The Madness in our Methods: The crash of Germanwings flight 9525 and our broken aeromedical system
On the 24th of March 2015, an Airbus A320 flying for low-cost carrier Germanwings stopped responding to air traffic control, entered a steep but steady descent, and impacted a mountainside in the French Alps, killing all 150 people on board. As investigators hurried to the scene of one of the worst disasters in the history of German aviation, they could not have imagined the horror of what they would learn just hours later, as they sat listening to the cockpit voice recorder for the first time. It all unfolded in the last ten minutes: in a shocking turn of events, the First Officer locked the Captain out of the cockpit, instructed the autopilot to descend to 100 feet, and then watched his plane fly into the ground as the Captain beat on the door with a crowbar and passengers screamed in terror.
The horrific discovery left investigators wondering: how could an airline pilot commit an act of such evil? And could he have been stopped? But eight years after the infamous mass murder-suicide, the industry is still at risk of taking away the wrong lessons. First Officer Andreas Lubitz hid his psychotic depression from his employer until he snapped, but instead of enacting broader exceptions to medical confidentiality, the real solution might be something completely different: to loosen, rather than tighten, the rules surrounding mental fitness to fly. As contradictory as it sounds, a deeper look at the system of aeromedical certification reveals a vindictive process that is so fundamentally broken that it destroys the careers of healthy pilots, engenders a culture of deceit, and — if not radically reformed — risks guaranteeing that the next Andreas Lubitz will also escape detection.
◊◊◊
German flag carrier Lufthansa is known for its large number of wholly owned subsidiaries, of which one of the more popular was Germanwings, a former division of Eurowings which split off in 2002 and was purchased by Lufthansa in 2009. Specializing in low-cost flights between European destinations, Germanwings historically operated a fleet of several dozen Airbus A320 mid-range passenger jets, before being folded back into Eurowings during the Covid-19 pandemic. Like all German airlines, it had a commendable safety record, without suffering a single serious incident or accident — until that bright, sunny day in March 2015, when darkness unexpectedly reared its head.
Germanwings flight 9525 should have been unremarkable. A routine morning shuttle from Barcelona, Spain, to Düsseldorf, Germany, the flight was not expected to encounter any adverse weather, and the 24-year-old Airbus A320, registration D-AIPX, was in good working order with only cosmetic defects recorded in the technical log. The passengers hailed from as many as 18 countries and represented various walks of life: there were two opera singers returning from a performance; families coming home from vacations; businesspeople traveling for work; and a group of 16 students and two teachers from a high school in the German town of Haltern am See, returning together from an exchange program in Spain. In total, 144 passengers boarded the plane, along with six crew, including four flight attendants and the two pilots, 34-year-old Captain Patrick Sondenheimer and 27-year-old First Officer Andreas Lubitz, who had just flown the plane in from Düsseldorf and were now entrusted to fly it back. With about 6,000 flying hours over a 10-year career, Sondenheimer was moderately experienced, while Lubitz was still fairly new — he had been flying for Germanwings since 2014 and had so far accumulated just 630 hours in the air.
At 10:00 Central European Time on March 24th, 2015, Germanwings flight 9525 took off from Barcelona and climbed uneventfully toward its cruising altitude of 38,000 feet, expecting to arrive in Düsseldorf in a little over 90 minutes. Captain Sondenheimer responded normally to radio calls during the climb, and contacted the Marseille area control center in southern France upon reaching their cruising altitude at 10:27. At 10:30, Marseille cleared the flight direct to the IRMAR waypoint, and Sondenheimer read back, “Direct IRMAR, merci, Germanwings one eight Golf.” But the Marseille controllers would never again hear from flight 9525.
Less than one minute later, unnoticed at first, the flight began to descend, losing altitude initially at 5,000, then 3,000 feet per minute — steeper than a normal descent, but shallower than would be expected in an emergency. It took two minutes for the controller to notice, by which time flight 9525 was already approaching 30,000 feet. Surprised that the flight would descend so far without calling him, he keyed his mic and asked Germanwings what altitude they were cleared for. But there was no reply. Beginning to worry now, he asked twice more for the flight to acknowledge, but it did not.
