How to Kill a Mermaid: accountability after the worst day

On 1 November 2020, an eighteen-year-old called Linnea Mills drowned during a training dive in Lake McDonald, in Glacier National Park, Montana. She had been a certified open water diver for a few weeks and had made six dives in her life.

That day she was diving in a drysuit for the first time. The inflator hose wasn’t connected because the fitting on the hose didn’t match the one on the suit, and nobody noticed until the group was on the beach. She carried roughly 44 lbs of lead in pockets she couldn’t release, with a wing that could lift less than 30 lbs. The ditchable weight pockets weren’t available at the dive site. The site was remote and unpermitted. Underwater, the slope dropped almost straight down from a shallow ledge into deep water. The group entered the water about fifteen minutes before sunset. Two courses had been combined into one, and the person helping the instructor wasn’t certified to supervise students. There had been no pool session to introduce Linnea to the drysuit, and no workable emergency plan for a site that was an hour from a hospital.

None of this is in dispute. Every account of the event agrees on it, from the formal documents to the informal and social media narratives, including those written by people who disagree about other parts of the story.

A documentary about her death, How to Kill a Mermaid, screens publicly at DEMA in New Orleans in November. It brings together her parents, her brother, the students who were in the water with her, and the investigators who came afterwards. Earlier this year I had the chance to see the film at a private screening. I have also read the civil complaint her family filed and the rulings the Montana court issued, and I have drafted a journal article that looks at what those accounts show when you read them together through a system safety and human factors lens.

What they show is broad agreement about what happened and real disagreement about what it means and what we should do next. That disagreement plays out every time a diver dies, and it isn’t unique to diving.

Two very different questions

There are two broad ways a community can respond when someone is badly hurt.

The first asks which rule was broken, who broke it, and what they deserve. It works backwards from the harm to a person and is finished once a consequence has been handed out. Courts run on this logic, and so does most of what gets said online in the week after a fatality. The online version is often incomplete and poorly informed because the second story hasn’t been told yet. Research and practice both show that we fill in the gaps when we don’t have all the information.

The second asks who has been hurt, what they need, and whose job it is to meet that need. It works forwards. It is finished when the people affected have the truth, the harm has been addressed as far as it can be, and the conditions that produced it have changed. For that to happen we need the second story. That is the one that explains how and why it made sense for everyone in the system to act the way they did.

Safety researchers call these retributive and restorative justice. The terms are a bit clumsy, but the difference is useful because each one aims at a different target, and so each produces different results.

The documentary captures the collision between the two. Linnea’s family want to understand what happened to their daughter, to hear it acknowledged as true, and to find a way of carrying the loss. The investigators in the film, one a lawyer and the other a retired federal dive team leader, want a prosecution. I can understand both positions, but the only processes on offer were built to answer the investigators’ question rather than the family’s.

The strangest thing in the film is that the people pushing hardest for a prosecution are also the people who see the system most clearly. One of them, who has no sympathy at all for the instructor, says openly that she was a product of the system that trained and certified her. Another asks who taught the instructor, and who taught that person, and so on up the chain. So, the pull towards a single blameworthy person has little to do with intelligence or decency. If it can capture experienced people who understand systems well, it can capture any of us.

Blame often depends on whether someone dies

It sounds harsh, but it is the reality.

Imagine the same day with nothing changed: the unconnected suit, the 44 lbs of lead she couldn’t ditch, the combined class, the uncertified assistant, no pool session, no emergency plan, and the near-vertical wall in the dark. The only difference is that when Linnea starts to sink, somebody reaches her in time and brings her up.

In that version there’s no complaint, investigation or coroner, nobody calls for a prosecution, and nobody makes a film. Instead, there’s a shaken student and an instructor who tells herself it worked out in the end. There probably isn’t a debrief, so nobody learns anything. (Jenny Lord’s account of running out of gas with her students shows what that debrief looks like when it does happen.)

The system that produced the near miss is the same system that produced the death, with the same conditions in place. The only thing that changes is the outcome, and it’s the outcome that sets the blame process in motion.

This isn’t just about how people judge each other, because it’s also written into law. In England, the offence of gross negligence manslaughter requires a death, so, as an example, a clinician can be appallingly negligent, cause real harm, and face no criminal charge at all if the patient lives.

A response that only switches on when someone dies can’t see the conditions that killed them, because those same conditions were present on all the days when nobody died. In diving, where fatalities are rare and near misses are common, that blind spot obscures a huge opportunity to learn from emergent outcomes.

How blame gets built

If blame isn’t simply sitting in the evidence waiting to be found, where does it come from?

