizen cannot verify, on their own, that the reporting layer faithfully carried their precinct’s count into the official totals. If that step is left unverified, trust in the result has nothing concrete to rest on. The stakes — economic policy, foreign policy, judicial appointments, the legitimacy of the government itself, compounded across decades and hundreds of millions of people — are at least comparable to the stakes of aviation safety. If the architecture is worth its cost for flight, it is worth a comparable cost for the vote.

IV. The Cautionary Case: The Boeing 737 MAX

The Boeing 737 MAX is the clearest modern illustration of what happens when a verification architecture is allowed to develop a self-certification gap — and of what a serious institutional response looks like.

To compete with a new Airbus model, Boeing fitted larger, repositioned engines to the existing 737 airframe, which changed the aircraft’s handling. To compensate, Boeing added a flight-control software system called the Maneuvering Characteristics Augmentation System (MCAS), which could automatically push the aircraft’s nose down. As a TC ODA holder, Boeing delegated much of the certification work on the MAX to its own employees. When MCAS was significantly expanded in scope during development — so that it would now activate across a far wider range of conditions and could be triggered by a single angle-of-attack sensor — two Boeing pilots who learned of the change concealed it from the FAA group responsible for pilot training. As a result, MCAS was left out of the final pilot training materials entirely. Airline crews flying the aircraft did not know the system existed.

The cost was 346 lives. On October 29, 2018, Lion Air Flight 610 crashed into the Java Sea, killing all 189 aboard, after MCAS repeatedly forced the nose down in response to a faulty sensor and the crew could not override it. On March 10, 2019, Ethiopian Airlines Flight 302 crashed under nearly identical circumstances, killing all 157. On March 13, 2019, the FAA issued an emergency order grounding the entire 737 MAX fleet — the longest grounding of a U.S. airliner in history, lasting roughly 20 months until the aircraft was recertified in November 2020 with redesigned software and new training.

The institutional response followed the diagnostic pattern of a healthy verification system: it strengthened rather than rationalized. The House Transportation Committee’s 238-page final report, released in September 2020 after an 18-month investigation, identified a “culture of concealment” at Boeing and “grossly insufficient oversight” by the FAA, including the conflict inherent in letting Boeing employees perform certification work on Boeing’s own aircraft. The DOT Inspector General’s February 2021 audit found that the FAA had not understood Boeing’s MCAS safety assessments until after the first crash and that its ODA personnel lacked adequate independence. Congress responded with the Aircraft Certification, Safety, and Accountability Act in December 2020, which required FAA approval of individual ODA personnel, embedded safety advisors in ODA programs, mandated Safety Management Systems, and created whistleblower protections shielding those personnel from employer interference. And the Justice Department charged Boeing with conspiracy to defraud the United States, resolved by a $2.5 billion settlement in January 2021. (The legal posture continued to evolve thereafter — the government later determined Boeing had breached that agreement, and the matter was resolved through subsequent proceedings — but the original response established the precedent.)

The 737 MAX did not prove that aviation certification is impossible. It proved that a specific gap — letting the regulated party certify its own critical systems without independent scrutiny — had lethal consequences, and the system closed the gap. That is the behavior of an architecture that is alive.

V. The Transfer to Elections

The structural parallel is exact at the level that matters. Both domains involve collective trust in the integrity of a process that no individual participant can directly observe, where the parties generating the information have potential interests in the outcome, and where a single unverified layer can produce catastrophic, hard-to-reverse harm. In aviation the unverified layer would be an uncertified design or an unrecorded repair; in elections it is the reporting layer, the transmission of precinct tabulator totals into published official results.

The asymmetry in rigor is striking. Aviation demands independent certification of pilots and designs, auditable maintenance records, a crash-protected objective recorder, and a public investigation by a body walled off from the regulator — with continuous reform driven by each documented failure. Election reporting, by contrast, is checked by audits that vary widely by state and are usually calibrated to the counting layer rather than the reporting layer; there is no objective primary-source recorder routinely preserved outside official custody, no independent investigative body with the NTSB’s authority, and no equivalent of the 737 MAX reform loop that forces the architecture to strengthen after a failure.

The 737 MAX offers one more lesson specific to elections: the danger of self-certification. The crashes happened because the party whose work most needed independent scrutiny was effectively allowed to scrutinize itself. In the election reporting layer, the equivalent risk is that the entities generating the official totals — administrators and equipment vendors — are also, in effect, the only parties verifying them. Aviation’s answer was to insert independent verification at exactly that seam. The election analog is to insert an independent, primary-source record at the reporting layer.

VI. Where Actual Vote Fits

Actual Vote is the election equivalent of the black box. It does not replace the FAA, the NTSB, or any official audit, any more than a flight data recorder replaces a maintenance program. What it supplies is the one element whose absence is most conspicuous in the election case: an independent, primary-source record of what actually happened at the moment that matters, captured before the data leaves the custody question entirely.

In aviation, the recorder’s value is not that it presumes a crash. Most of its value is in the ordinary case, where the objective record allows investigators to confirm that the aircraft and crew performed as they should. The black box is a standing capacity for verification that pays off whether or not anything went wrong. Actual Vote plays the same role at the precinct level: it captures what the tabulator reported — the poll tape — as an independent record that can be compared against the official published result. When the comparison matches, that match is itself evidence that the reporting layer functioned. When it does not, the discrepancy is preserved in a form outsiders can examine, exactly as a recorder preserves the parameters of a flight that ended badly.

The deeper parallel is to the role independent capacity played in forcing reform. The 737 MAX architecture strengthened because specific failures were documented in a form that could not be waved away — the recorders, the investigations, the public docket. The objective record is what made denial impossible and reform necessary. Actual Vote is positioned to create the same dynamic for election reporting: its immediate contribution is the per-precinct evidence it produces, and its long-run contribution is the pressure that accumulated evidence places on the political economy of election-verification reform. Aviation is the existence proof that an independent objective record, faithfully preserved, eventually reshapes the system around it.

VII. Cross-References

This entry most directly illuminates the reporting-layer case studies, where the absence of an objective primary-source record is the recurring failure:

  • Shelby County, Tennessee, 2015. Bennie Smith’s single photograph of a poll tape that did not match the official result is the election equivalent of a recovered black box: one piece of independently preserved primary evidence that turns an unverifiable claim into an undeniable discrepancy.

  • Prince William County, Virginia, 2020. A reporting-layer error that survived a risk-limiting audit at greater than 99 percent confidence is the election equivalent of an accident whose cause lived entirely outside the system that was being checked — the audit, like an inspection scoped to the wrong subsystem, asked a different question than the one that mattered.

  • Monmouth County, New Jersey, 2022. A “100 percent accuracy” audit that reported a clean result while the wrong candidate held office is the election equivalent of a certification that was procedurally complete and substantively wrong — the precise failure mode the NTSB’s independent investigation exists to catch.

  • The Fraction Magic Architecture. A vote-reporting system whose internal structure permits silent manipulation within the letter of its rules is the election equivalent of a design flaw that self-certification let through — the architectural hazard exists, its exploitation is possible, and the aviation response to an analogous flaw would have been prompt and structural.

VIII. Further Reading