Safety in international security: a view point from the practice of accident investigation

ABSTRACT While security points to a deliberate harming of humans and/or the environment, safety refers to unintended damage. In this view point, I will analyse how the distinction between safety and security matters in the practice of accident investigation and I will argue that the division between the fields is problematic for the assessment of security-related safety risks. Drawing on the case of the our accident investigation into the downing of flight MH17 above Ukraine in 2014, I highlight key dilemmas the Dutch Safety Board dealt with.

contribute to better understanding how dangers were or can be brought about, notwithstanding good intentions. While in academic journals devoted to (international) security, such as Contemporary Security Policy, articles focus on issues related to crime, war, military interventions, corruption, proliferation, deterrence, and (cyber)terrorism, and hence on how to understand and deal with actors with bad intentions.
Notwithstanding the shared orientation on risks and hazards, safety and security have become different worlds, addressed by different communities of practices, and also academic (inter)disciplines. Perhaps with the exception of Ulrich Beck's Risk Society (1986) and some other references, security and safety scholars read different books and articles, publish in different journals, visit different conferences, participate in different teaching programs, talk to other people, and have different audiences.
Yet in practice, safety and security are not completely disconnected. For instance, when one starts from the consequences, it does not matter so much whether a hospital is hacked or whether ICT systems fail for other reasons: The impact for patients may be similar. The same holds for nuclear facilities: Whether critical systems fail for safety or security reasons, the (international) consequences will be comparable, as we have learned from the Fukushima accident.
I am currently serving as board member of the Dutch Safety Board, which is the accident investigation authority in The Netherlands. 2 Accident investigation is concerned with analysing the causes of incidents. In various sectors, states are obliged to investigate accidents with the aim to learn how to improve safety. Such international obligations are part of various frameworks adopted by the United Nations (UN), the European Union (EU), and/or included in national legislation. For example, through the UN's International Civil Aviation Organisation (ICAO), with its seat in Montreal, countries are obliged to investigate aviation accidents and incidents. In sector-specific regulations, the EU member states are required to organize bodies for accident investigation. For example, Directive 2009/18/EC requires member states to investigate maritime incidents. Similar obligations exits with regard to rail and industry accidents.
As a response to these obligations, states have installed investigation bodies. In many countries, accident investigation is organized in sectoral bodies, such as the Rail Accident Investigation Branch (RAIB) in the UK and the German Bundesstelle für Flugunfalluntersuchung (BFU). In The Netherlands, all accident investigation is concentrated in one body, the Dutch Safety Board. Only Finland and Sweden also have concentrated investigations in one accident investigation authority with a broad scope and mandate.
Accident investigation is a safety practice, in the sense that it has been institutionalized to investigate unintended harm. In many of the legal frameworks surrounding this practice, provisions are made for avoiding attribution of blame and liability by accident investigation authorities. Nevertheless, in such investigations, which take the actual damage and harm as the starting point, safety and security may actually intertwine or interfere. In the last years, I have been involved in a number of investigations in which safety accidents have been investigated which clearly had or at least touched upon (international) security dimensions. Examples of such investigations in which safety and security intertwined are the investigation into the downing of the MH17 aeroplane in the Ukraine (Dutch Safety Board, 2014, 2015a, two investigations related to the Dutch military, i.e. a fatal incident during a training in The Netherlands and a fatal training incident in the defence mission in Mali (Dutch Safety Board, 2017a, 2017b and the investigation into nuclear safety coordination between The Netherlands, Belgium, and Germany (Dutch Safety Board, 2018a).
In this view point, I will analyse how the distinction between safety and security matters in the practice of accident investigation and I will argue that the division between the fields is problematic for the assessment of security-related safety risks.