As flight 9525 continued its steady but rapid descent, the controller kept calling, to no avail, watching as the flight’s altitude indication dropped ever lower. At 10:38, with the plane flying dangerously low, French Air Defense tried to contact it on the universal emergency frequency, but it didn’t respond there, either. Fearing the worst, the Air Force scrambled a fighter to intercept the plane — but it was already too late. Just as the order went out at 10:41, flight 9525 disappeared from radar in the Marseille control center, having dropped down between the snowcapped peaks of the French Alps. At that same time, witnesses in the town of Digne-les-Bains caught sight of the Airbus flying low overhead, proceeding directly toward the nearby Massif des Trois-Évêchés, clearly too low to avoid it. Approaching the 9,500-foot (2,900-meter) peak, the plane made no effort to turn away, until at last it disappeared up a remote valley, never to emerge. Seconds later, the Airbus plowed nose-first into a precipitous mountainside at an elevation of 5,000 feet (1500 m), obliterating the aircraft and instantly killing all 150 people on board. As shattered debris tumbled across the loose, gray scree of a rain-scoured ravine, a distant boom issued forth from the mountains, which was followed once more by silence.
Minutes later, at 10:48, the scrambled fighter jet took off and hurried to the area where flight 9525 was last seen, already fearing that the plane had crashed in the mountains. The crash site was found surprisingly quickly: at 11:01, shortly after reaching the area, the pilot spotted smoldering wreckage in the Ravine du Rosé, near the base of the Massif des Trois-Évêchés. Rescue helicopters immediately launched to search for survivors, but when they got there, the rescuers were left bereft of hope: what was once an Airbus A320 lay shattered into countless fragments, the largest of which could not have been more than a couple meters across. Rappelling down to the scene, they were confronted with human carnage as well. Pieces of bodies — torsos, limbs, hands and feet — lay strewn across the mountainside. Within minutes, they were forced to report the grim news that none of the 150 passengers and crew could possibly have survived.
◊◊◊
The crash upended the lives of hundreds, shocked Lufthansa employees, and forever scarred the town of Haltern am See, which lost 16 teenagers in a single blow. But at first, the reasons for this devastation were unclear. Publicly available data clearly traced the flight’s long, steady descent, proving that the plane was under control and appeared to be operating normally at all times. The plane never exceeded its normal flight envelope, no distress calls were made, and automated reporting systems never flagged any technical faults to the company. Speculation ran wild, with proposed scenarios including a computer malfunction or pilot incapacitation due to lack of oxygen. But if a computer error somehow locked the plane into a descent — a far-fetched idea to begin with — then why didn’t the pilots transmit a distress call during the nearly nine minutes before it struck the ground? Hypoxia was considered a more likely scenario, but there was still much that did not add up.
For French investigators with the Bureau of Inquiry and Analysis, or BEA, dispatched to handle the case under international law, the only answers would come from the plane’s two black boxes. In a stroke of luck, a rescuer stumbled across the cockpit voice recorder, or CVR, within hours of the crash, and it was immediately rushed to the BEA headquarters in Paris. Finding that the memory within was not damaged, investigators were able to download the recording and listen to its contents only about 24 hours after the accident, an unusually quick turnaround. Their curiosity must have been indescribable: in that recording, they presumed, would be the outline of some bizarre scenario which led to the otherwise inexplicable crash. If only they had known!
To this day, no definitive transcript of the CVR’s contents has been published, but a basic outline can be gleaned from official reports and the accounts of journalists who heard the tapes. According to these sources, the conversations between the pilots were normal at first, and confined to operational matters. About 12 minutes after takeoff, a flight attendant entered the cockpit, and the three crewmembers discussed the events on the ground in Barcelona, including their 26-minute delay. At some point Captain Sondenheimer mentioned that he forgot to use the restroom during the stopover and would need to take a break to do so in flight. First Officer Lubitz allegedly told him that he could “go any time,” but Sondenheimer prudently decided to wait until the plane was established in cruise.
After reaching 38,000 feet, the autopilot leveled the plane, and Sondenheimer proposed that Lubitz prepare for the descent briefing, seeing as their cruise phase would be short. According to various sources, Lubitz allegedly gave a cryptic reply: “Hopefully,” he said. “We’ll see.”
At that moment, Captain Sondenheimer made his final call to Marseille, announced that he was going to use the restroom, and handed over the radios to First Officer Lubitz. The CVR captured the sound of his seat sliding back, the sound of the cockpit door opening, and finally a click as it swung closed again, locking automatically.
The Flight Data Recorder, or FDR, would later pin down the details of what happened next: 19 seconds after Sondenheimer left the cockpit, someone used the altitude selector knob to enter a target altitude of 100 feet into the autopilot control panel — the lowest altitude a pilot can select. It could only have been First Officer Lubitz, who was alone in the cockpit. In response, the autopilot’s vertical mode changed to Open Descent, in which the autopilot adjusts pitch attitude to maintain a target airspeed while the autothrottle holds engine power at idle. The plane began to descend, rapidly at first, before settling on a brisk but safe value of 3,000 feet per minute. In the background, only minor unidentifiable sounds could be heard — Lubitz remained silent, except for the sound of steady, unhurried breathing, picked up by the microphone on his headset.
