Here are two descriptions of the same event.
The first: the incident had minimal impact in the real world, and it is markedly less serious than others already reported.
The second: having waited more than two months before detecting and reporting it is unacceptable.
The first comes from Anthropic, whose model under test sent a false witness statement about a murder to the Philadelphia police. The second comes from the police themselves. Who is right?
Everyone measures with their own ruler
Both, no doubt. And that is precisely what makes the question difficult.
The company compares this incident with its other incidents. On the scale of a lab running thousands of tests, a false message sent to a city looks small, especially next to far more serious cyber intrusions.
The police, for their part, compare it with their day-to-day work. A false witness statement about a murder means investigator time lost, a lead to check, perhaps an innocent person suspected. And two months of silence means two months during which nobody knew it had to be disregarded.
Nobody is lying. Each is looking from where they stand.
The problem of the one doing the measuring
Think of a driver who scratches a car while parking. To him, it is a scratch. To the owner, it is their new car damaged, a trip to the garage, an insurance excess to pay. The same scratch does not have the same seriousness depending on whether you caused it or suffered it.
When the one who causes an incident is also the one who measures its seriousness, they naturally do so with their own ruler. Not necessarily in bad faith: simply because it is the only one they have in front of them.
Yet it is often they who decide whether it needs to be reported. If the rule says "report serious incidents", and it is the perpetrator who judges what is serious, many incidents will never be known.
The hospital world knows this problem well. In France, since 2016, healthcare establishments and professionals have had to report to the regional health agencies "serious adverse events associated with care". And it is not the hospital that freely decides what is serious: the law itself defines it, for example when an event causes a death, puts life in danger or causes lasting disability. Seriousness is not left to the judgement of the person who made the mistake.
Time is part of the seriousness
There is another element this story brings to light. The seriousness of an incident depends not only on what it caused, but also on when we learn of it.
An error reported the same day can be corrected before it does damage. The same error discovered two months later has had two months to do damage. Silence makes worse what it hides, even when it is not deliberate.
That is why the best rules set not only what must be reported, but also within what timeframe.
What we take away
A few weeks ago we asked what an accident really is. The answer was that an accident often hides decisions. One could add: the seriousness of an incident often hides a point of view.
For a reporting rule to work, seriousness cannot be left to the sole judgement of the person who caused the incident. It must take into account those who suffered it, and the time they took to learn of it.