Downing of flight MH17 above Ukraine
On July 17, 2014, 298 people lost their lives when the Malaysia Airlines aeroplane MH17 crashed near Hrabove, a village in the eastern part of Ukraine. There was considerable dismay all over the world, especially when it became apparent that the aeroplane had presumably been shot down. Four days after the crash, the UN Security Council unanimously adopted resolution 2166, in which it expressed its support for an independent international investigation into the crash. The Dutch Safety Board became the lead agency in this investigation, which clearly took place at the intersection of safety and security.
The Dutch Safety Board investigated the causes of the MH17 crash in close cooperation with the bodies for aviation accident investigation in Ukraine, Malaysia, the United States, the United Kingdom, Australia, and the Russian Federation. The investigation was conducted in accordance with the international regulations that apply to independent aviation accident investigation, laid down in Annex 13 of the Convention on International Civil Aviation.

A safety investigation into a security accident
The Annex 13 framework is designed for safety investigations. Yet in the preface to the investigation report, the Board explicitly stated "it soon became clear that the crash of flight MH17 was probably no 'ordinary' aviation accident." Already in the preliminary report issued on September 9, 2014, it was concluded that "[t]he damage observed in the forward section of the aircraft appears to indicate that the aircraft was penetrated by a large number of high-energy objects from outside the aircraft" (Dutch Safety Board, 2014). In the final report, it noted that The in-flight disintegration of the aeroplane near the Ukrainian-Russian border was the result of the detonation of a warhead. … The weapon used was a 9N314M-model warhead carried on the 9M38-series of missiles, as installed on the Buk surface-to-air missile system. Other scenarios that could have led to the disintegration of the aeroplane were considered, analysed and excluded based on the evidence available. (Dutch Safety Board, 2015a, p. 9) With this external causea warhead that detonated above the left hand side of the cockpitthe investigation touched upon security issues. However, the sole objective of an Annex 13 investigation is the prevention of accidents and incidents. The Board therefore explicitly stressed that "[t]he Board is aware that this [report] does not answer one important questionthe question of who is to blame for the crash. It is the task of the criminal investigation to provide that answer" (Dutch Safety Board, 2015a, p. 7). Nevertheless, we had to establish where to draw the boundary in identifying the cause of the crash, knowing that we entered the domain of security. Being as specific as possible about the type of weapon was close to how we would have approached the technical details of a safety accident, but we concluded that determining the launch location fell "outside the mandate of the Dutch Safety Board, both in terms of Annex 13 and the Kingdom Act 'Dutch Safety Board'" (Dutch Safety Board, 2015a, p. 151).
The investigation into the MH17 crash illustrates how safety and security can intersect in accident investigation. It shows the limits of accident investigation when the distinction between safety and security blurs. Yet in such blurred cases important questions about causes cannot be answered as they fall beyond the scope and mandate of a safety investigation and also outside the competences of the investigators. Accident investigators are trained to identify the courses of events that resulted in the accident. Part of their work is interviewing people who have been involved in those courses of events and reconstructing their behaviors which had unintended consequences. The interviewees may have made mistakes or errors, but they did not have the aim to create an accident. Notwithstanding far-reaching legal competences, accident investigators do not have the skills neither the (legal) means to, for example, track down people, interrogate them, tap their communications, search their houses, and track financial flows. Accident investigations are about how to improve safety and hence how to decrease the risks of unintended accidents, so analysing intentional behaviors and tracking down those who committed those acts is not part of that practice. That is the logical consequence of the ways in which safety investigations have developed and are institutionalized.
In research on the governance of safety risks ( van Asselt & Vos, 2006, 2008van Asselt, Versluis, & Vos, 2013), we have identified the problem of role ambiguity, that is institutions playing a role that is not in line with the one(s) attributed to them. We, for example, observed how actors who qualify as risk producers, such as companies producing a product with inherent safety risks or storing hazardous materials, actually served as the risk assessors. We also witnessed how due to all kind of regulatory provisions, the supposed risk assessors only did a meta review of the risk assessment produced by the risk producers, while at the same time, because their advice got rubberstamped, the risk assessors actually took the risk management decisions. Drott, Lange, Skierka, Vach, and van Asselt (2013) convincingly demonstrate how accountability gets lost in such situations of role ambiguity, hence creating a situation Beck has referred to as "organized irresponsibility." This body of interdisciplinary social scientific and legal research on the governance of safety risks demonstrates the importance of role awareness of knowledge institutes which are in one way or the other involved in the governance of risk.
