A Request Is Not a Requirement

Published October 8, 2026

At 8:30 on the morning of January 22, 2003, a NASA liaison called U.S. Strategic Command and canceled a request to photograph the space shuttle Columbia in orbit. The request had been initiated less than ninety minutes earlier. It asked the military to help obtain images of the shuttle's left wing, which had been struck by a piece of foam during launch six days before. The reason given for the cancellation was that NASA had found its own resources and no longer needed the help.

Inside NASA, engineers were still trying to find out what the foam had done. Their need for pictures had reached people with the authority to obtain them. It had not become a requirement.

Sociologist Ron Westrum studied organizational culture by asking what happens to information, especially information suggesting that something is wrong. He identified three recurring patterns: pathological, bureaucratic, and generative. Each reflects a different priority, which shapes how people respond when someone brings them unwelcome news.

In a pathological culture, personal power comes first. Information is withheld or used to protect influential people and advance their interests. A warning can threaten someone's standing, so its messenger risks punishment. Responsibility is avoided, cooperation across groups is discouraged, and failure produces a search for a scapegoat. People learn to be careful about what they say and whom they tell.

In a bureaucratic culture, rules and departmental responsibilities come first. Information travels through prescribed channels, and people attend to what falls within their remit. Messengers may be neglected rather than punished. A concern that crosses boundaries can struggle to find an owner. When something goes wrong, the organization looks for who breached the rules; an unfamiliar problem can stall because established procedures do not accommodate it.

In a generative culture, accomplishing the mission comes first. People actively share useful information, including across departmental boundaries. Messengers are trained, responsibility for risk is shared, and failure prompts inquiry into what happened and what needs to change. A warning gives people a problem to investigate together.

These are patterns of behavior. Having detailed procedures does not, by itself, make an organization bureaucratic in Westrum's sense. What matters is how people use those procedures when information challenges their assumptions.

Westrum set out the model in a 2004 paper on safety in health care, while acknowledging that its relationship with safety needed further research. The types describe tendencies, and different parts of an organization can behave differently. Westrum himself used Columbia as an example of bureaucratic failure. The accident investigation gives that judgment its substance: a record of how a concern traveled, how its meaning changed along the way, and how the people who raised it eventually stopped trying.

Columbia lifted off on January 16. About eighty seconds into the climb, a piece of foam insulation broke away from the external tank and struck the left wing. The next morning, engineers reviewing the launch footage noticed the impact. They were alarmed by the size of the object and the timing of the strike, but the available images could not show the resulting damage. The chair of their photo-analysis group asked a manager who knew how to seek military imaging to try.

That afternoon, before a damage assessment had been completed, senior program managers expressed a lower level of concern. Foam had come off on previous flights, and the program officially took the position that this strike posed no safety issue.

A Debris Assessment Team formed from NASA and contractor engineers, with structural engineer Rodney Rocha as co-chair. Its analysts used a tool called Crater to predict damage. Crater had been validated against small debris; the foam that struck Columbia was about 400 times larger in volume than the debris used to calibrate it, by the investigation board's best estimate. The model predicted penetration deeper than the tiles were thick. The analysts discounted those results because Crater was considered conservative: it tended to predict more damage than actually occurred. But that reputation came from impacts within its experience base. This one was far outside it.

The team continued working with major uncertainties, including where the foam had struck. Better pictures could help resolve them.

On January 21, the team agreed to seek images from an outside source. Mission managers had given it little direction, so the engineers pursued the request through the engineering directorate rather than the mission chain of command. Rocha explained that without better photographs it would be difficult even to bound the problem and asked his managers to seek outside help.

The investigation board later concluded that this route mattered. Program managers read the request as an engineering desire rather than an operational need. The technical reason for asking had not changed. Its organizational standing had.

The next morning, Wayne Hale, a manager who had received the earlier photo-analysis request, contacted a Defense Department representative and asked the military to begin planning. Within an hour, Strategic Command was identifying imaging assets that might do the job.

When Linda Ham, chair of the Mission Management Team, learned of the activity, she began asking who required the pictures. The board reconstructed what likely happened during the ninety-minute interval: Ham contacted four colleagues, none of whom said they had requested imagery or could identify a requirement for it. She did not ask the Debris Assessment Team directly, although its engineers were analyzing the strike. She has said she did not know of the team's request.