Any possibility that Lubitz was asleep or unconscious was quickly ruled out, because 43 seconds into the descent, the CVR captured the sound of him adjusting his chair, and after a further 100 seconds, he began messing with the target airspeed on the autopilot control panel, increasing it from 273 knots to 308 knots. Seconds later, he reduced it back to 288 knots, then moved it up again to 302 knots. At that moment, the CVR captured the sound of the controller’s first radio call, asking about the altitude, but Lubitz did not audibly react. Two more calls followed, coming through loud and clear, but Lubitz ignored those, too. Instead, he increased the selected airspeed again, to 323 knots.
At 10:34 and 31 seconds, the sound of a buzzer was heard, indicating that someone was trying to enter the cockpit. Normally, a returning crewmember will type an entry code into a keypad on the door, which triggers a buzzer. The pilot can then glance at a live video feed of the entry area in order to determine whether the person should be permitted to enter. If so, the pilot should move the door lock switch from “normal” to “unlock,” allowing the door to be opened from the outside. But this time, that didn’t happen. “It’s me!” Sondenheimer is reported to have said, but Lubitz didn’t let him in. In fact, the buzzer never sounded again, which suggests that not only did Lubitz not move the switch to the “unlock” position, but that he actually moved it to the “lock” position instead, which is used to deny unauthorized access. When the switch is selected to “lock,” all use of the keypad is disabled for five minutes. On the other hand, had Lubitz been unconscious or otherwise unable to move the door lock switch, Sondenheimer could have entered an emergency override code known to all pilots, causing the door to unlock by itself after 15 seconds. This is the first backup method any pilot would use if they are unable to access the cockpit — so the fact that Sondenheimer never entered the emergency code could only mean that they keypad had been disabled by a conscious input from Lubitz. Investigators were left speechless: by all indications, the First Officer had deliberately locked the Captain out of the cockpit and was flying the plane into the ground.
Over the next minute, the controller tried several more times to call flight 9525, his transmissions clearly recorded on the CVR, but Lubitz did not reply. Descending through 25,000 feet, he used the speed knob to enter a target airspeed of 350 knots, the highest value a pilot could select. Dutifully, the autopilot pitched the nose down, and the plane accelerated still further. Several chimes were heard as someone attempted to call the cockpit via the interphone, but Lubitz didn’t answer. Sondenheimer started knocking on the cockpit door — once, twice, three times, six times. In the background, the CVR picked up a muffled shout: “For the love of God, open this door!”
From there, anger and confusion turned to desperation. It was becoming obvious that something was terribly wrong, and Sondenheimer must have decided it was time for drastic action, as he allegedly told a flight attendant to bring him a crowbar. Although some accounts suggest he used an axe, a crowbar — designed specifically to open jammed doors in an emergency — would have been more effective than a crash axe against the bulletproof cockpit door. Soon, the CVR captured the sound of heavy blows against the door as Sondenheimer frantically tried to smash his way in, but time was running out. Mountains rose up beneath them, and passengers began to panic. Propelled by their screams of terror, Sondenheimer beat, pried, and hammered as hard as he could, but still the reinforced door refused to give way. “Open the goddamn door!” he roared, as mountains streaked by outside the windows, the cacophony in the cabin juxtaposed against Lubitz’s malevolent silence. What was Sondenheimer feeling in those horrible moments, listening to the screams of the passengers whose safety had been entrusted to him, knowing that he was fighting a losing battle to save 150 lives? The door was too strong, but still he fought — and still Lubitz sat there, his breath calm, ignoring the frantic screaming and banging, disregarding the ground proximity warning system as it blared, “TERRAIN! TERRAIN! PULL UP!” And did he watch as the mountainside drew nearer and nearer? Did he regret, in those moments, the path he had chosen? We will never know, because moments later the plane shattered against the mountain, taking with it the lives of so many.
◊◊◊
Stunned by what they had heard on the CVR, investigators could only conclude that First Officer Andreas Lubitz had deliberately crashed the plane in an appalling act of mass murder-suicide. Other explanations were no doubt considered, but none fit the evidence. There were no malfunctions recorded on the FDR. Lubitz must have been alive and acting consciously throughout the descent, but there was no legitimate reason for him to take the action he did — no reason to lock Sondenheimer out, to select an altitude of 100 feet, to let the autopilot fly the plane into the ground. If he didn’t want the plane to crash, he would have tried to stop it, but he didn’t even try, successfully or otherwise. The only answer was that he wanted to crash the plane, and that he succeeded.