As accident investigation authority, we have the role to investigate accidents in order to draw lessons. So safety investigation can be qualified as experience-based knowledge production. Although we are independent and not formally part of the regulatory system, we provide information decision-makers act upon or even have to act upon. So in that sense, the Dutch Safety Board is as independent body nevertheless a knowledge institute situated in the governance of safety risks. Informed by the problems associated with role ambiguity, we were keen to limit ourselves to the role attributed to us, which was already a daunting challenge anyway. 3 Furthermore, the Dutch Safety Board fortunately embodied enough political, diplomatic, and international experience to be sensitive to the geopolitical dimensions of the MH17 investigation. This was another reason to seriously reflect on our role, as we realized that it was important to stay within the scope of accident investigation and the mandate of our investigation authority. Any role ambiguity or even role expansion could have been detrimental to the whole endeavor. In order to be able to carry out the investigation, we needed common ground among the involved accident investigators from the various countries participating in the investigation, which required that we strictly adhered to the international agreements as well as international and national regulations and that we were able to defend all our choices with references to those frameworks. We also realized that any trespassing would be casted in political terms, so role clarity was also critical in view of our task to carry out an independent investigation (see also Dutch Safety Board, 2018b).
So although we were aware that in fact as safety investigators we were investigating a security accident, we have nevertheless deliberately limited ourselves to the scope and mandate of safety investigations. In doing so, we could establish the direct cause of the MH17 downing, namely a warhead detonating in the vicinity of the cockpit. But the consequence was that we could and did not answer questions about the (international) security causes. These questions about the actual launch location and those responsible for the actual missile launch and the necessary equipment are currently addressed in the international criminal investigation by the Joint Investigation Team (JIT). In this context, it is also relevant to understand that the reports of the Dutch Safety Board cannot be used in Dutch courts as evidence. Such a division of roles might require that in criminal investigation particular issues have to be re-investigated. For the broader public, this might be hard to understand, but it is respecting the difference between safety and security. So although the distinction between safety and security in this investigation actually blurred or at least became fuzzy which complicated the accident investigation, at the same time the distinction between safety and security and the existence of different legal regimes and practices of investigation, also helped us to confine ourselves to the role attributed to us.
The accident investigation into the MH17 demonstrates what safety investigation has to offer when this type of security events takes place. The knowledge of and experience with aviation safety risks was helpful in determining that it had to be an external cause and with the established networks of international collaboration, we were able to identify what kind of external cause (a warhead) and even what type of warhead, missile and system were involved. It provided the next of kin and the public at large clarity about the cause. Criminal investigation, such as currently carried out by the JIT, focus on the intent, and hence on blame and liability. Criminal investigation results in a court case, in which only the evidence is shared which is needed for the accusation. It does not produce the kind of publicly available report as we published about the MH17 and the preparation of trials usually takes much longer than the 18 months we needed in the accident investigation. So the MH17 case actually demonstrates the complementarity of safety and security practices in understanding accidents.

Security-related safety risks
But we did more than investigating the direct cause of the downing of MH17. We also investigated the assessment of this security risk, in order to understand the decision-making on flight routes. One of the major questions asked in the aftermath of the disaster was why aeroplanes were flying over this conflict zone. Although this social scientific investigation in relevant decision-making processes is not a standard part of an Annex 13 investigation, it is common practice in accident investigation to reconstruct how decisions, which provided the context for an accident, were made.
