Southern Pacific Transportation Co. v. United States

OPINION WIESE, Judge. Plaintiff, Southern Pacific Transportation Company and its subsidiary, North [403] western Pacific Railroad Company (collectively “Southern Pacific” or “the railroad”) initiated this suit to recover the costs of cleaning up a vandal-caused tank car spill of formaldehyde, a hazardous substance, into a navigable waterway of the United States. The applicable statute, section 311 of the Federal Water Pollution Control Act (renamed the Clean Water Act), as amended, 33 U.S.C. § 1321 (1982), assigns liability for such clean-up costs to the owner or operator of the facility involved. However, section 311(i)(l) provides that “such owner or operator shall be entitled to recover the reasonable costs incurred in such removal upon establishing * * * that such discharge was caused solely by * * * an act or omission of a third party”. 33 U.S.C. § 1321(i)(l). The railroad’s claim is grounded on this exception. The Government argues the exception does not apply. The case is presently before the court on cross-motions for summary judgment. Briefs and extensive supporting documents have been filed, and oral argument has been heard. Because the court finds that there áre disputed issues of fact concerning the efficacy of certain entry-resistant cable seals as a preventive measure against vandalism, summary judgment on the case in its entirety cannot be granted to either party. However, with respect to all other issues raised in the briefs, plaintiff is entitled to judgment as a matter of law. In order to help clarify the issues that remain for trial, the court sets forth the reasons for its decision below. FACTS On the morning of March 25,1982, shortly before daybreak, a psychotic vagrant crawled beneath a parked railroad tank car, opened the car’s bottom-outlet mechanism and released the contents — about 21,000 gallons of formaldehyde solution, a widely used industrial chemical. Formaldehyde is classified as a hazardous substance, 40 C.F.R. § 116.4 & Table 116.4A (1986), on the same order of dangerousness as turpentine, diesel fuel and kerosene. 49 C.F.R. §§ 172.101, 173.2(a) (1985). The spill flowed into a trackside culvert, from there into a small creek, and eventually into the Russian River, a major source of drinking water and a principal recreational resource in north- western California. Because of rapid clean-up efforts, the spill caused no serious health problems or permanent environmental damage. However, the water systems of several communities had to be temporarily shut down and a nearby orchard was damaged when an emergency containment dike overflowed. The tank car from which the spill occurred was a standard-design bottom-outlet car commonly used to transport substances like formaldehyde by rail. It was owned by ACF Industries, Inc., and leased by a shipper, Georgia-Pacific Corporation. The car had been loaded by Georgia-Pacific employees at a chemical plant in Millersburg, Oregon on March 19. It was then tendered to the railroad for carriage to a Georgia-Pacific plywood plant in Ukiah. The car, which was designated by the code number ACFX 84600, arrived in Ukiah at about 10:45 p.m. on March 24. Upon arrival, the car was placed on a “set-out” track, along with some ten other cars, to await delivery the following afternoon to the plywood plant. This set-out procedure made it possible for the railroad’s local switch crew to schedule deliveries to area industries at a time of day most convenient for unloading cargo. Such set-outs are a standard part of railroad operations. In fact, it is not unusual for tank cars to spend many hours at rest in sorting yards and siding tracks en route to their destinations. The set-out track in Ukiah was located about a half mile south of a train depot and across the field from a bus station. The area was not lighted or fenced, and it was not patrolled by security guards. Although located away from street crossings, the track was accessible by foot paths. Like all railroad tracks, the set-out track was designed to drain as quickly as possible to prevent accumulations of surface water from undermining the crossties. See 49 C.F.R. § 213.33 (1985). All of the terrain around the track sloped toward the [404] Russian River, which was located about a mile east of the track. The spill was discovered at about 9:00 a.m. March 25 when the first railroad personnel came on duty. By then, virtually all of the contents of car ACFX 84600 had drained out. On the basis of the rate at which liquid flows from the bottom-outlet valve, it was established that the discharge must have begun sometime between 6:00 a.m. and 6:20 a.m. All the evidence in the record points to vandalism as the cause of the spill. At several points en route from Millersburg, railroad workers had visually inspected the bottom-outlet mechanism on car ACFX 84600 to make sure it was not leaking. A similar check had been conducted at the time the car was placed on the set-out track at Ukiah. None of these inspections revealed any indication of leakage or dripping. In addition, an examination of the tracks near the set-out track revealed no trace of a waxy paraformaldehyde residue that would have been present had the car been leaking when it arrived in Ukiah. Because spontaneous leaks are virtually impossible when cars are at rest, the only plausible explanation for the formaldehyde release is that someone opened the bottom-outlet mechanism while the car was left unattended on the set-out track. Although there were no eyewitnesses to the vandalism, all evidence points to one Douglas Arthur Collins, a 38-year-old vagrant with a history of psychotic illness and substance abuse, as the person responsible. Mr. Collins had spent the nights of March 23 and 24 sleeping on a bench outside the depot. He was seen rooting in garbage cans during the day. At 3:00 a.m. on the morning of the spill, Mr. Collins was in the nearby bus station, shouting and generally behaving in an unruly manner. According to one psychiatrist who later examined him, it was not unusual for Mr. Collins to create minor disturbances periodically so that he could get arrested and spend the night in jail before moving on to a new town. On this occasion, however, his behavior had garnered no more than a warning from police. At about 5:45 a.m., Mr. Collins left the bus station and bought a cup of coffee and a candy bar at a nearby convenience food store. He was next seen about 7:00 a.m. back in the bus station. He was now reeking of a strong odor and picking at his face and arms. At 10:30 a.m., he was seen washing his clothes at a gas station. When he was arrested three days