Weak Signals, Hard Decisions: What the Columbia Mishap Teaches the Sea Services About Risk

The Navy and Marine Corps do not lack risk management (RM) processes. Risk, issue and opportunity management in acquisition programs and operational risk management in fleet settings have been around for decades (DoD RIO Guide, 2023; OPNAVINST 3500.39, 2018; and MCO 3500.27C, 2014). These procedures were crafted to identify, assess and develop mitigations for risks/hazards. While these standardized processes organize risk data, they do not inform leaders how uncertainty should be interpreted nor substantiate the validity of assumptions and knowledge needed to make decisions. Ultimately, the objective of RM is to help leaders decide what to do when the conditions and consequences of a risk are consequential. RM might therefore be more aptly summarized as the execution of a commander’s judgment.

The Space Shuttle Columbia mishap provides a compelling example of how risk can be misinterpreted and lead to fatal results. Columbia and her crew of seven were lost during reentry from orbit over Texas on February 1, 2003. Sixteen days earlier and roughly 82 seconds after liftoff, a piece of insulating foam from the external tank’s left bipod shed from its ramp, then struck and breached the orbiter’s left wing leading edge. The Columbia Accident Investigation Board (CAIB) concluded that this foam event was the root cause of the loss of the orbiter, but other factors, including organizational culture, inadequate communication, flawed decision making, and poorly defined risk acceptance, all contributed to the mishap (CAIB, 2003).

The key takeaway from this investigation was not human spaceflight is uniquely dangerous—the Navy and Marine Corps operate in hostile environments on and under the sea, on land and in the air that are just as unforgiving as human spaceflight. It is that complex organizations, even competent leaders can become vulnerable to risks when uncertainty is misunderstood, dissent is muted, and decision-makers do not weigh the consequences of what they do not know. Naval officers should therefore consider the Columbia mishap lessons not only as an engineering and organizational post-mortem, but as a leadership warning that uncertainty may be significantly underestimated, hard questions must be encouraged, dissenting opinions often carry value, and a residual risk acceptance decision remains a command decision.

NORMALIZATION OF DEVIANCE

The original space shuttle design requirements assumed that the orbiter would fly in a debris free environment. Nonetheless, debris strikes from foam loss, ice shedding from the launch platform and micro-meteoroid debris effects became routine over time. This familiarity, shared among key leaders and team members, bred a reinterpretation of the risk, which was then normalized over time. In short, what should have been treated as a violation of design requirements became an accepted maintenance turnaround issue which required the orbiter to undergo on average 2,000 touch labor hours to replace in-flight damaged tiles after each mission (Jenkins, 2026). NASA then began to classify tile damage and other repeated anomalies as “in family” simply because previous missions had survived them. Sociologist Diane Vaughn contributed to the CAIB’s organizational cause analysis. She was also author of The Challenger Launch Decision. In that work she observed in that the incremental sequence of decisions to operate with a known anomaly established a precedent; repeated successful outcomes then created both an empirical basis and a cultural belief that the risk was acceptable, even if the underlying hazard was poorly understood She coined the phrase normalization of deviance to describe this behavior (Vaughn, 1996).

In everyday flight operations in our naval service, aviators routinely sign for an aircraft with a maintenance action form that reads “Could not duplicate on deck.” On subsequent flights, both aircrew and maintenance personnel begin to assume that the recurring gripe is inconsequential because it has not produced a Class A mishap to date. Similarly, a surface warfare commanding officer skipper may deploy with one or more degraded systems—all too often due to home cycle operational tempo or pre-deployment certification demands–with the belief that the workarounds have always been found or a “we can fix that at sea” attitude. Ditto the ground unit commander that treats deferred maintenance, manning shortfalls, or a whole host of other off nominal issues as background noise. All are guilty of complacence in the face of what are clearly leading risk indicators.