Based on this evidence, just two days after the accident the BEA announced to the world that the crash of flight 9525 was a purposeful act by the First Officer. The sensational press conference upended the public conversation around the crash and deeply unsettled the airline industry. It was not the first time that an airline pilot had committed suicide by deliberately crashing a passenger plane — in fact, it had happened at least five times before — but the Germanwings tragedy brought the phenomenon into the public eye in a way which the others had not. Many were left with feelings of helpless anger. Expressing his company’s horror and revulsion, Lufthansa CEO Carsten Spohr told the press, “If a person takes 149 other people to their deaths with him, there is another word than suicide.”
From that point, the investigation into the crash, conducted in parallel by safety experts and judicial authorities, began to focus on what led Andreas Lubitz to commit such an appalling act, and how he was able to get away with it. And to tell that story, the investigators needed to go back to the quiet, upscale town of Montabaur in the German Rhineland, where Lubitz grew up and first learned to love flying.
The firstborn son of a banker and a piano teacher, Andreas Günter Lubitz was born on December 18th, 1987 in the Bavarian town of Neuberg an der Donau, although his family moved across the country to Montabaur while he was still in school. He was by most accounts a normal child, and later, a normal adult. He also expressed a desire to fly from an early age, and the passion never left him. His first taste of flying came at a local gliding club at the age of 14, and he remained a regular club attendee well into adulthood. In fact, as soon as he finished high school in 2007, he applied to Lufthansa’s in-house pilot training program, where his passion and dedication served him well: out of 6,530 applicants, he was one of just 384 selected to begin commercial pilot training.
Everything seemed to be on track, until the summer of 2008, when Lubitz suddenly fell into a deep, crushing depression. On November 5th, just two months after he started his initial training, he withdrew, citing medical reasons. In the depths of despair, he experienced suicidal ideation, made a pact with his therapist not to commit suicide, and was briefly hospitalized. In an effort to get his life back on track, he began taking anti-depressants, and after some time he started to show improvement — but his own mental health was only half the battle.
In April 2009, Lubitz applied for the first annual renewal of his medical certification, which is required in order to fly an airplane. But the doctors at Lufthansa’s aeromedical center denied his application on account of his ongoing major depression and medication thereof, which rendered him unfit to fly under European and German law. At that time, EU rules prohibited anyone taking any psychoactive anti-depressant from holding a medical certificate, so the only solution was to ease off the medication. With help from his psychiatrist, Lubitz was eventually able to end treatment, and in July 2009 he was declared fully recovered. After applying again, the Lufthansa aeromedical center decided to issue him a new medical certificate, but with strings attached: if he ever again suffered from depression, the document said, the certificate would immediately become invalid. It’s not clear from the official report whether the document described this invalidation as permanent, but that was certainly the implication.
With the limitation on his medical hanging in the background, Lubitz resumed initial training with Lufthansa, and eventually graduated to the next phase: flight training in real light aircraft at a facility in the US state of Arizona. In order to be accepted, he needed to submit his medical information to the Federal Aviation Administration and receive a US medical. Allegedly, he failed to disclose his history of depression on the form, but was somehow caught in the lie; the official report, however, makes no mention of any explicit rulebreaking. In any case, what is known is that the FAA eventually received Lubitz’s medical history and issued him a US medical certificate with the same limitations as the German one, and he went on to pass flight training in Arizona in 2011. For two years after that, he worked as a flight attendant for Lufthansa, until a spot opened up and he was assigned to the Germanwings division. He subsequently completed an Airbus A320 type rating course, passed his proficiency check, and began flying passengers as an A320 First Officer for Germanwings in the fall of 2014.
Throughout the intervening years, Lubitz renewed his medical every 12 months without incident. Due to the limitation on his certificate, the aeromedical examiners were required to contact the licensing authority, which in this case was the LBA, the German equivalent of the FAA, in order to learn about his medical history. But at no point did his depression recur, and his medical was renewed without major difficulties.
However, all that changed in December 2014, when Lubitz’s depression suddenly returned. This time, the symptoms were different, and more sinister. He complained that he was losing his vision, but multiple physicians could find nothing wrong with his eyesight. Doctors proposed that he might be suffering from a psychosomatic disorder, in which psychological factors give rise to seemingly physical symptoms, but Lubitz was allegedly resistant to the idea, possibly because the doctors wanted him to take psychoactive medications that he feared would invalidate his medical certificate.