later, Mr. Collins had severe burns on his feet, and his face was red and peeling. Formaldehyde residue was also found on his clothing. His appearance was consistent with the condition a person would be in if he had been splashed by formaldehyde while squatting underneath a tank car. Mr. Collins was charged with felony vandalism, but the charge was later withdrawn when psychiatrists could not agree on whether he had the capacity to appreciate the wrongfulness of his acts. The account of the incident that he gave to investigators and hospital staff members was only partially coherent. For instance, he said that he had been underneath the tank car and had seen fluid spraying from the bottom valve, but he also remembered seeing Army trucks and paramedics on the scene. He also spoke of little ghost-like people who shouted at him but left him alone when he was on the railroad tracks. When shown a picture of the tank car, Mr. Collins, a Navy veteran, identified it as a “water buffalo”, a car used in the military to transport water. Although Mr. Collins denied that he was responsible for the formaldehyde spill, there is no evidence that anyone else was involved. The release of the contents of car ACFX 84600 was controlled by an outlet mechanism consisting of two principal components: an interior ball valve assembly located on the underside of the tank car body and, projecting from that, an outlet pipe fitted with a gasketed cap. The cap, in turn, was equipped with a 2-inch hexagonal end plug. Thus, release of the contents of the tank car required a two-step process: either the cap or end plug had to be removed and then the valve had to be opened to release the flow. [405] The valve was controlled by an external handle projecting from the side of the bottom-outlet assembly. The handle was held in a closed position by means of a retaining pin. The pin was inserted through an opening in the handle and into a hasp on the body of the car. Drilled through the pin was a small hole, through which a thin metal “ribbon seal” was placed. The seal was supplied to Georgia-Pacific by the railroad and was applied at the time the car was loaded in Millersburg. It was easily broken without special tools and was designed to detect, rather than prevent, tampering. Forensic tests conducted after the spill established a high likelihood that the ribbon seal on car ACFX 84600 had been broken by a can opener found in Mr. Collins’ possession at the time of his arrest. Thus, all of the evidence in the record leads to the conclusion that it was Mr. Collins who turned the exterior handle to open the valve and cause the formaldehyde release. The end plug on the outlet cap had also been removed. Department of Transportation (“DOT”) regulations require that a shipper of hazardous materials (in this case, Georgia-Pacific) must tighten both the outlet cap and the end plug with a 36-inch Stillson wrench before certifying the car as fit for transport and tendering it to the railroad. 49 C.F.R. §§ 172.204(a), 173.1(b), 173.22(a), 173.31(b)(3) (1985). Clarence R. Chung, a Georgia-Pacific employee, stated in his declaration that he properly tightened the outlet cap with a 36-inch wrench when car ACFX 84600 was loaded in Millersburg. He said that he then resized the jaws and tightened the plug. A cap and plug properly secured cannot be removed again without a comparable tool. There is no evidence, however, that Mr. Collins used a 36-inch wrench — or, for that matter, a tool of any kind — to remove the plug. A 24-inch wrench was discovered several days later at a railroad crossing about a mile away, but there is no evidence to link it directly to the formaldehyde spill. Plaintiff concedes that it is highly unlikely that this wrench was involved in opening the tank car. There also were two scrap metal yards near the set-out track. Plaintiff theorizes that Mr. Collins, who had some experience as a part-time mechanic, might have fashioned a makeshift tool out of channel iron and then quickly discarded it after the spill began. But, again, there is no direct evidence that such a tool was used. Nor is there any evidence that Mr. Collins, a man of slight physical stature, possessed unusual strength. The evidence in the record can lead to only one conclusion: either Mr. Chung is mistaken about tightening the end plug or the plug came loose en route through vibration. In any event, the plug could not have been properly tightened when the tank car was placed on the set-out track in Ukiah. The looseness of the plug could have easily escaped detection during the visual inspections because a properly seated valve will prevent visible dripping even if the cap or plug is loose. In addition, paraformaldehyde can form a seal around a loose cap or plug that also will stop minor drips. Thus, the court must conclude that when car ACFX 84600 was placed on the set-out tracks overnight, it was in such a condition that its contents could be released relatively easily by a casual vandal, that is, if the vandal took a notion to crawl under the two-foot clearance beneath the car, remove the plug — either by hand or with a hurriedly fashioned makeshift tool — , break the ribbon seal on the valve handle, and then turn the handle and open the valve. Vandalism of this kind is not regarded as a significant cause of hazardous substance spills on railroads. The Federal Railroad Administration does not consider vandalism a sufficiently important cause of spills to warrant a separate category among 17 classifications used for discharge reporting purposes. In fact, analysis of existing records from 1978 through 1983 indicates there was only one significant hazardous substance spill — other than the discharge at issue in this case — that might have been caused by vandalism.1 During this same [406] time period, almost 5 million carloads of hazardous material were moved by rail. Plaintiff’s own experience with vandalism mirrors the national statistics. Although the railroad averages more than 100,000 movements of hazardous materials annually, its security personnel stated that in their memory, which dates back 40 years, there had never been a prior release of hazardous material caused by vandalism on any part of the Southern Pacific system. The system includes more than 14,000 miles of mainline track across the western half of the United States. The railroad’s only prior vandalism-related spill of any kind occurred eight days before the Ukiah incident when two teenagers opened a car with a crescent wrench and released non-hazardous rubber extender oil near Bakersfield, California. The cause of this spill was not determined to be vandalism until two days before the