ADMIRAL GEHMAN’S WARNINGS

In December 2005, ADM Hal Gehman USN (Ret.), who chaired the CAIB and also co-chaired the DoD review of the attack on the USS Cole in Yemen, lectured Midshipmen enrolled in NE203, the core ethics course at the Naval Academy, on similar challenges for organizations using lessons learned from the USS Cole and Columbia tragedies. He offered a blunt warning: large organizations behave like organic beings whose first instinct, when threatened, is self-preservation. This response need not be considered malicious, as Gehman emphasized that NASA had many good people trying to do the right thing. Drawing these points together, he argued that individuals may nonetheless defend their organization and protect its established practices, even when faced with uncomfortable evidence by responding to threats through trivialization, avoidance of direct engagement of the issues, and relegation of their further consideration to studies, meetings, and reviews until the central issue is obscured (Gehman, 2005).

DISSENT IS NOT DISLOYALTY

Unity of command, loyalty, discipline and decisiveness are long-held military cultural values. But in high-risk, high operational tempo environments, those virtues can be misapplied. Loyalty to the commanding officer does not demand silence. Dissenting opinions existed during the Columbia mission. Engineers who observed the ascent video of the debris strike, which made its rounds through the space shuttle organization via e-mail, desperately wanted on-orbit imagery from national assets to confirm the extent and location of the damage. But the organization stifled those dissenting concerns.

Risk is not always annunciated by a master caution light or a near miss. Often it shows up as the same gripe, the same workaround, or the same junior officer’s voice that gets waved off by a department head. A commander should ask a harder question: what decision alternatives is this situation forcing me to consider? Columbia’s foam strike should have forced the STS-107 mission management team to make a clear choice: continue the science mission as planned or treat the strike as a safety of flight issue and seek better evidence through testing, analysis and consultation with subject matter experts. NASA managers did not reach the wrong conclusion, but an incomplete one by treating the decision environment as closed before obtaining on-orbit imagery, validating their debris impact model, or conducting a spacewalk to visually inspect the damage.

Commanders should make dissent normal before a crisis arrives. Ask junior officers what is being missed. Invite maintainers and operators to challenge assumptions, particularly if they change over time. Require safety, maintenance and supply officers to speak independently. Distinguish between debate before the decision and unity after it. The officer raising dissent has obligations as well. Gehman advised future officers to become “bureaucratic guerilla fighters”— professionals who know how to get to the right issue, to the right level, by the right path (Gehman, 2005). That means grounding objections in mission, standards and evidence, not simply grumbling in the back of the ready room or officer’s mess. The goal of dissent is to improve the commander’s decision.

RISK ACCEPTANCE AND ETHICAL BOUNDARIES

One of NASA’s organizational failures involved unclear authority. Who owned the debris impact risk? Who had the authority to request on-orbit imagery? Who was responsible for accepting the residual risk? These are not bureaucratic details. They are the structure of responsibility. By closing the debris impact issue without resolving the likelihood and consequence of the debris impact event, NASA managers crossed an ethical boundary.

Too often, risk is accepted by drift. Risk issues pass through discussions at all officer meetings; it is dispersed in PowerPoint slides, e-mail threads and undocumented passageway discussions until continuation becomes the default even though no authorized leader explicitly accepted the residual risk. Before operations, naval officers should ask: who can accept this risk? What mitigation plans are in place for scenarios A, B and C? What trigger event, additional information or assumption changes should cause reconsideration?

Every commander has a different risk appetite, which may vary widely or be subtly different due to experience. While risk tolerance can vary by commander and mission, ethical boundaries should not drift with schedule pressure, organizational convenience, or personal risk appetite. That is why risk acceptance thresholds should be discussed before the organization is under pressure.

TRADE SPACES AND MARGINS

ADM Gehman’s espoused a trade-space framework illustrating how organizations manage or conceal uncertainty. Developmental programs are bounded by cost, schedule (programmatic), technical performance and safety trade spaces. Under this rubric, if funding and schedule are fixed, margin gets consumed in the other trade spaces (Gehman, 2005). In the Columbia case, STS-107 was a science mission that had been delayed over a year. Schedule pressure to get the flight in the rearview mirror to continue assembly of the International Space Station shaped the decision environment without anyone issuing an explicit order to cut corners. When margin is consumed in this manner, risk increases sometimes imperceptibly (CAIB, 2003).

