Is it safe?
— Christian Szell (Sir Laurence Olivier) in Marathon Man1 [1 John Schlesinger, Marathon Man (Paramount, 1976).]
There can be surely be no more terrifying question in the English language than the one posed to Dustin Hoffman’s marathon-running student by Laurence Olivier’s fugitive ex-Nazi. No three words have done less for modern dental health since ‘West Indies sugar’ in the 16th century. Even today, Marathon Man is to dentists what Jaws is to beaches.
As terrifying as the question is, though, it is one that we all must daily confront in some form. It is difficult to argue against safety, but Olivier’s relentless pursuit of it does not end well for him. There is a lesson here: we commonly mistake reliability for safety.2 [2 Nancy G. Leveson, ‘The Role of Software in Recent Aerospace Accidents’, 19th International System Safety Conference (2001), pp. 2–3.]
In the engineering domain, there is no more reliable recipe for disaster than to believe that the safety of a system follows from the reliability of its components. In truth, all ‘safe’ systems are designed in the certain knowledge that their components will prove unreliable. The ‘One Hoss Shay’ of Oliver Wendell Holmes’s satirical poem ‘The Deacon’s Masterpiece’ was built in the opposite belief, with ‘every part as strong as the rest’ so there could be no weak link. Such designs are inevitably brittle: in the end, it simply ‘went to pieces all at once’.3 [3 Henry Petroski, To Engineer is Human (Vintage Books, 1992), p. 29.]
A notable product of successful thinking about reliability is the Internet,4 [4 Randy Bush & David Meyer, RFC 3439 ‘Some Internet Architectural Guidelines and Philosophy’ (ISOC Internet Engineering Task Force, 2002).] a system in which data may be lost at any point. Despite—or, rather, because of—this apparent handicap, it manages to safely and efficiently transport vast quantities of data around the world every day. An internetwork comprising only completely reliable components would require components orders of magnitude more complex—complex enough to ensure that a working system could never emerge.5 [5 Walter Willinger & John Doyle, ‘Robustness and the Internet: Design and Evolution’ (2002).’]
Similar follies have actually been attempted. The hypertext system known as Xanadu was designed from the ground up to have such properties as unbreakable hyperlinks. It proved immune to all attempts at implementation over a period of more than four decades,6 [6 Gary Wolf, ‘The Curse of Xanadu’, Wired Magazine (Issue 3.06, June 1995).] even as the World Wide Web arose and made the effort obsolete. There can now be no doubt that a spectacularly successful hypertext system is possible absent such guarantees, nor is there yet any reason to suspect that one is possible with them.
In Homer’s Odyssey, the flawed hero—as true an embodiment of the human condition as has ever appeared in literature—must choose between two leviathans that bar his passage: the six-headed monster Scylla, who will inevitably feast on the crew but leave the ship to sail another day, or the whirlpool Charybdis, which may or may not swallow them all. Odysseus chooses the reliable option over the risky one. He orders his men to row closer to Scylla, condemning six of them to be devoured.
Humans, it seems, are wired to prioritise reliability over safety.7 [7 Massimo Piattelli-Palmarini, Inevitable Illusions (Wiley & Sons, 1996).] In the words of Alistair Cockburn, ‘People prefer to fail conservatively than to risk succeeding differently’,8 [8 Alistair A.R. Cockburn, ‘Characterizing people as non-linear, first-order components in software development’, 4th International Multi-Conference on Systems, Cybernetics and Informatics (2000).] and the problem is by no means limited to engineering. ‘A “sound” banker,’ lamented the economist John Maynard Keynes, ‘is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional way along with his fellows, so that no one can really blame him.’9 [9 John Maynard Keynes, ‘The Consequences to the Banks of a Collapse in Money Values’, Essays in Persuasion (Macmillan, 1931), p. 176.]
It is often assumed that our unwillingness to take risks is due to a fear of failure—the fear of death. Not so, for if we shun uncertainty and still fail then we have not circumvented failure but guaranteed it. We fear not death, but life. Death is nothing if not reliable; life nothing if not uncertain. Freud postulated the existence of a death-drive,10 [10 Sigmund Freud, ‘Beyond the Pleasure Principle’, On Metapsychology (Middlesex, 1987), p. 308.] thanatos, exemplified by this passage from On the Road:
Something, someone, some spirit was pursuing all of us across the desert of life and was bound to catch us before we reached heaven. Naturally, now that I look back on it, this is only death: death will overtake us before heaven. The one thing that we yearn for in our living days, that makes us sigh and groan and undergo sweet nauseas of all kinds, is the remembrance of some lost bliss that was probably experienced in the womb and can only be reproduced (though we hate to admit it) in death. But who wants to die? In the rush of events I kept thinking about this in the back of my mind. I told it to Dean and he recognised it as the mere simple longing for pure death; and because we’re all of us never in life again, he, rightly, would have nothing to do with it, and I agreed with him then.11 [11 Jack Kerouac, On the Road (Viking Press, 1957), p. 124.]
The key word in that final sentence may be the last. Sal eventually gets his moment of ecstasy, standing outside ‘a fish-’n-chips joint’ in San Francisco’s Market Street;12 [12 ibid., pp. 172–173.] Kerouac finally drank himself to death at the age of 47 in 1969, after more than a decade of trying. When the even-younger Neal Cassady (‘Dean Moriarty’ in this roman à clef) expired the previous year after passing out beside a Mexican railway track, his inevitable early demise at least had the virtue of occurring in wholly unpredictable circumstances.
It is worth remembering that the dying Roy Scheider revealed nothing at all to Hoffman—Olivier’s scheme to recover his ill-gotten diamonds was perfectly safe, though he could not have known it. It was his demand for surety that caused his downfall. By seeking reliability we create hazards worse than the failures we are protecting ourselves from.
By the time Olivier shows up at the bank it must be clear that there are very few people in the Greater New York area who remain ignorant of his plan, yet he proceeds regardless. It is generally a mistake to collect information you are unable or unwilling to act on.13 [13 Dilbert provides a corollary: ‘The best way to compile inaccurate information that no one wants is to make it up.’] Nothing he could have learned from the torture sessions would have prevented Olivier from attempting to collect the diamonds; he simply could not tolerate the uncertainty.
One prerequisite to making such errors of judgment is that we examine our options in isolation. Considering only one thing at a time, we may easily assume that doing nothing is risk-free and condemn ourselves to certain doom in the service of avoiding danger. Equally, we may assume that something—anything—must be done and take action even at the cost of making matters worse.
Just as it would be unwise to make economic decisions without considering opportunity cost, so it is unwise to make decisions based on the absolute risk of a given course of action without reference to the alternatives—and there are always alternatives. As Edward Tufte writes, ‘Numbers become evidence by being in relation to.’14 [14 Edward R. Tufte, Visual Explanations (Graphics Press, 1997), p. 44. Emphasis original.] A single datum is meaningless without a point of comparison.
In the film, Hoffman never finds a satisfactory answer to the question before him—at least, not until he apprehends Sir Larry outside the bank with his diamonds. (‘It isn’t safe.’) But there is, perhaps, one response he might have tried earlier.