Ukiah spill. In any event, there was too little time between the Bakersfield and Ukiah incidents for plaintiff to have altered its safety procedures to any significant degree. Thus, for all practical purposes, the release of fluid from a tank car by a vandal must be viewed as an event unprecedented in the railroad’s experience. Furthermore, although vandalism of a general or minor nature is common in some parts of the Southern Pacific system, it was not a serious problem at the Ukiah station. Prior to the spill, the railroad had experienced no vandalism to cars at rest on the set-out track, and acts of vandalism at the depot had been limited to minor thefts and rock-throwing incidents. There was therefore no reason to suspect any special danger that a vandal might cause a release of hazardous material in Ukiah. In light of these facts — and in light of the logistical problems peculiar to the transport of hazardous materials across thousands of miles of track — plaintiff contends that it did everything that reasonably could be expected of a railroad to protect against a vandalism-related spill. It therefore argues that Mr. Collins’ act of vandalism was the sole cause of the formaldehyde spill into the Russian River. DISCUSSION Section 311 of the Clean Water Act, as amended, 33 U.S.C. § 1321 (1982), declares “that it is the policy of the United States that there should be no discharges of oil or hazardous substances into or upon the navigable waters of the United States”. § 1321(b)(1). To achieve that goal, the statute places primary responsibility upon the operators of storage facilities to clean up spills of oil and hazardous material. § 1321(c)(1).2 The liability scheme is not absolute, however. A discharger can recover its clean-up costs from the Government if it can prove that the spill was “caused solely by” an act of God, an act of war, the negligence of the Government, or an act or omission of a third party. § 1321(i)(l). The exceptions must be narrowly construed. As the relevant Senate Report stated, “Any culpability on the part of the owner or operator would vitiate the exception.” S.Rep. No. 351, 91st Cong., 1st Sess. 6 (1969).3 Plaintiff therefore bears a heavy burden of proving that it was totally without fault for the spill. St. Paul Fire & Marine Insurance Co. v. United States, 4 Cl.Ct. 762, 768 (1984); Atlantic Richfield Co. v. United States, 1 Cl.Ct. 261, 263 (1982). Affirmative Act Theory At the outset, the Government contends that the railroad’s placement of the tank car on the set-out track above a drain [407] age culvert constitutes an affirmative act which contributed to the discharge of formaldehyde into the Russian River. Therefore, defendant argues, the vandal cannot be considered the sole cause of the spill and recovery is automatically precluded, regardless of fault on the part of the railroad. The court does not agree. In Cities Service Pipe Line Co. v. United States, 742 F.2d 626 (Fed.Cir.1984), the Federal Circuit made clear that activity inherent in plaintiffs business, if not abnormally dangerous, does not give rise to liability for clean-up costs without a breach of duty. Id. at 627. Thus, the court concluded, the mere act of pumping oil through a pipeline does not by itself make the operator liable for all spills. Id.; see also Travelers Indemnity Co. v. United States, 230 Ct.Cl. 867, 868, cert. denied, 459 U.S. 1015, 103 S.Ct. 374, 74 L.Ed.2d 508 (1982) (mere act of placing oil in storage tank does not give rise to liability). In this case, placement of cars on railroad tracks is obviously inherent in plaintiff’s business. The uncontroverted evidence establishes that set-outs are a necessary part of railroad operations. Indeed, during its five-day trip from Millersburg to Ukiah, car ACFX 84600 was at rest for a total of 76 hours, more than half of its travel time. There is no evidence in the record to suggest that transporting substances like formaldehyde by rail poses greater dangers to the environment than transporting oil by pipeline. Therefore, the court must conclude that the mere act of placing a tank car on set-out tracks does not constitute an abnormally dangerous act that precludes recovery of clean-up costs. A contrary result would essentially make railroads liable for all vandalism-related spills and write the exceptions to strict liability out of § 311. It is clear that the statute was not intended to make a railroad the insurer against all acts of vandalism. Union Petroleum Corp., 228 Cl.Ct. 54, 73, 651 F.2d 734, 745 (1981). Standard Of Care The issue, rather, is whether the railroad placed the tank car on the set-out tracks without taking sufficient precautions against vandalism so that plaintiff's omissions must be considered partially responsible for the spill. Where a vandal is the immediate cause of a spill, recovery must be denied “if the claimant does not prove that reasonable actions had been taken to prevent or forestall such intervention by a third party.” Id., 651 F.2d at 745 (emphasis in original) (quoting Chicago, Milwaukee, St. Paul & Pacific Railroad v. United States, 216 Ct.Cl. 155, 159, 575 F.2d 839, 841 (1978)); see also Cities Service, 742 F.2d at 627-28 & n. 1 (“reasonable care” satisfies legal duty); Travelers Indemnity, 230 Ct.Cl. at 869 (operator must take all precautions that are “reasonably required”). Determining what precautions are reasonable in a given situation presents a difficult task of line-drawing. Chicago, Milwaukee, 216 Ct.Cl. at 161, 575 F.2d at 842. In drawing that line, plaintiff urges the court to follow the oft-cited test for reasonable care that Judge Learned Hand borrowed from economic theory almost four decades ago: a precaution is reasonable if it costs less than the cost of the potential harm, discounted by the probability that the harm will occur. United States v. Carroll Towing Co., 159 F.2d 169, 173 (2d Cir.1947) (Hand, J.); see also United States Fidelity & Guaranty Co. v. Jadranska Slobodna Plovidba, 683 F.2d 1022, 1026 (7th Cir.1982) (Posner, J.). This cost vs. benefit test reflects the modern trend in tort law toward a single, sliding duty of care applicable to all situations, as opposed to wooden distinctions between duties of “slight”, “ordinary” and “great” care. See W. Prosser & W. Keeton, Prosser & Kee-ton on Torts § 31 at 171-73 (1984) (hereafter cited as Prosser); Posner, A Theory of Negligence, 1 J. Legal Studies 29 (1972). The Government resists this approach contending that Congress’ concern for protection of the nation’s waterways demands a higher standard of care than required under the Hand formula. In defendant’s view, even economically inefficient precautions must