The naval equivalent is clear. A deployment date or inspection window or funding might be fixed. Hard schedules shift the cost into deferred maintenance, abbreviated training, crew fatigue and lost proficiency. Other shortfalls become treated as reality—a “we just have to deal with it” attitude becomes normalized. Commanders and staffs should make these trade-offs explicit. Questions like: Are we prioritizing schedule over safety or mission availability over maintenance recovery? –should be asked. There may be valid reasons to do so, but they must be visible and deliberate.

UNCERTAINTY AND ASSUMPTIONS ARE NOT A FOOTNOTES

After the foam impact a debris assessment team (DAT) was assembled to analyze possible damage to the orbiter. The ground-based video was not clear enough to identify the impact location and angle. Even with the model’s profound uncertainty the DAT’s verbal bottom line summary, “no safety-of-flight issue” was verbally briefed to the mission management team—without the DAT’s charts, assumptions, uncertainty bounds or dissenting opinions. No shuttle managers asked probing technical questions as they were already geared towards the belief that foam could not cause critical damage. This put the burden of proof on the engineers to prove it was unsafe.

Naval decision makers need to know not only the risk issues associated with decision alternatives, but also the uncertainty, assumptions and strength of knowledge behind them. In a healthy command climate, uncertainty belongs in the bottom line upfront—not in backup slides. Under similar circumstances to Columbia, responsible officers should be willing to say: “Our estimate is low confidence, our assumptions are not validated for this scenario, and we have dissenting opinions on the conclusions.” Delaying a risk acceptance decision to obtain more data, or elevating acceptance authority up the chain of command, may be uncomfortable but it is also professional.

COMMAND IS RISK ACCEPTANCE

RM in the naval service should not be reduced to administrative compliance with directives. The Columbia mishap reminds us that catastrophic outcomes can emerge from competent people operating within well-respected organizations. Naval leaders should be wary of repeated discrepancies, the silenced operator or maintainer, and be attuned to dissenting opinions. ADM Gehman’s warning remains relevant today because every naval organization faces the same temptation to substitute process for understanding and judgment. Command involves more than assessing risks in port, in garrison, during training exercises or in combat. Commanders must make decisions under uncertainty or ambiguity. This often requires courage. That is Columbia’s enduring lesson for today’s sea services.

References 

Office of the Undersecretary of Defense for Research and Engineering, Department of Defense Risk, Issue and Opportunity Management Guide for Defense Acquisition Programs (Washington, DC: Department of Defense, 2023).

Chief of Naval Operations, Operational Risk Management (ORM), OPNAVINST 3500.39D (Washington, DC: Department of the Navy, 29 March 2018).

Commandant of the Marine Corps, Operational Risk Management (ORM), MCO 3500.27C (Washington, DC: Department of the Navy, Headquarters United State Marine Corps, 2014). 

Columbia Accident Investigation Board. 2003. Columbia Accident Investigation Board. Vol. 1. Washington, DC: U.S. Government Printing Office.

Dennis R. Jenkins, Interview by the author, July 2026.

Diane Vaughn, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA (Chicago: University of Chicago Press, 1996).

Harold W. Gehman, Jr., “Ethical Challenges for Organizations: Lessons Learned from the USS Cole and Columbia Tragedies” (Edited and abridge lecture transcript, Center for the Study of Professional Military Ethics, U.S. Naval Academy, Annapolis, MD, 2005.

David M. Lengyel, Ph.D., is the retired Chief Risk Officer for NASA’s Human Exploration and Operations Mission Directorate, whose research focuses on risk management philosophy and decision-making under uncertainty. He served in senior NASA roles supporting human spaceflight. A former U.S. Marine Corps Naval Flight Officer, he is a 1980 graduate of the U.S. Naval Academy and holds a Ph.D. in systems engineering.