Over the first few months of 2015, with his despair deepening, he saw at least four different doctors and several psychiatrists, who variously diagnosed him with depression, anxiety, and other illnesses. In February, a physician issued him 8 days of sick leave, but he kept working anyway. He was prescribed Zopiclone and Mirtazapine neither of which was approved for pilots. He took several sick days, but for the most part he ignored his doctors’ requests to stop working. Under medical confidentiality laws, the only way for Germanwings to find out that his doctors were issuing sick leave was for Lubitz to forward the notices to his employer, but he did not — presumably, he feared that if he did, they would find out that he was ill, his medical would be revoked, and he would lose his career. Instead, he took the sick leave notes, ripped them up, and threw them in the trash.
Mentally and physically unwell and living in constant fear, Lubitz’s mind eventually veered into suicidal ideation and paranoia. Lying restless at night, he was unable to catch more than a few scattered snatches of sleep. In early March, he started searching the internet for ways to commit suicide. His physician diagnosed him with possible psychosis, a condition characterized by delusions and difficulty determining what is real, prompting a referral to a psychiatric hospital, along with 19 days of sick leave. Days later, his psychiatrist prescribed him two more medications, Escitalopram and Zolpidem, but still, he kept flying. On the job, he kept up a remarkable impression of normalcy, but on the inside, he was falling apart, growing more dangerous with every passing day.
According to documents collected by prosecutors and seen by GQ writer Joshua Hammer, Lubitz apparently tried to work with his psychiatrist, keeping a journal of positive thoughts, among other activities, which suggested that he wanted to recover. But his mind was descending into an impenetrable darkness. Sometime in mid-March, he began searching the internet for information about cockpit door security on the Airbus A320. Then on Sunday, March 22nd, he allegedly wrote several notes on a scrap paper, including the letters “BCN” for Barcelona, the words “Decision Sunday,” and a series of bullet points, including “[find the] inner will to work and continue to live,” “[deal with] stress and sleeplessness,” and finally, “let myself go.” According to GQ, police later found the piece of paper in the trash in his apartment — the closest he ever came to leaving a suicide note.
At this point, the stage was set — all that remained was the final decision. On the flight into Barcelona from Düsseldorf on the morning of the crash, it almost came. Near the top of descent, Captain Sondenheimer left the cockpit, and while Lubitz was alone, a controller cleared them to descend from 37,000 to 35,000 feet. But instead of entering 35,000 feet into the autopilot, Lubitz entered 100 feet, and left it there for several seconds. Minutes later, he was cleared down to 21,000 feet, and again he selected an altitude of 100 feet. This time the selected altitude remained there for two minutes, until Lubitz, perhaps hearing the Captain’s approaching footsteps, switched it to a more reasonable value, two seconds before Sondenheimer buzzed back into the cockpit. Was it a dry run, or a balked attempt? Had Lubitz made the decision already and was testing his methods, or was he testing the concept itself, unsure whether he wanted to go all the way? We will never know, and in the end, it probably doesn’t matter.
◊◊◊
One of the most disturbing aspects of Lubitz’s story is that most of those who knew him thought he was a normal person. He loved his job, he spent time with friends, he had hobbies, he had a girlfriend. Few people in his life saw anything untoward about his behavior in the months before the crash, even though medical records showed he was falling down a spiral of despair and delusion. Nor did he display any signs that he might be capable of mass murder. In fact, some of those close to him still refuse to believe it — his parents, for instance, have angered victims’ families on several occasions by very publicly protesting for their son’s innocence. But even an aviation expert they hired to “poke holes” in the official report didn’t seem to believe their assertions, even though he dutifully did what they asked.
In the end, the parents can be forgiven — even in the face of overwhelming evidence, it can be all but impossible to imagine that someone so close was capable of committing such an atrocity. But Lubitz himself can receive no such mercy. His depression was not an excuse; after all, millions of people suffer from depression, including thousands of airline pilots, and hardly any of them commit mass-murder suicide. The level of delusion required to completely dismiss the lives of 149 other people in the blind pursuit of self-annihilation is difficult to comprehend and impossible to study. Many suicidal people are deeply empathetic, even refusing to take their own lives for fear of upsetting loved ones. How Lubitz, in the grip of psychosis, drifted to the opposite extreme cannot be known, although psychologists have proposed various explanations. Perhaps he was simply a murderous psychopath all along, desiring to live in infamy. Perhaps he performatively imitated empathy in times of normalcy, but in a moment of great stress, the lives of others simply did not occur to him. Or perhaps the decision to crash the plane was a form of intrusive thought, which in his psychosis he failed to counter, and having taken the decision, fear of punishment should he reverse course overcame any dying shreds of conscience.
