And now… the “rest of the story” …
The 2016 film cast John Malkovich as Donald Vidrine, the lone villain who pushed the job forward despite the crew’s objections. People who had worked with Vidrine have disputed that portrayal. One investigator said engineers who served under him called him the most conservative, risk-averse company man they had ever known, and that BP higher-ups unfairly blamed him for decisions they made.
Vidrine was initially charged with 22 felony manslaughter charges; however, many of those charges were dismissed as the case proceeded (11 manslaughter charges). In his order, Judge Stanwood Duval ruled that the law didn’t reach oil well site leaders with no navigation function on the rig, and the 5th Circuit later upheld that ruling. In December 2015, prosecutors dropped the remaining manslaughter charges, so neither Vidrine nor Robert Kaluza stood trial for the deaths.
As part of the plea deal on the remaining gross misdemeanor charges, Vidrine testified against Kaluza at the February 2016 trial. On the stand, he said he “probably didn’t press hard enough”. He pleaded guilty to the misdemeanor pollution charge and got 10 months of probation. He died at home in Baton Rouge after a three-year fight with cancer in 2017.
On the evening of April 20, 2010, the Deepwater Horizon crew ran a test to see whether the Macondo well, a mile of water and another two and a half miles of rock below the rig, was sealed.
The test was simple. Bleed the pressure off the drill pipe, close it in, and watch the gauge. If the cement at the bottom of the well held, the pressure would stay at zero. If it climbed, something from the reservoir was pushing its way back in.
The drill pipe gauge read 1,400 psi. A second line, the kill line, read zero. Two instruments that should have agreed, telling two different stories. One said the well was dead. The other said it was alive.
So the men on the rig floor did what experienced people do with a number that doesn’t fit. They explained it. A theory went around the drill shack: the “bladder effect.” Heavy drilling mud in the riser pressed down on a rubber seal, pushing pressure into the drill pipe. The reading wasn’t the well. It was an artifact. The BP company men accepted it. They logged the test as a pass, and the crew began pulling the heavy mud out of the hole.
A little before ten that night, the well blew out. Eleven men died. The rig burned for two days and sank. Oil flowed into the Gulf for 87 days.
The standard telling of this story is “a chain of small mistakes.” A bad cement job, a skimped design, a misread test. That’s true as far as it goes. It misses what actually matters.
The people who read that gauge weren’t reckless. Many of them had spent decades offshore. They had seen ugly pressure readings before. And they weren’t betting their lives on the bladder effect.
They were betting their lives on what sat at the bottom of the riser.
The blowout preventer is a stack of valves and rams roughly five stories tall, bolted to the seafloor, built for one moment: when everything else fails. If gas comes up the well, the preventer closes around the pipe. If that isn’t enough, blind shear rams cut the drill pipe in half and seal the hole. If the rig loses power and communication, a deadman system is supposed to fire those shears automatically. Layer on layer on layer.
That stack is the reason a crew can live with an ambiguous reading. If we’re wrong, the BOP catches it.
That night, someone on the bridge hit the emergency disconnect. Nothing happened. The explosions had likely already severed the control lines. The deadman system should have fired on its own. Forensic testing later found that one of its two control pods had a dead battery and the other had a miswired solenoid. When the shears finally did close, the drill pipe had buckled under the pressure and been pushed off-center, out of the blades’ reach.
Every backup failed. And here is the part that matters: nobody on that rig floor could have known it before they needed it. You cannot test a blowout preventer against a real blowout without having one.
That’s the mechanism. Not a chain of small mistakes, but a bad signal explained away because everyone believed in a backstop they had never seen work under real conditions. Take the preventer out of their heads and nobody pulls the mud out of that well with a 1,400-psi question mark on the gauge.
The backup didn’t just fail. The backup is why they took the risk.
Economists call this risk compensation. Give people better brakes and they drive faster. Give them airbags and they follow closer. The safety system doesn’t just sit there waiting for the bad day. It quietly changes how much risk everyone is willing to accept on the good days.
There’s a second piece to this, and it’s the one that keeps me up.
Twenty-four years before Macondo, on April 26, 1986, the operators of Reactor 4 at Chernobyl were running a test that pushed the reactor into strange and unstable territory. They could do that because they had AZ-5, the emergency shutdown. Press the button and every control rod drives into the core. It’s the button you press when you’ve lost control, and it’s the reason you’re willing to get close to losing control in the first place.