We carried out research among airline operators and we examined what the intelligence agencies, usually considered part of the security system, knew about the risks related to the armed conflict. We concluded that: Although (Western) intelligence services, politicians and diplomats established the intensification of fighting in the eastern part of Ukraine, on the ground as well as in the air, it was not recognized that as a result there was an increased risk to civil aeroplanes flying over the conflict zone at cruising altitude. The focus was mainly on military activities, and the geopolitical consequences of the conflict. (Dutch Safety Board, 2015a, p. 10) This conclusion could be read as that the conflict was primarily evaluated as a security risk, while the safety risks for aviation were not flagged. And those concerned with the safety risks for civil aviation assumed that the unrestricted airspace over Ukraine was safe, not realizing that as a consequence of the expansion of the conflict into the airspace a security issue threatened the safety of the airspace.
This part of the investigation provided lessons on which improvements can be made. The aim of an accident investigation is to identify possibilities for improvement. We concluded that states involved in an armed conflict rarely close their airspace and that more effective incentives are needed to encourage them to close their airspace as precaution. We furthermore concluded that airline operators should take greater account of uncertainties and risk-increasing factors, such as when a conflict expands into the airspace. We also recommended that combining security and safety information needs to be advanced and that the international aviation regulations pertaining to safety and security are currently too divided. These lessons were translated into recommendations to ICAO, ICAO member states, IATA (the organization of airline operators), to states and operators. 4 So in this part of the investigation, we showed a drawback of the division between safety and security practices. In risk assessment, it is problematic that security and safety are treated as different domains, due to which the safety consequences of security risks remain out of sight, leaving society ill-prepared.
The accident investigation into the MH17 downing showed the existence of safety-security risks, which require collaboration across the different fields, practices and worlds. Improvement of the risk assessment practice requires innovation in the assessment of the risk, not only in terms of methods, approaches and sources used, but it also calls for more exchange and collaboration between the safety and security field to facilitate such innovation.
This lesson is further substantiated by some of our other accident investigations. The Dutch Safety Board is also mandated to investigate accidents in the Dutch military. In 2017, we published two investigations concerning such incidents: one about a fatal accident during a military exercise in The Netherlands (Dutch Safety Board, 2017a) and the second about a fatal training incident in Mali during an international mission to which The Netherlands contributed (Dutch Safety Board, 2017b). In the Mali mission four soldiers have died, but none in action. Two died in the incident just mentioned and two others from a helicopter crash.
Military activities are at the center of attention among those concerned with (international) security, but in the field of safety research such activities rarely gain attention, as is demonstrated by the topics treated in security and safety journals. In both defence investigations, we showed how considerations about international security resulted in the Dutch military compromising the safety of training approaches, facilities, resources, and material. We also highlighted that in the military community, which is trained to deal with all kind of security risks and where a strong "can do"-attitude reigns, safety risks can become subordinate. These investigations demonstrate how safety risks can arise in context so focussed on dealing with security risks. These safety risks actually arise from the inherent hazards of weapons, whether part of a military conflict (as in MH17), in the context of peace-keeping missions or in training contexts, as the defence accident investigations demonstrate. To be able to adequately assess such security-related safety risks, collaboration across the fields is necessary to improve safety.

Conclusion
Safety and security have developed into different academic fields and communities of practitioners. In this practice-informed view point, I have reflected on the safety-security distinction from the perspective of accident investigation.
The safety and security distinction matters in the sense that depending on whether or not harm was intentional, different questions are being asked. In violations of safety, the key question is what can be learned to decrease the risks. Culpable mistakes may have been made, which can be brought to court, but the societal emphasis is on learning lessons to improve safety.
The investigation into the downing of the MH17 yields some interesting insights about the distinction between security and safety and its consequences. On the one hand, the distinction turned out to be useful in the boundary work needed to avoid role ambiguity. On the other hand, it also demonstrated that distinctions tend to create divisions between fields, due to which a particular class of risks remained out of sight, that is the security-related safety risks. This lesson was further substantiated in some other investigations in which safety and security intersected. Collaboration is needed to improve the assessment of those risks where security and safety intersect or even interact. Finally, the MH17 case demonstrated the complementarity of safety investigations in case of security-related accidents.