Finally, still others object to asking the question at all.
◊◊◊
From an aviation safety perspective, Lubitz’s exact thought process matters a great deal less than the question of whether he could have been stopped. In the end, a French judge determined that under existing laws, the answer was no: after all, he did not divulge anything about his deteriorating mental state to his coworkers, family, or friends, and especially not to his employer. His medical would have been up for renewal in July, requiring an aeromedical examination at which his condition may have been discovered, but he carried out his suicidal mission before this could occur.
The only people who knew about the depths of Lubitz’s illness were the physicians and psychiatrists with whom he spoke in the months before the tragedy. In the BEA’s opinion, these professionals likely knew that he was an airline pilot, but they might not have appreciated the degree to which he had become a risk to others. In fact, they might have believed that Lubitz was complying with their requests that he take time off from work, but even if they knew he was flying, their options would have been limited. In Germany, as in most parts of the world, it’s a criminal offense to divulge a patient’s private medical information without their consent. An exception existed for cases in which a patient presents a clear and imminent danger to themselves or others, but there were no clear guidelines doctors could use to determine when this exception applied, and they would bear the burden of proof in the aftermath. In the end, the doctors treating Lubitz probably didn’t even consider the possibility of reporting him to Lufthansa, because that simply wasn’t done — not in Germany, and realistically, not in most other Western countries either.
In the aftermath of the crash, experts proposed various measures intended to reduce the risk of pilot suicide, including a rule that there must be two crewmembers in the cockpit at all times. Typically, this means that a flight attendant must wait in the cockpit whenever one pilot leaves to use the bathroom, a policy which has existed in the United States for many years, but was not and still is not widespread in the rest of the world. Shortly after the crash of flight 9525, the European Aviation Safety Agency began encouraging the policy in Europe in order to gather data about its effectiveness, but after the trial period was over, the results were not encouraging. In the opinion of EASA and the airlines themselves, the policy did not eliminate the risk of pilot suicide: after all, several high-profile cases of in-flight suicide have occurred with more than one pilot in the cockpit, and the presence of a flight attendant is even less likely to prove decisive. Furthermore, they argued, the policy leaves the cockpit door open for longer periods of time, increasing the risk of hijackings, which historically have been much more common than pilot suicides anyway.
Another unresolved debate over safety measures concerns medical confidentiality. Arguments have been advanced to the effect that the strict confidentiality of medical information should be loosened for pilots, a proposal which can seem logical at first glance, especially to people outside the aviation and medical industries. In its final report, the BEA even recommended that the possibility be explored. But for those who deal with medical certification in their day-to-day lives — that is to say, pilots — this proposal is alarming not just because of the principle of reduced privacy, but because from the inside, its potentially damaging safety effects are self-evident. Those unfamiliar with the process might not understand why, so it’s worth taking some time to explain, not only because privacy is important, but because the reasons for the policy’s ineffectiveness are closely tied to some of the possible untold circumstances behind the actions of Andreas Lubitz. In fact, both of these avenues of inquiry lead to one critical conclusion: that the entire process of aeromedical certification is fundamentally broken.
◊◊◊
Aeromedical certification exists because there are numerous medical conditions whose characteristics or treatments carry unacceptable risk of sudden incapacitation. In this case the word “incapacitation” could mean anything from inability to focus to loss of consciousness to suicidal acts. It goes without saying that individuals at high risk of such incapacitation should not be allowed in the cockpit. However, quantifying this risk is difficult. An international standard, known as the 1% rule, holds that a medical condition is acceptable for a pilot if the risk of incapacitation during a critical phase of flight is less than 1% in any given year. But with most medical conditions, there is insufficient data to say for sure whether a pilot’s particular case complies with the 1% rule or not, and so most certificating entities err on the side of caution and blanket-ban conditions with any perceived risk of incapacitation at all. In many countries, this includes two of the most common psychological conditions: anxiety and depression.
Some would suggest that the story of Andreas Lubitz clearly justifies this position. A lawsuit filed on behalf of the victims argued that Lubitz’s flight school should never have accepted him because of his history of depression and his initial failure to disclose that history to the FAA. If he had simply been denied on account of that history, the argument goes, the crash would never have happened. While this is, strictly speaking, true, it’s also incredibly dangerous, for reasons which I’m about to explain.