be undertaken as long as they are “available” at some cost. The Government purports to find this higher-than-eco [408] nomically-rational duty of care in the structure of § 311, its legislative history and its interpretation by this circuit. This court draws exactly the opposite conclusion. Preliminarily, we observe that nothing in the language of § 311 or its legislative history precludes the court from employing a rational balancing of costs and benefits to determine what precautionary measures are reasonably required to meet a particular threat of pollution to the nation’s waterways. And while it is certainly true, as defendant points out, that § 311 generally imposes liability on the discharger of hazardous materials without regard to fault, that fact alone reveals nothing about the standard of care required to make a dis-charger eligible for the exceptions to strict liability listed in § 311(i)(l). Rather, one must look to the reasons why Congress imposed strict liability as the general rule in order to determine what standard of care is required to qualify for the specific exceptions. As originally drafted, § 311 would have required the discharger to prove it was not negligent before it could recover the costs of cleaning up a spill. S.Rep. No. 351 at 4. This standard would have compelled operators to take all reasonable precautions before seeking to shift liability for a spill to the public treasury. In the final version of the legislation, Congress ultimately rejected the negligence standard in favor of a general rule of strict liability. The reason for the change was simply to avoid needless litigation costs. The Senate report explained: It should be noted that the insurance industry and the oil industry testified that they could not imagine a circumstance where a discharge of oil would occur without some degree of negligence. Therefore, it appears that negligent liability with a reverse burden of proof [i.e., burden upon the discharger] and absolute liability are similar in practical application. The practical advantage to absolute liability, of course, is that it would avoid litigation with the vessel owner on the question of responsibility. [Id. at 5]. Or, to put the analysis in terms of the Hand formula, strict liability was the preferable standard because its benefits (reduced litigation costs) outweighed the potential harm (the unfairness of imposing liability on a blameless party), discounted by the probability that the harm might occur (very slight).4 It logically follows, however, that the exceptions to strict liability in § 311(i)(l) identify those rare situations in which Congress determined that it was worthwhile to litigate on the issue of fault because there existed a more-than-negligible chance that a spill might occur without discharger negligence, i.e., because the spill was not reasonably within the operator’s control. Id. at 5-6. In those situations, Congress decided, the costs of strict liability — in terms of possible unfair burden on a blameless discharger — outweighed the benefits of reduced litigation. Thus, where the immediate cause of a spill is an act of God, an act of war, Government negligence or the act of a third party, it is worth the social cost to litigate the issue of whether or not the discharger was negligent in not taking reasonable precautions to prevent the discharge. In those instances, strict liability does not apply, but rather the discharger bears the burden of proof to show that it took all reasonable precautions.5 [409] Seen in this light, the structure of § 311 is similar to the doctrine of strict liability as it is actually applied in tort law. Essentially, strict liability embodies a recognition that certain types of accidents — such as ones involving abnormally dangerous activities or defective consumer products — rarely occur without some negligence on the part of the defendant. It therefore makes little social sense to litigate thousands of cases under a negligence standard when the outcome is foreordained in virtually every instance and problems of proof faced by plaintiffs may be daunting. See Pros-ser § 98 at 693. However, the law abhors an injustice, even an economically efficient one. Thus, courts have been reluctant to entirely abandon concepts of negligence or fault, even under a rule of strict liability. Rather, considerations of reasonableness reappear as defenses to strict liability to account for the unusual cases “at the margins” where there exists more than a minimal possibility that the defendant might be blameless. For instance, although strict liability is imposed for “abnormally dangerous activities”, Restatement (Second) of Torts § 519 at 34 (1977), the determination of whether an activity is abnormally dangerous requires, in the first instance, a negligence-oriented analysis of such factors as the risks of harm, the magnitude of the potential harm, the ability to eliminate the risk in the exercise of reasonable care, common industry practices, the appropriateness of the location of the activity, and the extent to which the benefits of the activity to the community outweigh the dangers. Id. § 520 at 36 (1977). Similarly, strict product liability is imposed only for “unreasonably dangerous” goods, id. § 402A at 352 (1965), so that issues of reasonableness resurface in the defenses of scientific unk-nowability and unavoidability. See Schwartz, The Vitality of Negligence and the Ethics of Strict Liability, 15 Ga.L.Rev. 963, 970-73 (1981). In the case of the Clean Water Act, those marginal situations are taken into account not through judge-made doctrine, but through the four exceptions specifically enumerated in § 311(i)(l). In determining whether any of these exceptions to strict liability apply in a particular case, it is perfectly logical to borrow the modern cost-benefit test for reasonable care from tort law. Nor does this approach conflict with case law in this circuit. Defendant relies heavily upon dictum in Reliance Insurance Co. v. United States, 230 Ct.Cl. 390, 677 F.2d 844 (1982), to the effect that Congress’ concern for protection of the environment demands a “very high” standard of care in handling oil and hazardous materials. Id. at 396, 677 F.2d at 848. In the Government’s view, this observation mandates a test for reasonable care that goes beyond “mere” cost-efficiency. But the “very high” standard in Reliance simply recognizes the fact that the potential harm from a discharge of oil and hazardous materials into the nation’s waterways is always very great. Hazardous material is by definition hazardous. Accordingly, the harm factor generally can be expected to tilt the cost-benefit balance