There were practical objections. Maneuvering the shuttle for photographs could interrupt experiments. Earlier military images had been disappointing. Some managers believed that even if damage were found, nothing could be done. Yet the board found that nobody in the operational chain of command had the clearance needed to know the national imaging systems' capabilities, and nobody checked what quality of images they could provide.

At 8:30, the request was canceled.

The liaison later thanked Strategic Command for its quick response and asked that future requests come through official channels. Those channels, the message explained, existed so that requests like this one would not "spin the community up" about problems that had not been fully vetted.

That afternoon, the engineers discussed whether they had a mandatory need for the images. When investigators later asked what that meant, most shrugged. They understood why they needed pictures: without them, they could not reliably assess damage from a strike outside their experience. They could not identify a requirement that made the request mandatory.

The board described the circular demand they faced. They wanted images to assess the damage, but needed to establish through their assessment that images were necessary. The uncertainty that prompted the request was also what prevented them from justifying it.

After the meeting, Rocha drafted an email calling the decision "bordering on irresponsible." He warned of potentially grave hazards and recalled NASA's safety posters: "If it's not safe, say so." He did not send the email. He printed it and showed it to a colleague. Asked why, he said he did not want to jump the chain of command and would defer to management's judgment.

The next day, Mission Operations offered him a possible route to pursue imaging. He declined, believing program managers would still have to support it. An avenue existed, but he no longer believed that taking it would get the concern acted on.

On January 24, the team presented its findings to a room so crowded that engineers stood in the hallway. The analysis did not establish a safety-of-flight issue, but substantial uncertainties remained. An hour later, a manager summarized the findings to the Mission Management Team without the supporting charts. Nobody requested the underlying analysis or asked technical questions. The official minutes did not mention the debris strike.

The requested images were never obtained. Columbia broke apart during re-entry on February 1. All seven astronauts aboard were killed.

Westrum's bureaucratic type helps explain the sequence. Responsibility narrowed at departmental boundaries. A request through engineering became an engineering preference, even though its purpose was to assess a threat to a mission in progress. Managers sought confirmation from other managers without asking the team doing the analysis. Official channels could stop outside activity more effectively than they could bring unresolved concerns into a decision.

The distinction between request and requirement determined who had to prove what. Engineers needed evidence to determine whether the shuttle was in danger. Management required a stronger demonstration of need before helping them obtain that evidence. A system intended to screen requests screened out the means of assessing the risk.

But bureaucracy alone does not explain all of it. Team members told investigators that they had held back for fear of ridicule from peers and managers. Rocha believed the decision was irresponsible yet kept his strongest objection out of circulation. Those details bring Westrum's pathological type into view: information becomes harder to share when raising it puts the messenger's standing at risk. Departmental procedure and fear can reinforce each other.

Nor does the record support a simple division between perceptive engineers and ignorant managers. The engineers made questionable assumptions in their analysis. Senior managers' own emails showed awareness of the technical limits and possible seriousness of the strike. The board found failures on both sides, including weaknesses in how uncertainty was presented and how little management probed it. Information was available. It did not produce the inquiry it warranted.

There is a fair objection to judging all this through the outcome. Earlier foam strikes had ended in successful landings. Complex programs generate more concerns than they can pursue at full cost, and hindsight makes a warning look clearer than it was. Obtaining photographs would not necessarily have revealed the damage or saved the crew. At the board's request, NASA studied rescue and repair options. A rescue by Atlantis looked possible only if the damage had been recognized very early and everything on the ground had gone right, and the repair analysis was inconclusive.

The failure can be judged without claiming a different ending. Managers canceled an effort to obtain evidence without directly consulting the team that needed it. The team then struggled to satisfy a requirement it could not define. Its uncertainty survived; its request did not.

A generative response, in Westrum's terms, would have kept that uncertainty attached to the decision. Someone with authority would have asked the analysts what they could establish, what they could not, and what additional evidence might change their judgment. Imaging might still have proved inadequate. The request might still have been declined. But the reasons would have answered the engineering need, and the unresolved risk would have remained visible to those responsible for the mission.

After the accident, program managers said engineers with safety concerns were obligated to tell management. The board answered that leaders had a corresponding, and perhaps greater, obligation to create viable routes for those concerns to travel.

That obligation is the practical force of Westrum's model. A culture is revealed in what happens after someone speaks: who listens, who takes responsibility, and whether an unresolved question can reach the people empowered to act on it. At Columbia, engineers were asked to establish why they needed to look before anyone would help them look. The danger remained uncertain. The request never became a requirement.