2 Oct Collision. Vehicle drags the pedestrian roughly 20 feet.
3 Oct Regulator told the vehicle stopped on impact.
19 Oct Full video footage provided. 15 days later.
24 Oct State suspends the operating licence.
Every incident review you have ever read stops at a layer somebody chose. Not the deepest layer — the deepest layer that has an owner in the room.
I want to work through a case where the stopping point is unusually visible, because the technical failure and the organisational failure are separated by seventeen days and nobody can confuse them.
What happened
On the evening of 2 October 2023 in San Francisco, a pedestrian was struck by a human-driven car and thrown into the path of a driverless taxi operated by Cruise, then a subsidiary of General Motors. The autonomous vehicle hit her at 18.6 mph. Its sensors were unable to properly determine her position afterwards. The vehicle then executed a pullover manoeuvre to a side lane at up to 7.7 mph, dragging her approximately 20 feet. She was critically injured.
That is the proximate cause, and it is genuinely technical. A perception system met a situation outside what it could resolve and executed a manoeuvre that was correct for a scenario it was not in.
Then the second thing happened. On 3 October, a regulatory analyst was told the vehicle had come to an immediate stop on impact — without mention of the 20 feet. The full video was not provided until 19 October. California’s Public Utilities Commission characterised this as concealment spanning fifteen days, exposing the company to penalties of $100,000 per day, or about $1.5 million.
The state suspended the company’s driverless permits. It halted operations nationwide. The chief executive and co-founder resigned. Twenty-four per cent of the workforce was laid off. The Justice Department and the SEC opened investigations. An outside law firm produced a 195-page report which the company accepted in full.
Operating loss, 2023
$3.48bn
Operating loss, 2022
$3.2bn
Cumulative, since end of 2019
~$6bn
Revenue the service was to produce by 2025
$1bn
Cities in the plan before the incident: more than a dozen. After: one.
The finding I want to sit with
That report did not conclude that the sensors were inadequate. It concluded that the company suffered from poor leadership, made mistakes in judgment, took an “us versus them” mentality with regulators, and held a “fundamental misapprehension of Cruise’s obligations of accountability and transparency to the government and the public.”
Poor leadership
A posture
Mistakes in judgment
A posture
"Us versus them" with regulators
A posture
Misapprehension of what transparency was owed
A posture
Nothing here has a part number, a version, or an owner. A remediation tracker has no column for any of it.
Read that list again with an incident-review eye. Not one of those items is a component. They are all postures. And a posture is exactly the kind of finding that most review processes cannot metabolise, because there is nothing to assign it to.
Why the loss frame explains the second failure
The course reading that made this case legible wasn’t about vehicles. It was about how people weigh risk when they are behind.
The pattern from prospect theory is that we are risk-averse when facing probable gains and risk-seeking when facing probable losses. Offered a sure win, we take it. Facing a sure loss, we reach for the gamble that might avoid it — and we reach for it more readily than the arithmetic justifies.
Now look at the morning of 3 October from inside that building. The certain loss is enormous and already banked: a critically injured person, a suspension, the end of the expansion. The gamble is disclosure control. It has a small chance of containing the damage and a large chance of converting a safety failure into a credibility failure, which is worse.
Nobody sensible takes that bet from a neutral starting point. From deep inside a loss frame, it is the predicted behaviour.
Probable gain
Risk-averse — protect the market position you already hold
Probable loss
Risk-seeking — gamble to avoid a penalty that already looks certain
Improbable gain
Risk-seeking — chase the breakthrough, deploy in a dozen cities
Improbable loss
Underweighted — the rare, severe accident gets insufficient precaution
The bottom two rows are the deployment strategy: chase the improbable gain, discount the improbable catastrophe. The second row is the cover-up. It is the same organisation, in the same frame, on both sides of the incident — which is why treating them as two unrelated failures misses the thing they have in common.
The hard case, which the argument has to survive
Here is where I have to be careful, because “competitive pressure caused it” is a satisfying sentence and satisfying sentences are usually doing less work than they appear to.
The main rival was in the same race. Both companies had received approval to run paid, round-the-clock robotaxi service in the same city that same summer. Both were burning comparable, enormous sums — the operating loss on one side was $3.48 billion in 2023, and the parent division containing the other lost $4.1 billion in the same year. Neither had a working business. Both were being measured against each other constantly.
One of them dragged a pedestrian and then withheld the footage for fifteen days. The other did not.