in favor of a high duty of care. However, that does not mean that the court must put on blinders and ignore any other factors, such as a low risk of probability, that might mitigate in favor of the discharger. As Prosser states: “What is required is merely the conduct of the reasonable person of ordinary prudence under the circumstances, and the greater danger, or the greater responsibility, is merely one of the circumstances, demanding only an increased amount of care.” § 34 at 209. It would be both illogical and arbitrary to require exactly the same degree of care for all potential spills, regardless of the relative probability that they might occur or the costs of taking preventive measures. [410] Reasonable care is defined in terms of what a prudent person would do in light of all the circumstances, not just those that favor the Government. Finally, the Government’s proposed standard of higher-than-economically-rational care is simply unworkable from a practical standpoint. Defendant concedes that cost is at least relevant to determining the reasonableness of preventive measures, but offers no rational framework for incorporating costs into the analysis. In any situation, the human mind can always imagine some additional precaution — no matter how far-fetched — that might have been taken at some cost. With sufficient expenditure, for instance, railroads could be built underground like subways to prevent damage not only from vandals but from meteor showers and comets as well. No one, however, would consider such a preventive measure reasonable. The Government apparently would have the court distinguish between measures that are totally impractical and those that are merely impractical from a rational standpoint of costs and benefits. This, to be blunt, is nonsense. The question is not whether plaintiff here could have taken some additional precaution at some expense, but rather whether the railroad took reasonable preventive steps in light of all the circumstances. Those circumstances include the nature of the harm threatened by a release of hazardous material from a tank car, the likelihood that the harm might occur, the precautions already required under federal regulations governing railroad transportation (of which there are many), and the cost of additional precautions. That is the test which must govern this case. Adequacy of Precautions Taken In determining what precautionary measures are reasonably required to meet a given hazard, relevant governmental regulations and industry practices are a useful starting point. Travelers Indemnity, 230 Ct.Cl. at 869. In this case, the Government has promulgated no regulations specifically relevant to railroad transportation under § 311 of the Clean Water Act. However, detailed regulations controlling the transport of hazardous materials by rail have been promulgated by the DOT under the Hazardous Materials Transportation Act of 1974, 49 U.S.C. § 1801 et seq. (1982). See 49 C.F.R. 101 et seq. (1986). The Government contends that the DOT regulations are irrelevant to the standard of care required under the Clean Water Act because they were issued under a different statutory authority. This position is, frankly, bizarre. The express purpose of the Hazardous Materials Transportation Act is “to protect the Nation adequately against the risks to life and property which are inherent in the transportation of hazardous materials in commerce.” 49 U.S.C. § 1801. Obviously, achieving that goal would also further the objective of the Clean Water Act to “restore and maintain the chemical, physical, and biological integrity of the Nation’s waters.” 33 U.S.C. § 1251(a). It would be absurd to contend that a higher standard of care is necessary to protect the environment than to protect human life. Indeed, the lack of any regulations under the Clean Water Act governing railroad transportation implies a recognition that the DOT regulations address the same concerns. Furthermore, as the record here indicates, the regulations governing rail transportation are the product of decades of careful thought and experience. In a real sense, they represent the collective cost-benefit judgment of experts in both the Government and private industry. Such judgment is not to be lightly disregarded in determining what constitutes reasonable care. Thus, in the absence of any regulations applicable to rail transportation promulgated under the Clean Water Act itself,. compliance with the pertinent DOT regulations is a highly relevant factor in determining whether plaintiff exercised reasonable care in the shipment of hazardous materials. As noted earlier, DOT regulations require that the cap and plug on bottom-outlet tank cars carrying hazardous materials be tightened with a 36-inch Stillson wrench [411] before the cars are certified for transport. If this is done, the contents of the tank car cannot be released again without a comparable tool. Thus, a properly secured tank car would be essentially vandal-proof without additional precautions, at least with regard to the kind of casual vandal or mischief-maker who is likely to appear on the scene without a specialized tool. Therefore, leaving a properly secured tank car on a set-out track, even unattended overnight, would not appear to create unreasonable invitation to random vandalism.6 It follows, however, that the failure to properly tighten the cap and plug would breach the duty of reasonable care. See Total Petroleum Co. v. United States, 12 Cl.Ct. 178, 183 (1987) (failure to reasonably adhere to established safety procedures precludes recovery of clean-up costs for oil spill). If therefore the railroad had been responsible for tightening the plug and failed to do so, it could not be considered blameless if a vandalism-related spill resulted. What complicates the issue here is that DOT regulations place responsibility for tightening the cap and plug not on the railroad, but on the shipper who loads the cargo and tenders the car to the railroad.7 The railroad is required only to visually inspect for leaks. 49 C.F.R. §§ 174.8, 174.