Many pilots reading this are probably already aware that Lubitz’s “failure to disclose” would not necessarily have seemed important, because the dark truth about the aeromedical process is that everyone lies. In the majority of cases, FAA-appointed Aeromedical Examiners, or AMEs, have no way of verifying whether an applicant is telling the truth when they say they have no history of disqualifying health issues. On the other hand, voluntarily disclosing potentially damaging medical history is a surefire way for a pilot applicant to waste time, waste money, and maybe even torpedo their career. Although the US theoretically allows medical certification of pilots with histories of certain psychological conditions, in practice, qualifying for such an exception requires numerous expensive, burdensome, and often unnecessary tests, checks, procedures, statements, and other red tape. This is true regardless of the seriousness of the diagnosis. If you had a minor depressive episode in high school, if you were erroneously diagnosed with ADHD as a child, if you went to rehab 15 years ago, or even if you went through a hard breakup that required seeing a therapist, disclosing as much to an AME can make your certification process considerably more difficult, and sometimes even impossible.
Pilot forums are full of such stories. You could be made to attend Alcoholics Anonymous meetings despite not drinking alcohol. You can be forced to spend thousands to prove you aren’t suicidal because you take medication for general anxiety. You can be denied a medical because your therapists had to submit a diagnosis, even if untrue, in order for insurance to cover basic therapy. If you admit to snoring, prepare to spend thousands on tests to prove you don’t have sleep apnea. The list goes on and on. The obvious lesson, of course, is that all of this drama can be avoided simply by failing to disclose to any of this information to the FAA in the first place.
These examples illustrate how minor events from a pilot’s past can turn the aeromedical process into a major nightmare. Some pilots who face difficulties with the process have genuinely problematic conditions, but many more are completely healthy, but nevertheless have to spend thousands of dollars and years of their lives in order to prove it. The result of this system is a culture of deceit, as instructors and fellow pilots — always off the record, of course — advise up-and-coming young aviators to lie to the FAA when applying for their medical. In fact, a study by the University of North Dakota found that 56% of all pilots in the United States have knowingly failed to disclose portions of their medical history at some point in their careers.
Part of the problem is that the criteria for determining who is a potential risk are out of touch with the realities of modern medicine. Several decades ago, a psychological diagnosis was rare and could usually be considered a big deal. Today, that’s no longer the case —for instance, among younger generations, who tend to be more open about their mental health, it seems like almost everyone freely admits that they’ve suffered from depression, or anxiety, or ADHD, or autism, or any of the numerous issues that can complicate aeromedical certification. (For illustrative purposes, I consider myself a Zillennial, and I can say with confidence that about 90% of my social circle would have difficulty passing a medical if they were honest.) Many of these conditions are no more common now than they were 40 years ago, but the rate of diagnosis has increased, especially for low-level cases that realistically pose no danger. And yet medical certification rules continue to treat anyone ever diagnosed with anxiety as a potential mass murderer.
So what does this all have to do with Germanwings flight 9525, you might ask? After all, Andreas Lubitz literally was a mass murderer. But I’m about to propose a radical hypothesis: that his heinous crime might have been avoided if the aeromedical process had treated him like a normal person.
To understand why, we should go back to the beginning of Lubitz’s training, when he first suffered from depression. After a few months he recovered, but now he had a “history of depression” and everything that entailed. Although he eventually managed to get a medical certificate, it came with a clause that virtually guaranteed his career would end if he ever became depressed again. Imagine that you were in his position: if you felt your depression returning, would you admit it to an aeromedical examiner? I think most people probably wouldn’t. After all, his flight training had cost him 60,000 euros and he was still repaying the loan. Germanwings offered insurance that would cover most of the loan if he became unfit to fly, but what about after that? He had spent years of his life working to become a pilot, and flying had been his passion since childhood. If he lost his medical, he would find himself with no money, no career, and no future. Furthermore, Germanwings’ loss-of-license insurance only covered loss of future income for pilots who were at least 35 years old or had worked for the company for at least 10 years, while Lubitz was only 27 and had been flying for Germanwings for only five months. Lubitz considered purchasing a third party insurance policy that would cover future loss of income, but according to emails left on his computer, he couldn’t get insurance companies to cover him because — you guessed it — the limitation on his medical certificate made him too high-risk.
As a result of these factors, Lubitz probably felt compelled to hide his condition at any cost. For years, he lived with the limitation hanging over his head like a proverbial Sword of Damocles, knowing that his career could end at any moment for reasons beyond his control. Indeed, the very stress of his situation might have made his depression worse, creating a destructive feedback loop that led him to the very gates of madness. But what if it didn’t have to be that way? What if Lubitz had believed it was possible to temporarily ground himself, and then regain his medical later, if his psychiatrist testified that he had recovered? After all, he had done exactly that during training in 2008. Regardless of whether he would actually have been re-certified, what if all he needed to get himself out of the cockpit was a little bit of hope that he could one day come back? We can’t know for sure, because this is a hypothetical, and it’s always possible he was more delusional than is publicly known. But still, we can’t help but ask.