Part of the answer lies in how legal documents are structured. A civil complaint has to show that each person had a duty, broke it, and in doing so caused the harm, so every systemic condition has to be rewritten as an individual failure. The complaint in this case is good on the facts. It reaches further up into the training system than most incident reports do. But it then turns all of that into a list of things particular people should have done differently.

Part of it is how our minds work. When it’s easy to picture the action that would have prevented an outcome, the outcome feels more avoidable, and more responsibility attaches to whoever didn’t take that action. ‘She should have called the dive’ and ‘someone should have checked the weights’ are small acts of blame, and they come easily because we already know how the story ends. Language has the same effect. Studies of accident reports show that when a report is written in the vocabulary of wrongdoing, readers reach different conclusions and propose different fixes than when the same facts are written in the vocabulary of conditions.

Underneath both of these is the line between an acceptable action and a culpable one moves. Research on how organisations actually decide culpability found that it shifts depending on how bad the outcome was, who is doing the judging, and the story that has already formed. In other words, culpability is a judgement that people make, and it changes with the people making it.

Where the blame landed. Not just one place.

You can see that process at work in this case, and you can see where the blame settles: on whoever is closest and least able to push back. On the beach, Linnea was asked whether she was comfortable diving with the suit unconnected. That question handed the decision to the one person there who had no way of knowing what she was agreeing to. As one of the narrators in the documentary put it, it’s like telling someone who has never driven that the brakes are poor and asking whether they mind.

After she died, the same reflex showed up again, this time with greater consequences. The dive centre told the coroner she had panicked, which the recording and the physical evidence don’t support, and which for a time led to her death being recorded as accidental. The same source phoned the diver who had swum down to her, done everything a rescuer could do and still not been able to save her, and told him her death was his fault. A later account suggested the only person who could have saved her was the student who had been filming.

We can see that the blame moved from the student who died, to the rescuer, and then to the bystander, and each time it landed on a person and never on a condition.

You can read that as individuals covering their tracks, and some of it probably was. I think it’s more useful to read it as what an operation without psychological safety does under the pressure of a fatality and a pending lawsuit. If we treat it as a ‘bad person’ story, we move on quickly and then act surprised when the same thing happens somewhere else. When the same pattern keeps showing up in different places, it’s telling us about the system rather than about an individual diver or instructor.

Linnea was also wearing a dive computer that recorded the descent. It was removed from her body, and investigators were later told it was unreadable. Whatever the reason, the effect was to lose one of the best accounts of those few minutes. Unlike a witness statement, which is shaped by shock and hindsight, the computer had no stake in the outcome and nothing to protect. When people expect blame, they keep what they know to themselves. A learning culture gives them a reason to protect that information, because they can see it will be used to make things better. In this case the response did more than fail to produce learning. It removed the evidence that learning would have needed.

Counting everyone who was hurt

When a diver dies, we usually count one victim. Here there were many more.

The instructor didn’t intend any of this and will carry it for the rest of her life. The diver who reached Linnea did everything right, was physically injured in the attempted recovery, and was then told her death was his doing. A fourteen-year-old was asked to help recover a body. And then there is the family.

Healthcare calls these people second victims, a term that covers anyone, directly or indirectly involved, who is negatively affected. The research is consistent in what it finds: intrusive memories, guilt, anxiety and a lasting fear of getting it wrong again, along with a need for support that mostly goes unmet.

A retributive process can’t treat all of these people as harmed, because it has to sort them onto one of two sides, the guilty and the wronged, and then set them against each other.

What a grieving family ask for

There is a substantial body of research on what bereaved families want after a sudden death at work, and some of it surprises people.

Families do want wrongdoing named. But at least as strongly, they want a precise explanation of how and why their loved one died, and an assurance that something will change so the death wasn’t for nothing. Many report being badly let down by processes that were slow, opaque and narrowly focused on securing a conviction. Several studies record families asking for a mediated conversation with the organisations involved so that everyone can agree on what happened. Without ever using the term, these families are describing a restorative process.

The Mills family weren’t unusual, and they weren’t asking the wrong question. They were asking one that the available institutions weren’t built to answer. During the eight days of silence from the dive centre after Linnea died, and while the official record described her death incorrectly, they had to fight for the basic truth of what happened to their daughter before they could even begin to look for meaning in it.

Nobody's job

Almost all the research on restorative approaches has been done inside single organisations, such as hospitals, air forces and individual companies. These have someone who can convene a process, an employment relationship to work through, and usually a regulator setting expectations.