-9(a), 215.13(c). The uncontroverted evidence in the record establishes that plaintiff more than complied with its inspection duty. Plaintiff therefore argues that its compliance satisfies its duty of care. This argument is not without force, but the court finds it is inadequate to sustain a motion for summary judgment. Compliance with regulations intended to prevent the harm at issue may in some instances be conclusive evidence of reasonable care, but not where a party has reason to suspect the existence of special dangers or hazards. Prosser § 36 at 233. For instance, where a railroad is aware of special dangers of vandalism, such as during a strike, the reasonableness of its actions must be evaluated in terms of what extraordinary preventive measures, such as extra security patrols, were taken. See Union Petroleum, 228 Ct.Cl. at 74-75, 651 F.2d at 738. While there was nothing so dramatic as a strike to raise warning flags in this case, the railroad was aware of certain conditions that at least should have given it [412] pause to reevaluate the security of bottom-outlet tank cars left unattended on set-out tracks. Plaintiff’s evidence shows that visual inspection by railroad workers revealed 695 leaks — most of them very minor drips — during the three-year period prior to the Ukiah spill. The significance of this fact is that it suggests some failure on the part of shippers to perform their tightening duties properly, since in order for a leak to occur, the interior valve must be improperly seated and either the bottom-outlet cap or end plug must be loose or the gasket above the cap must be defective. More important, however, as noted earlier, a loose cap or plug will not necessarily be revealed by a visual inspection for leaks. This is so because a properly seated valve will prevent a leak even where the outlet cap or plug is almost ready to fall off. Therefore, a visual inspection for leaks (i.e., observing the cap and end plug) can only hint at the possible extent of the incidence of tank cars that are transported with loose caps or plugs. The full extent of the problem remains unknown. Thus, even though the number of reported leaks was small (695) compared with the number of carloads of hazardous materials carried during the same three-year period (about 300,000), the court cannot conclude on motion for summary judgment that the measures taken by the railroad were sufficient to address the risks involved. For visual inspection to be regarded as an adequate safety precaution it must be capable of detecting the potential leak no less than the actual. Cities Service, 742 F.2d at 628. That, however, is not the case: the full extent of the potential problem is unknown (and, according to the railroad, unknowable, because physical, as opposed to visual, inspection would have exposed railroad workers to unacceptable safety risks). Given this reality, a prudent party would have erred on the side of caution. Prudence therefore dictated that the railroad should at least have considered whether additional backup security measures might be advisable, if such measures were available at reasonable cost. In reaching this conclusion, the court is mindful that the chances were extremely remote that a casual vandal, such as Mr. Collins, would happen upon a loose cap or plug, crawl underneath the tank car and release its contents. The past experience of plaintiff and other railroads clearly establishes that vandalism of this nature is very rare, an event that can be expected to occur perhaps only once in several million tank-car movements. But to focus on the low probability alone, without taking cognizance of the enormity of the potential harm posed by the discharge of an entire carload of hazardous material into the environment would be to ignore half of the Hand equation. Where hazardous materials are involved, there is no “first bite” rule that exonerates a discharger solely because a particular calamity is unprecedented. As Prosser states: [I]f the risk is an appreciable one, and the possible consequences are serious, the question is not one of mathematical probability alone * * *. It may be highly improbable that lightning will strike at any given place or time; but the possibility is there, and it may require precautions for the protection of inflammables. As the gravity of the possible harm increases, the apparent likelihood of its occurrence need be correspondingly less to generate a duty of precaution. [Pros-ser § 31 at 171.] The same idea is found in the legislative history of § 311. In setting a very high ceiling on discharger liability to the United States for costs incurred when the Government must undertake clean-up measures, see 33 U.S.C. § 1321(f)(2) (fixing $50,000,-000 as a discharger’s liability ceiling), the Senate report made clear that operators were expected to look beyond past experience alone and plan against harms of unprecedented magnitude. The report noted that no previous oil spill into coastal waters had approached the liability limits set in the bill. “The committee, however, believes that the risk of such spills must be considered together with the possibility of major catastrophic discharges from onshore or offshore facilities or from drilling opera [413] tions.” S.Rep. No. 351 at 6; see also 115 Cong.Rec. 28,955 (1969) (remarks of Senator Muskie, the bill’s floor manager: “However, the risk of such spills and the possibility of major catastrophic discharges from onshore or offshore facilities or from oil-drilling operations must be considered.”). So too must spills of unprecedented magnitude be considered when taking precautions against vandalism. Precautionary measures going beyond those necessary to meet the risks commonly encountered are required when the potential harm is great and the preventive measure is not unduly burdensome from an economic standpoint. Where, as here, the hazard to society is great enough, preventive measures cannot be dictated solely by past experience, but must address the not-so-likely event, if its prevention can be obtained without extraordinary costs. In particular, an industry must keep abreast of innovations in safety techniques and use them where it is rational to do so.8 The question remains, however, to what extremes could plaintiff reasonably be expected to have gone in employing additional safeguards to protect against a rare and unexpected event? Possible Additional Precautions The Government has presented the court with a litany of additional precautions that it asserts the railroad could have pursued to avoid the spill that occurred. We find little merit in most of them. To start with, the Government argues that railroad workers could have double-checked the tightness of outlet caps and plugs with a 36-inch wrench at the various “Class A” inspection points, where cars receive a complete safety inspection. According to the uncontroverted evidence, however, constant retightening of caps would weaken the gaskets, thus causing new leaks. And because leaks represent a more serious spillage problem for railroads than vandalism, the safety costs of retightening caps would clearly outweigh any benefits. The Government next contends that railroad workers could have checked the tightness of caps and plugs by