The other side of the argument is that Lubitz should never have been allowed to fly at all, in which case hope wouldn’t have mattered. But then you’re back to the original problem. At the time he first received his FAA medical, Lubitz appeared to have recovered from his severe depression, a condition which afflicts one in every six men and is not necessarily recurrent. He may have had other issues which he was hiding — the fact that he was capable of mass murder means he almost certainly did — but from a systemic point of view, the problems on his official record are the ones that matter. And the problem is that if we keep denying everyone with that medical profile, most of whom are probably fit to fly, even if it turned out Lubitz wasn’t, then the culture of deceit will remain. Applicants will continue to lie about their medical problems — and not only innocuous problems, but real ones too, like Lubitz’s eventual psychosis, which was disqualifying by any standard. And as long as the system incentivizes hiding these problems, it will remain impossible to detect those rare individuals, like Lubitz, who are actually dangerous.
With all this information in mind, it should be clear why rolling back medical confidentiality rules won’t solve the problem, and might make it worse. Sure, at first, open access to medical records might make it impossible to hide a diagnosis. But before long, pilots will learn that they can avoid this trap by declining to seek treatment at all. At that point, we’ll return to the days when everyone bottled up their problems and self-medicated by abusing alcohol, like our grandfathers did. As if that would somehow be better!
The only answer, in my view, is to streamline the process, loosen restrictions on common psychological conditions like anxiety and depression, and expand the use of temporary groundings at the expense of permanent ones. Permanent denials should still be issued, of course, for permanent conditions. For instance, we can probably all agree that you shouldn’t be a commercial pilot if you have recurring suicidal thoughts, or if you have diabetes with high risk of hypoglycemia, or if you have no arms. But for conditions that are temporary, or are easily treatable with approved forms of medication, looser rules will encourage honesty, especially among pilots who develop these conditions after their careers have already begun. Mitigations can be put in place to compensate, such as requirements for pilots with certain conditions to fly as part of a multi-person crew. However, “Sword of Damocles” clauses like the one applied to Lubitz should be used sparingly, if at all. And before anyone complains that looser requirements and simplified approval procedures will result in countless unhealthy pilots taking to the skies, I would like to point out that that’s already the case right now, and we just pretend that it isn’t. Everyone is lying, and the only choice is to lie, because if nobody lied, we wouldn’t have any pilots. The only conclusion is that the system we have now does not and cannot ensure that unfit pilots are kept out of the cockpit, at which point we have the right to ask what aeromedical certification is even for.
◊◊◊
Many of my articles end with a reassuring roundup of safety reforms or planned improvements, but unfortunately, this is not one of them. Although pilot unions and independent non-profits are increasingly pushing for common-sense aeromedical reform, with some limited success, to my knowledge the FAA and its global equivalents have not yet acknowledged that major changes are needed, let alone established any kind of timeline for implementing them. So instead of summing up the past, I’ve decided to look to the future by sounding the alarm about a major issue which almost every pilot understands, but is virtually unknown to the general public. Increasing awareness is the only way to pressure governments to reform the system — and make no mistake, the consequences of failing to fix the problem are potentially disastrous. Pilot suicide is one of the few remaining causes of catastrophic crashes in developed countries, and there’s no evidence that it’s going anywhere any time soon. In fact, the 2022 crash of China Eastern Airlines flight 5735, which is the most recent major loss of a passenger jet at the time of this writing, may have been another case of pilot suicide, as leaks from the investigation suggest that deliberate action is currently the leading theory. As matters stand, another crash along the same lines is probably a matter of when and where, not if.
In the grand scheme of things, pilot suicide remains rare, but means exist to make it much rarer, and if the aviation industry truly cares about safety, the topic — as touchy as it is — must not be avoided. We owe it to those who died on flight 9525, trapped aboard an airliner as their own pilot drove it unceasingly downward, possessed by demons known only to him. We owe it to Captain Patrick Sondenheimer, who died a hero, even if he could not possibly have saved the plane. And we owe it to future pilots, who should have the right to care for themselves without fear of punishment, as well as their future passengers, who would rest easier knowing that something has been done. We owe this because the Germanwings tragedy was not only a senseless act of murder, but the product of a senseless system, one which must be reformed before the next Andreas Lubitz, succumbing to the siren song of oblivion, steps into a cockpit for the last time.
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 240 similar articles
_______________________________________________________________
Note: this accident was previously featured in episode 46 of the plane crash series on July 21st, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