They pressed it.
The control rods had graphite tips. In the condition that reactor was in, the first seconds of insertion pushed water out of the bottom of the core and added power instead of killing it. The shutdown button didn’t save the reactor. By most accounts, it set off the explosion.
The flaw wasn’t unknowable. A version of it had shown up at another Soviet plant three years earlier. The knowledge existed inside the system. It never reached the men in the control room.
Same structure at Macondo. Transocean owned and maintained that blowout preventer. The condition of its batteries and solenoids lived in someone’s records, somewhere. It wasn’t at the point of decision. The people making the call were working from a wrong picture of their safety net, and they had no way to know it was wrong until it was the only thing standing between them and the fire.
So this story has two kinds of risk, and the deadly thing is having both at once.
The first is the signal you explain away. The data says something is wrong, and you build a story where it isn’t. That feels like analysis. It’s actually the oldest rule in politics, broken in real time: don’t believe your own bullshit. In statistics, we call this “The Type II error” or “Beta error” (β), where you conclude the hypothesis is “false” when, in fact, the hypothesis is true. In a jury trial, for example, this would mean concluding the accused is guilty, ignoring the hypothesis of his innocence, when in fact the accused is indeed innocent (wrongful conviction). In medicine, this would be a negative test result for a disease when the patient has the disease.
This is a decision error, not malfeasance (at least not obviously such).
Nobody on that rig lied to anyone else first. They told themselves a story that made 1,400 psi mean nothing, and then they believed it.
A Type II error is among the most serious mistakes you can make in reasoning under uncertainty. If you ignore the data in front of you and concoct a story that rationalizes an outcome you prefer, you are almost certainly making a Type II decision error.
The second is the backup you can’t inspect. The safeguard you’ve never fired, can’t test without needing it, and won’t learn is broken until the day it has to work.
A backup isn’t a backup until you use it to survive a failure, it kicks in at a decision failure, or you try and restore using that system. I learned that lesson in national security, aviation training, and while I had Iron Mountain as an advertising client. You have to test whether your backup measures can prevent the harm you believe could occur. If you don't test, you have no reasonable expectation that a backup will work.
In national security, you run system tests, war games, and you practice what you can. Obviously, you’re not going to start a war with someone to test your backup systems. That said, conflicts generate massive amounts of “paperwork” after the fact. After-action reports are submitted. And I swear, the favorite buzzword in my time in DoD was “lessons learned”, which meant a compilation of alleged lessons and takeaways from both leadership and the field. What worked, what didn’t, what needed reform, what needed replacement, what we should and shouldn’t do again.
In aviation, backups are routinely tested in real-world scenarios and evaluated; if measures fail, it’s better to know before you need them. In pilot training, pilots learn to navigate and use backup instrumentation and systems under real-world conditions. In early flight training, you literally do this “in the air,” while piloting the aircraft. Instructors will force you not to use primary instruments, shut the engine off, or put the plane into a stall on purpose so you can practice using the backup systems and recover. In later flight training for, like, an ATP (commercial pilot) certification, you’ll do this in hyper-realistic simulators because it’s ill-advised to shut off a 747’s engines in flight or blow out its electrical system. When piloting a complex aircraft, pilots intentionally trigger alarms and backup systems before takeoff by causing faults that take primary systems offline while still on the ground.
In data management backups, they’ll intentionally attempt to restore, under stress, backed-up data. If you can’t back it up, then the backup system isn’t really functional. Only a data restore can tell you if your backups actually work. They’ll restore entire systems and then compare them to the functioning live systems. If it works, awesome; if it doesn’t? Problems.
Either a Type II error or a back system failure alone is possibly survivable. You can catch a misread signal if your backstop holds. You can live with a broken backstop if you never let yourself need it. Put them together and the second one gives you permission for the first.
There was a human cost on top of the engineering one. Earlier that day, the rig’s senior Transocean manager, Jimmy Harrell (“Mister Jimmy”), argued with the BP company man over the plan for the evening. He argued, and then he went along. It’s easy to say he should have refused, shut it down, and let the lawyers sort out the breach of contract. But look at the math from where he stood. Refuse, and the best possible outcome on record is that he cost his company a client and a week of rig time over a test the drillers said was fine. Go along, and most days nothing happens. The cost of saying no was visible, immediate and personal. The cost of saying yes was a counterfactual nobody would ever see, until the one day they did.