hand. Even if such a check would have resulted in some practical benefit, it would have required road crew workers to place themselves in a potentially dangerous position underneath tank cars of hazardous materials. Plaintiff’s evidence establishes that a typical train will carry various degrees of hazardous materials. Road crews are neither trained nor adequately equipped with protective clothing to conduct safe manual inspections. The court therefore concludes that manual checks would not be feasible in light of the potential safety hazard for railroad employees. Turning next to more substantial precautions, the Government argues that plaintiff could have installed fencing, hired security guards, built containment dikes on the set-out track or delivered the tank car directly to the Georgia-Pacific plant. Plaintiff’s uncontroverted evidence, however, establishes that even the cheapest of these measures — if rationally undertaken as part of a systemwide precautionary scheme — would cost more than $20 million a year to put into practice. Based upon plaintiff’s haulage figure of roughly 100,000 tank-car loadings of hazardous materials per year, the expense would come down to $200 per car per year. On the record before us, so large an expenditure — $200 per tank car of hazardous substance per year — would be totally without economic justification. To explain: According to the Government’s evidence,9 the highest estimate of [414] possible harm posed by a formaldehyde spill on the Russian River comes to approximately $93 million. (This was calculated by assuming a summertime spill of 21,000 gallons of formaldehyde at a location on the river where recreational activities are much more extensive than at Ukiah.) For present purposes, we shall assume the damages figure to be $100 million. In order for plaintiff to rationally conclude that $20 million per year represented a cost efficient expenditure, the evidence would have to show the likelihood of a $100 million vandal-caused spill at least once every five years. However, viewing the actual experience of plaintiff and other railroads in the light most favorable to the Government, it is impossible to say the odds are even remotely that great. As indicated earlier, plaintiff carries about 100,000 carloads of hazardous materials a year and had not experienced a vandal-caused spill in 40 years. Further, throughout the nation, the evidence indicates only two vandal-caused spills of hazardous substances between 1978 and 1983 —the one at Ukiah and one car of gasoline broken into by thieves.10 During that same time, almost 5 million carloads of hazardous materials were moved. Given this experience, the probability of a vandal-caused spill must be measured at least in the one-per-millions-of-carloads range. For a vandal-caused spill to occur on the Southern Pacific line once every five years, however, the odds would have to be in the range of one in 500,000. Therefore, the court can conclude as a matter of law that the precautionary measures listed above cannot be considered reasonable in light of a rational balancing of the harm, probability and cost factors. There is one possible preventive measure, however, that cannot be dismissed so quickly. The Government argues that high-security seals made of airline cable could have been used in place of the ribbon seal placed on the valve handle on tank car ACFX 84600. These seals are designed to be entry-resistant and require a set of 24-inch cable cutters to be quickly defeated. With such a seal in place, defendant contends, Mr. Collins would not have been able to free the valve handle to release the formaldehyde, at least not without considerable effort. Plaintiff notes that use of cable seals for cargoes like formaldehyde is not common practice in the railroad industry. While industry custom is certainly a factor in determining reasonableness, Travelers Indemnity, 230 Ct.Cl. at 869, it cannot be regarded as controlling. Prosser, § 33 at 194; see also The T.J. Hooper, 60 F.2d 737, 740 (2d Cir.1932) (Hand, J.), cert. denied sub nom., Eastern Transportation Co. v. Northern Barge Corp., 287 U.S. 662, 53 S.Ct. 220, 77 L.Ed. 571 (1932) (“there are precautions so imperative that even their universal disregard will not excuse their omission”). In fact, entry-resistant seals are “highly recommended”, though not required, by DOT regulations to prevent pilferage. 49 C.F.R. § 101-5.25(b). Furthermore, the affidavits of plaintiff’s experts in the railroad industry show that the group responsible for promulgating safety standards — the Bureau of Explosives of the American Railroad Association — has never evaluated cable seals as an anti-vandalism measure on a costs vs. benefits basis. Therefore, the court cannot say as a matter of law that such a risk-reducing alternative may simply be ignored without running the risk of breaching the duty to exercise reasonable care. In their submissions, the parties have raised numerous issues as to the effectiveness of the seals, the feasibility of their use without modification in railroad car designs, and the labor costs associated with [415] their use. These factual issues can be resolved only at trial. But in that connection, the court offers the following observations: There is one fact about cable seals that is not in dispute: they are intrinsically cheap, costing about $1.25 or less a piece, depending on the type of seal purchased. Assuming it is shown at trial that cable seals are technologically feasible to use and are reasonably entry-resistant in fact, and do not involve high installation costs, then the outcome of the case will depend upon a balancing of two imponderable factors: the magnitude of the potential harm and the likelihood of its occurrence. The first is obviously going to be large, certainly in the millions of dollars; the second is just as certainly going to be small, clearly in the once-in-the-millions range. As the parties’ supplementary submissions show all too well, neither factor is amenable to more than very rough estimation.11 Moreover, they have the potential for exactly balancing each other out. The parties would be well advised to bear that in mind in exercising responsible judgment as to the future course of this litigation. Pursuing litigation for the sake of principle makes sense where there is a principle worth pursuing; this case holds out no such benefit. CONCLUSION For the reasons stated, defendant’s motion for summary judgment is DENIED. Plaintiff’s cross-motion for summary judgment is GRANTED as to all of the preventive measures proposed by defendant save the cable seal. As to this last, there exist issues of fact the resolution of