A Spy in the Cockpit

In 1953, a young Australian chemist named David Warren was assigned to a panel investigating why the world’s first jet airliner, the de Havilland Comet, kept falling out of the sky. The investigations had a structural problem: the only witnesses were dead, and the machine’s own wreckage could describe the end of the flight but nothing of what led there. Warren’s proposal was almost offensively simple — put a device aboard that records what the aircraft and its crew actually did, build it to survive the crash, and let the record speak for the dead.

The reception is the part worth remembering. His own laboratory shelved the idea. The military saw little use for it. And the pilots’ unions denounced the device as a spy in the cockpit — an instrument, they said, that would be used against the very people it flew with. Warren built his prototype anyway, in his spare time. It took a British air marshal’s enthusiasm to get it manufactured, and a 1960 crash inquiry in Queensland before Australia — the country that had rejected the idea first — became the first in the world to mandate it.

What aviation had invented, though nobody phrased it this way, was machine testimony: a record designed from the first rivet to be believed by strangers. Consider the design constraints, because every one of them is a distrust made physical. The recorder is independent of the systems it observes. It cannot be erased in flight. It survives fire, impact, and the bottom of the ocean, and announces its own location for thirty days. Its formats are standardized so that any investigating authority on earth can read it. And its custody after an accident passes immediately to parties who do not work for the airline. The result is the rarest artifact in engineering: a machine’s account of events that courts, regulators, insurers, and grieving families on opposite sides of a lawsuit all accept as fact.

The ordinary digital record: written by the machine under investigation, editable by the party with the strongest interest in its contents.

Now look at everything else. The infrastructure that runs the rest of modern life — networks, servers, clouds, vehicles, medical devices, trading systems — also writes down what it does. We call these records logs, and they are testimony’s opposite in every particular. A log is written by the machine whose conduct is in question. It lives on storage controlled by the machine’s operator, who holds write access and, with it, the power of revision. Its timestamps drift against every other machine’s clock. Its format is whatever the vendor chose that year. Attackers delete logs as a first order of business precisely because deletion works. And when an incident matters enough to litigate, the record’s keeper and the record’s subject are, as a rule, the same party — a witness arrangement no court would accept from a human.

The stakes stopped being administrative some time ago. When a vehicle driving itself is involved in a collision, the account of what the machine perceived and decided is produced by, stored with, and interpreted through the manufacturer — the probable defendant. The crash recorders regulators do require capture a few seconds of physics: speed, braking, throttle. They do not capture decisions, and access to the richer record runs through the party being sued. The only witness works for the defense. Insurers, courts, and families are left to negotiate with an account that cannot be independently examined, produced by an interested party, in a format only that party fully understands.

It is tempting to file this under bad faith, but the honest diagnosis is worse: it is a missing layer. Aviation’s recorder works because an entire system was engineered around a single premise — the record must be believable by someone who trusts neither the machine nor its owner. Digital infrastructure was engineered around the opposite premise: the record is for the operator, written by the operator’s machine, kept at the operator’s pleasure. Sixty years of accumulated logging practice is built on the assumption that nobody hostile will ever cross-examine it. Increasingly, everything that matters is cross-examined.

So the question the Comet panel answered for aircraft in 1953 is still open for every other machine that acts in the world: what would it take for a machine’s account of its own conduct to have the standing of testimony — examinable by a party who distrusts its author, decisive in a dispute between adversaries, and worth exactly as much on the day it is challenged as the day it was written?

That is the space we work in. More soon.