This is actually the most dangerous risk, and I want you to hold onto that, because it’s exactly the math you’re running.
Most people who read this publication have a plan B. Usually it sounds like a sentence I’ve written about before: If it gets bad, we’ll leave.
That sentence is a blowout preventer. And you have never fired it.
Look at what has to work, all at once, for it to hold. Your passport has to be valid, with enough runway left that a border agent doesn’t turn you away. A country has to let you stay longer than a tourist. The Schengen Area gives Americans 90 days in any 180, and that’s not a plan; it’s a vacation. The residency path you’re counting on still has to be open the day you finally need it. A bank has to be willing to hold and move your money. And the citizenship claim you’ve been holding in reserve has to actually exist.
Those are the batteries and the solenoids. And they fail quietly, on someone else’s schedule, while you’re not looking.
In March 2025, Italy rewrote its citizenship-by-descent rules by decree, effectively overnight, and cut off most claims that ran further back than a grandparent. Thousands of Americans had spent years treating an Italian great-grandparent as their escape hatch. They had the family tree. They’d meant to file. The hatch was miswired the whole time they counted on it, and they found out when they read the news.
Spain ended its golden visa in April 2025. Portugal stopped letting real estate purchases qualify for its version in 2023. American expats get their foreign bank accounts closed every year because the reporting burden makes them more trouble than they’re worth. None of these are catastrophes. They’re dead batteries. Nobody notices one until the day the system has to fire.
Now go back to the risk compensation piece, because this is where it gets personal. Because you believe the hatch works, you tolerate signals you’d otherwise act on. Every month that passes without needing it reinforces the belief that it’s there. Sociologist Diane Vaughan, studying the Challenger disaster, called this the normalization of deviance: each near-miss gets filed as proof of safety instead of luck. The gauge reads 1,400 psi, nothing happens, and next time 1,400 psi feels normal.
And you’re running Jimmy Harrell’s math. The cost of acting now is visible and immediate: money, paperwork, a hard conversation with family, the friend who thinks you’re being dramatic. The cost of waiting is a counterfactual. It will stay a counterfactual right up until the day it isn’t.
Most of the decisions in your life can be reversed. You can change jobs, sell the house, try a city and leave it. Those are decisions you get to learn from.
Some can’t. A citizenship window that closes stays closed. A residency program that ends doesn’t come back for you. A health event, a family crisis or a change in the law that lands before your paperwork is in hand doesn’t give you a second session to fix it. In the end, there are only two kinds of decisions that matter: the ones you survive and the ones you don’t. The skill is knowing which kind you’re looking at before you make it.
That’s why the rational move is not to predict when it gets bad. Nobody can, and the people who tell you they can are selling something. The rational move is to test your backup now, while testing is cheap and failing is survivable.
Concretely, that means turning a theoretical hatch into one you’ve actually opened. File the citizenship claim instead of holding it in reserve; a filed claim is protected in ways an intention isn’t. Get the residence permit while it’s a choice and not a refuge, and keep it alive. Open the foreign bank account now, use it, and find out whether it survives its first year of compliance paperwork. Know your passport’s expiration date and the six-month rule that governs half the borders you might need to cross. Know exactly how many days you can stay, and where.
None of that is moving. It’s a fire drill. It’s opening the hatch once, on a calm day, to find out whether it opens at all.
The crew of the Deepwater Horizon didn’t die because they misread a gauge. Experienced people misread gauges all the time and go home. They died because they believed something at the bottom of the sea would save them if they had.
Find out whether yours will, while it's still cheap.
The visa, the apostilles, the background check — those are the easy part. People get all of that right and still end up in trouble. Even people with accountants, lawyers, and wealth managers.
What goes wrong is further back. A decision that looked perfect ten moves ago, arriving now as a tax bill, a letter from a government, a check you didn’t plan to write. And nobody had to do anything wrong. They just never saw the whole board.
A Situation Review takes 25 minutes. It’s free. You’ll leave knowing whether you have a wish or a plan.
I just want to say that your work is so good and so valuable. I'm already into my permanent residence in Brazil, and I've got properties and lawyers and pretty much things under control, although there probably are some costs that I should have anticipated around taxes, and I didn't, since I did this all on my own. If I was moving now or thinking now, I would certainly engage your service. And your work on politics is fantastic too. I just really enjoy reading you.