So after the harm is manifest, it is important to be aware of the differences between safety and security and benefit from it. Especially in situations in which safety and security intersect, this requires a good understanding of the differences between safety and security, also in terms of arrangements and institutionalized practices. However, in the assessments of potential risks, the safety and security distinction is less relevant, if not obsolete or even unproductive, in cases where they intersect. The experiences with MH17 and military accidents demonstrate that. Such blurred accidents in which security-related safety risks become manifest, have not materialized before or very rarely, due to which the existing monodisciplinary approaches fell short. The much needed innovation in the assessment and management of risks requires intense collaboration between the two fields and professionals exposed to and trained in both fields.
What did this view point informed by the practice of accident investigation teach us? I would like to conclude that the distinction between safety and security needs to be recognized and benefitted from, the complementarity should be appraised, but the division needs to be solved. Why is it relevant for scholars gathered around the theme of "international security"? All three actions require scholars who are aware of the distinction, who are knowledgeable about the differences and complementarity between safety and security arrangements and who are able to conquer the division where collaboration and learning across the fields are needed to assess securityrelated safety risks and to understand accidents in which security and safety intertwine. Hopefully, this view point contributes to this much needed interdisciplinary cooperation. Notes 1. In various languages, ranging from Dutch to Italian, from Polish to Swedish, from Greek to Russian, from Swahili to Portuguese, the distinction between safety and security does not exist. Both are translated to the same word, such as "veiligheid" (in Dutch), "sicurezza" (in Italian), "bezpieczenstwo" (in Polish) and "usalama" (in Swahili). When the distinction is nevertheless needed, people adopt the English terms, which I regularly witnessed in Dutch policy circles. 2. The Dutch Safety Board has the mandate to investigate all violations or threats regarding safety in The Netherlands and even beyond in case of Dutch involvement in accidents in other countries. For example, a collision with fatalities involving a Dutch-owned ship in the Pacific Ocean is part of its mandate. The Dutch Safety Board covers the full range of safety risks, from food safety to patient safety and from industrial to transport risks. In this section, I will introduce two investigations which clearly relate in one way or another to (international) security. 3. With the final report we also delivered "MH17 about the investigation" (Dutch Safety Board, 2015b) in which account we explained the exceptional circumstances and the dilemmas we faced and the choices made and approaches taken. 4. We are currently in the process of evaluating how these recommendations have been implemented. Next to doing accident investigation, the Dutch Safety Board has a role in monitoring whether the identified possibilities for improvement of safety are also realized.

Disclosure statement
The author is a Board Member of the Dutch Safety Board since August 2014. Together with the chairman and the vice-chairman, she shares the final responsibility for all the investigations, from deciding which accidents to investigate until the publication of the report and the recommendations made. In this article, she reflects on her experiences in this position. Notwithstanding her academic affiliation with Maastricht University, this article should not be seen as scholarly analysis. Rather it aims at a reflexive practitioner contribution to the scholarly debate. The author is herself entirely responsible for the substance and conclusions of this article.

Notes on contributor
Marjolein B.A. van Asselt holds the Risk Governance chair at Maastricht University. Her academic contributions involve numerous articles, book chapters, and books on societal decision-making in situations of scientific uncertainty. Complex risk dossiers in the field of safety have been a recurring topic. In her interdisciplinary studies, she has reflected on the complex role of experts in political-societal arenas. Nowadays, her primary occupation has been outside academia. She was council member of the Scientific Council for Government Policy (in Dutch abbreviated to WRR), an independent think tank advising the Dutch government (2008)(2009)(2010)(2011)(2012)(2013)(2014). Since 2014, she is board member of the Dutch Safety Board, the independent accident investigation authority. Although she still teaches and supervises PhD researchers, she is primarily engaged with applying scholarly insights to societal contexts. However, she considers it important to reflect on her practical experiences in actual governance and feed them back to academic communities.