which must await further proceedings. Footnotes [1] In that episode, the tank car was being used as a temporary gasoline storage facility and was [406] not subject to the wrench-tightening requirements applicable to a tank car in transit. It is also unclear .whether that incident was the result of vandalism or a bungled theft attempt. [2] A tank car is a storage facility within the meaning of the statute. § 1321(a)(10), (11); see Union Petroleum Corp. v. United States, 228 Ct.Cl. 54, 68, 651 F.2d 734, 742 (1981). [3] Report of the Senate Committee on Public Works accompanying S. 7, the predecessor of the Federal Water Pollution Control Act Amendments of 1972 in which § 311 was added to the Act. [4] The Senate report does express concern that a standard of negligence, coupled with limitations on monetary liability, might produce an inadequate level of care because it would protect only private interests. S.Rep. No. 351 at 5. But there is no indication that Congress felt a standard of strict liability would produce a higher level of environmental protection than negligence as a general rule. Logically speaking, strict liability would be expected to produce exactly the same degree of care as ordinary negligence because, under either standard, an operator will take only those precautions whose benefits outweigh the expense, i.e., the cost of the precaution is less than the harm avoided. The only effect of strict liability would be to shift the economic burden for unpreventable spills from the public to the discharger. [5] See 115 Cong.Rec. 28,957 (1969) (remarks of Sen. Boggs: "It was the committee's belief that such exemptions have the effect of protecting the public in nearly every case, while safeguarding private interests at rare times of great disaster”); id. at 28,958 (remarks of Sen. Spong: "Our objective was to protect the taxpayers from [409] potential cleanup costs, without imposing liability in excess of reasonable risks”); IMCO Civil Liabilities Convention, 1970: Hearings Before the Subcommittee on Air and Water Pollution of the Senate Committee on Public Works, 91st Cong., 2d Sess. 13 (1970) (remarks of Sen. Muskie: vessel operator's negligent disregard of hurricane conditions would preclude recovery under "act of God” exception). [6] The reasonableness of relying on the design of a tank car to prevent vandalism was not addressed in the two prior cases involving discharges from railroad tank cars. In Proctor Wholesale Co. v. United States, a tank car had been converted to a permanent oil storage facility, and the decision made no mention of the tightness of the outlet mechanism. 215 Ct.Cl. 1049, 1051, 578 F.2d 1388 (1978). In Union Petroleum, the discharge occurred during a labor dispute and the case turned on whether the plaintiff took sufficient extraordinary precautions in light of the special dangers of vandalism resulting from the strike. 228 Ct.Cl. at 74-75, 651 F.2d at 738. In other cases, however, the security of valve mechanisms has played a key role in determining whether reasonable care was exercised to prevent vandalism. Compare Chicago, Milwaukee, 216 Ct.Cl. at 160, 575 F.2d at 842 (recovery allowed where valve handle protectively removed) with Anglo Fabrics Co. v. United States, 227 Ct.Cl. 604, 605 (1981) (no recovery where protection of valve inadequate); M/V Anna-Maria & Elena, Inc. v. United States, 14 Env’t Rep. Cas. (BNA) 1314, 1316 (Ct.Cl.), opinion adopted, 225 Ct.Cl. 535 (1980) (no recovery where “minimal step" of chaining or removing valve handles not taken); City of Pawtuckett v. United States, 211 Ct.Cl. 324, 326, 546 F.2d 430 (1976) (no recovery where spigots left unlocked); Travelers Insurance Co. v. United States, 2 Cl.Ct. 758, 762 (1983) (no recovery where handle left on valve); Minneapolis Park & Recreation Board v. United States, 18 Env’t Rep.Cas. (BNA), 1015, 1016 (Ct.Cl.), opinion adopted, 231 Ct.Cl. 738 (1982) (no recovery where valve handle not removed and vandals had previously broken padlock on door). [7] Although an operator may be held responsible for a surrogate’s negligent failure to perform its duties, United States v. Le Beouf Brothers Towing Co., 621 F.2d 787, 789-90 (5th Cir.1980), cert. denied, 452 U.S. 906, 101 S.Ct. 3031, 69 L.Ed.2d 406 (1982); St. Paul Fire & Marine Insurance Co., 4 Cl.Ct. at 768, plaintiff in this case cannot be held liable for any possible negligence on the part of Georgia-Pacific. As a common carrier, plaintiff had no choice but to accept a tank car properly certified as fit for transport, and it was not in a position to exercise any ultimate control over the shipper’s performance of its safety duties. This does not, of course, speak to the question whether Southern Pacific may have been negligent in its own right. [8] For this reason, the decisions of this circuit recognize that a low crime rate, by itself, is not sufficient to relieve an operator of responsibility for taking precautions against vandal-caused spills. Travelers Insurance, 2 Cl.Ct. at 758; Atlantic Richfield Co. v. United States, 1 Cl.Ct. at 263. As the Court of Claims has noted, "Obviously, things being unfortunately what they are today, vandals must always be expected.” Travelers Indemnity, 230 Ct.Cl. at 869. Therefore, doing "nothing whatsoever" to prevent vandalism is an inadequate response as a matter of law. Chicago, Milwaukee, 216 Ct.Cl. at 159, 575 F.2d at 841; Proctor Wholesale v. United States, 215 Ct.Cl. at 1051. [9] During the course of the oral argument, it became apparent that the record did not contain all of the data necessary to a rational decision of the case. In particular, what the court need [414] ed to know was the range of harm (in dollar terms) that could reasonably be associated with ■ a spill of formaldehyde into navigable waters and the likelihood or frequency of occurrence of such an event. Post-argument submissions addressing these issues have since been provided by the parties. This material, though demonstrating a wide divergence in views between the parties as to the correct estimated values, is, nevertheless, sufficient to disprove the cost efficiency {i.e., reasonableness) of most of the preventive measures for which the Government argues. [10] See footnote 1. [11] The post-argument submissions make clear that placing a value, even a very rough one, on the harm and probability factors cannot be done in a purely mathematical way. Because there is so little experience with vandalism-caused spills from railroad cars, much of the balancing will necessarily depend on subjective judgment. See generally Judgment Under Uncertainty: Heuristics and Biases 463-92 (D. Kahne-man, P. Slovic & A. Tversky, eds., 1982).