Approved for paid 24/7 robotaxi service
BOTH
Burning billions a year with no working business
BOTH
Measured constantly against the other
BOTH
Withheld footage from the regulator for fifteen days
ONE
So the race cannot be sufficient. If it were, both companies would have produced the same behaviour, and they didn’t. Competitive pressure is a condition that has to combine with something else, and the report tells us what the something else was: an us-versus-them stance toward the regulator, and a misapprehension about what transparency was owed.
That is the honest version of the claim, and it is narrower than my title:
Intense competitive pressure, combined with an adversarial posture toward the body that can stop you, is sufficient for a concealment response after a serious incident.
Pressure supplies the loss frame. The adversarial posture decides that the regulator is an opponent in the contest rather than a party to it — and once the regulator is an opponent, withholding is not a lie, it is strategy. Remove either half and you get an organisation under enormous strain that still picks up the phone.
I’ve made the sufficient-versus-contributing mistake before, and had to be talked out of looking for a single root cause by the method I’d chosen to find one. It is the same error in a different coat: naming the loudest condition and calling it the cause.
Why reviews won’t write it down
Now the part I actually care about, because I sit in these meetings.
A root cause, in practice, is not the deepest true explanation. It is the deepest explanation that satisfies three conditions: someone in the room owns it, it maps to a corrective action, and the action can be closed by a date.
Has an owner
Nobody's job title is "the race"
FAIL
Maps to an action
"Compete less" is not assignable
FAIL
Can be closed by a date
A standing market condition never closes
FAIL
Where it ends up instead
The narrative section, as context
Run “competitive pressure” through that filter and it fails all three:
- No owner. Nobody’s job title is “the race.” The engineering manager doesn’t own it, the safety lead doesn’t own it, the executive who set the expansion target has a legitimate mandate to grow.
- No corrective action. What is the remediation item? “Compete less”? A review board cannot assign that, and if it could, the business would reject it.
- No closure date. It is a standing condition of the market, not an event. Standing conditions do not close, and an item that cannot close will not be opened.
So it gets demoted. It appears in the narrative section as context, or in a list of contributing factors, where it is true, unactionable and unread. Meanwhile the actionable findings — improve pedestrian-detection edge cases, revise the pullover manoeuvre, add a disclosure checklist — all get owners and dates, all get closed, and none of them would have prevented the fifteen days.
The remediations in this case were real and severe: leadership dismissed, a relaunch narrowed from more than a dozen cities to one, a purpose-built vehicle shelved, spending cut by about a billion dollars. But those are consequences imposed from outside after the fact, not findings a review board wrote down beforehand. That distinction is the whole problem.
What would actually have to change
If a standing pressure can’t be a corrective action, then the only place it can be addressed is in the design of the process, before anything goes wrong. The course framing gave a usable set of moves for exactly this, and two of them are worth stealing:
Classify irreversibility. A decision that cannot be undone should not be made at the same speed as one that can. Deploying an autonomous fleet on public roads is irreversible in the way that shipping a feature behind a flag is not, and the review cadence should differ by more than a rubber stamp. Most organisations I’ve worked in have exactly one change process for both.
Notice the frame before you decide inside it. The reason the loss frame is dangerous is that it is invisible from within — nobody at 9am on 3 October thought “I am now risk-seeking because I am facing a certain loss.” The only defence is a rule written down in advance by people who were calm: this class of event is disclosed within N hours, and the disclosure is not a judgment call. That converts the gamble into a non-decision, which is the point.
Classify irreversibility
A fleet on public roads and a feature behind a flag should not share one change process. Most organisations run exactly one.
Pre-commit the disclosure
"This class of event is disclosed within N hours" — written by people who were calm, so the people who aren't never get a decision to make.
What both moves have in common
They remove a judgment call from the worst possible moment to make one
What I took from it
I have written incident reports that stopped one layer early, and I know why I did it: the last layer had no owner, and a finding without an owner reads as an accusation, so I softened it into context and moved on. The report closed cleanly. The condition stayed exactly where it was.
The lesson from this case isn’t that competitive pressure is evil — competition produced the technology, and the safety case for it may well be real. It’s that the causes most worth naming are precisely the ones your process is built to discard, because your process was designed to produce closeable items and they are not closeable.
If a factor shows up in the narrative of three separate incidents and never once appears as a finding, that is not evidence it wasn’t a cause. That is evidence about your template.
Thanks to whoever attached a live, ugly, still-unfolding case to a week of theory, instead of a tidy one from thirty years ago. If you run reviews: what’s the condition that keeps appearing in your write-ups and never in your action items? I’d like to know whether anyone has found a way to make it stick.
Comments