Recreational diving has none of that. Training is delivered by independent centres running on thin margins and certified against standards set by agencies. Those agencies earn money on the certifications their members issue while formally denying that those members work for them. There is no independent regulator, no mandatory reporting, and no confidential route by which the industry could learn from an event before the next one. Consequently, when a diver dies, no organisation has the job of asking who was hurt and what they need. The gap gets filled by civil litigation and, now and then, a criminal investigation. Both are built to find a defendant.

Months before Linnea died, another customer of the same dive centre had drowned after being rented gear without anyone checking his certification, and litigation from that death was already under way when Linnea signed up. The system had already received the most serious warning possible, and it had no way to act on it. Again, it required a serious trigger to provide a focus, but that focus was unlikely to look at the conditions, instead focusing on individuals and their behaviours/actions.

The ending that gave nobody anything

The court in Montana did something interesting. When asked whether the dive centre and instructor were agents of the certification agency, the judge held that the agency’s control over its members was substantial enough for a jury to decide. Read as a systems document, the ruling says that blame here can’t be pinned on one party just because that would be tidier. Once the ruling came out, the agency’s exposure rose sharply, and the case settled out of court.

A settlement closes off two things. There’s no public verdict, no account tested in court and usually no admission of liability, so there’s never a public reckoning. And importantly for learning, there’s also no shared inquiry and no findings the industry can read. A confidentiality clause often seals away whatever was learned, so nothing gets repaired either. The family received a resolution of their claim. Sadly, the system whose conditions led to the death got nothing it had to act on. Some minor changes were made to standards, but nothing that would materially change the underlying conditions and context.

Restorative justice/just culture asks more of people

When I make the case for restorative or forward-looking accountability, people often hear it as a plea for going easy on those involved. It is actually the opposite.

A restorative response gives the instructor, the dive centre and the agency no immunity at all. It asks them to sit in a room with the people they have harmed, give a full and honest account of what happened, hear what it did to those people, and take an active part in putting right what can be put right. That is a heavier duty than writing a cheque under a confidentiality clause and never speaking about it again. Many people who have been through it say it is harder than being punished.

What would actually change things

If we focus on the conditions instead of the individuals, four changes follow.

At the level of the dive, the confined water orientation before a first drysuit dive needs to be a hard stop and not a recommendation, and the pre-dive equipment check needs to be a supervised, witnessed step rather than an assumed one. Both were missing here. I think this is already in place, the issue is does it get checked. How does quality management deal with the inherent drift?

At the level of the dive centre and training agency, a quality management system has to bring problems to the surface instead of sitting on a website. The earlier death shows the warning signal was there. What was missing was the capacity or the motivation to act on it. Also recognising that fatalities are an obvious marker, but there are many other factors that contributed to this event and these needed to be looked for, not waiting for them to 'arrive'.

At the level of the agency, the standards that allow a specialty to run as an adventure dive far below a full course, the high-volume instructor pipeline, and the practice of issuing certifications after a fatality without a pause are all conditions the agency sets and can change. The control the Montana court identified is the lever for changing them. There are a number of training organisations that allow self-certification of instructor competencies or 'specialities' which don't fall under normal QM processes. If an instructor can self-certify to teach, how are the standards checked?

At the level of the activity as a whole, what’s missing is a well-resourced, confidential, non-punitive route for reporting and learning before the next death, rather than through litigation years afterwards. Real learning doesn’t need a serious injury or fatality to trigger it. Aviation and parts of healthcare have built this kind of system, but diving hasn’t. None of this is unique to us, either. Any high-risk sport that is sold commercially and governed only by membership bodies and the courts sits in the same gap. Given the number of certifications issued around the world, funding such a system shouldn’t be out of reach.

Meeting the need: the dive at the end

The film closes with Linnea’s brother learning to dive. He took his time and chose his instructors for how they taught as much as for what they knew. Three years after she died, he descended into Lake McDonald surrounded by the people who loved her and completed the dive she couldn’t.

To me, that is what accountability looks like. Nobody was punished and nobody needed to be a defendant. A family was helped to carry what had happened and to build some meaning out of the loss. What should give us pause is that they had to do it themselves, outside every formal channel, because the industry that trained and certified Linnea offered no route to it. Other sectors, including healthcare, aviation and US wildland firefighting, already provide that route.

Linnea trusted that system, as every new diver has to. The least the industry owes her, and the families who will otherwise follow, is to become a system that deserves that trust. That means putting in the barriers that were missing and, alongside them, building a way of responding to harm that helps people repair and learn from what happened using tools within the LFEO programmes.

How to Kill a Mermaid screens publicly at DEMA in New Orleans in November 2026. If you teach, run a centre or sit on a standards committee and are at DEMA, please watch it. Then ask what your organisation would actually do on its worst day, and who, if anyone, would see it as their job to ask the family what they need.