Dam Safety as Public Trust

In Harrisburg, in the cabinet where the engineer’s memorandum still sat unread, the ASCE investigating committee’s 1891 report used language that did not equivocate. The South Fork Dam, the committee wrote, was “defective in construction and maintenance.” Its failure resulted from “gross negligence.” The committee traced the causal chain with engineering specificity: the crest had been lowered, the spillway narrowed, the discharge pipes removed. Each defect was measurable. Each had been knowable before the storm. The report named the engineering causes. It named no owners. It filed its findings and went home.

Two decades later, a Pennsylvania property owner put the opposite case in writing. A dam on his land had drawn an inspector’s attention. The owner’s letter to the state waterway commission argued that the dam was his. The water behind it was his. The state had no right to tell him how to maintain his own reservoir. The valley below was someone else’s problem.

The contrast was the subject. Engineers had reached consensus on what caused the South Fork Dam to fail. Property owners had not conceded that the consensus bound them. The space between the report and the letter was where the next twenty years of dam-safety policy would be fought.

Johnstown’s legal defeat had closed the courtroom door. Plaintiffs could not hold the South Fork Fishing and Hunting Club liable. The court held that the dam was not a nuisance but a reservoir, and reservoirs were lawful structures. If they failed, the owner might be negligent, but negligence had to be proven, and the negligent party had to be identifiable. The corporate form dispersed ownership. The members had not built the dam. They had bought it. They had not designed it. They had modified it. The modifications were performed by employees following instructions from officers who answered to members who were many. The chain of responsibility dissolved at each link.

The courtroom was built to find a defendant. The dam was maintained by a system. No single defendant embodied that system. The law could not reach the system itself. It exonerated the parts and let the whole go free.

That exonerated whole became the engineering profession’s subject. The ASCE committee had done what the court could not. It examined the dam as a system. It traced each link from the lowered crest to the narrowed spillway to the removed discharge pipes to the overtopping to the collapse. Each link was a maintenance decision. Each decision was made or approved by someone who never visited the site. The report carried a moral weight the court had refused to carry. The report said the dam was defective. It said the defects were known. It said the failure was foreseeable. The word “negligence” appeared. The word “culpable” did not. The engineering logic implied it.

The report entered the profession’s literature. Through the 1890s and 1900s, engineering textbooks cited the South Fork Dam. The citations were not memorial. They were technical. The dam illustrated principles: the importance of spillway capacity, the danger of lowering a crest without recalculating freeboard, the folly of removing discharge pipes from an earthfill embankment. Each citation taught the same lesson. The dam failed because its owners treated it as scenery, not as infrastructure.

The lesson traveled. Insurance companies that wrote policies on downstream properties began to ask questions. Did a dam sit above the insured asset? Who owned it? When was it last inspected? The questions appeared in underwriting manuals by the early 1900s. The manuals cited Johnstown. They did not cite it as a disaster. They cited it as a category of risk. A dam above a populated valley was not a private matter. The water did not stop at the property line.

The insurers were not reformers. They were capitalists. Their interest was actuarial. A broken dam destroyed downstream property. Destroyed property generated claims. Claims cost money. The insurer’s solution was information. If the dam was unsafe, the premium went up. If the dam was uninspectable, the policy was declined. The market began to do what the court had refused to do. It priced the risk.

But the market priced it for the downstream owner, not for the dam owner. The mill below the dam paid the higher premium. The club above the dam paid nothing. The risk was still allocated downward. The insurer’s question — is there a dam above you? — was a question the downstream owner could not answer by himself. He needed someone to inspect the dam. He needed someone with the authority to enter the property, measure the spillway, check the crest, and report. He needed the state.

The state’s authority was the problem. Pennsylvania’s common law gave property owners broad rights over their land. A dam was an improvement. It was not a nuisance unless it caused harm. It could not cause harm until it failed. The state could not inspect a dam before it failed, because the dam had not yet become a nuisance. The logic was circular. The law waited for the catastrophe. The catastrophe was the proof. The proof came too late.

The ASCE committee’s report broke the circle in one way. It established that the South Fork Dam’s defects were knowable before failure. The engineering analysis showed that the spillway was inadequate, the crest was too low, and the discharge pipes were gone. Each fact was measurable. Each was measurable before the storm. The report’s implicit argument was that inspection could have found these defects in time. The failure was a deferred-maintenance debt that came due.

The South Fork Club had not spent the money to maintain the dam properly. The cost of maintenance was real. The cost of failure was catastrophic. The difference between the two was the debt. The club paid the maintenance cost. The valley paid the failure cost. The court said the valley could not recover. The engineering profession said the valley should not have had to.

That position was the seed of the public-trust principle. It grew slowly. It grew through the professional literature. It grew through the insurance industry’s underwriting questions. It grew through the quiet work of state engineers who inspected dams when invited and noted their defects when asked.

It grew also through other failures. The South Fork Dam was not the last dam to break. The Austin Dam in Potter County, Pennsylvania, failed in September 1911. A concrete gravity dam, owned by the Bayless Pulp and Paper Company, it stood fifty feet high. It held a reservoir that supplied water to the company’s mill. The company built it in 1909. It failed in 1911. The break killed at least seventy-eight people. The flood destroyed the town of Austin.

The Austin Dam’s engineering was different from South Fork’s. It was concrete, not earthfill. Its failure mode was different. The foundation was inadequate. The concrete was thin. The spillway was undersized. But the institutional pattern was the same. A private company built a dam for its own industrial use. The dam was below the engineering standard of the time. No independent authority inspected it. The company’s engineer designed it. The company’s management approved it. The company’s workers built it. The company’s priorities governed every decision. The public downstream had no voice.

The Austin failure reinforced the Johnstown lesson. The two dams were separated by twenty-two years. The engineering was different. The ownership structure was the same. A private entity built a dam. The dam was inadequate. The inadequacy was knowable. No one with authority checked. The dam failed. People died.

The Austin Dam also went to court. The victims sued the Bayless Pulp and Paper Company. The company argued that the dam was built according to accepted engineering practice. The court rejected the argument. The jury found the company liable. The verdict was a break from the Johnstown pattern. The jury could see what the Johnstown jury could not. The Bayless company was a single entity. It owned the dam. It built the dam. It operated the dam. It profited from the dam. The chain of responsibility was short. The jury could hold it.

But the Austin verdict also showed the limits of the courtroom. The company was liable. The victims won. The company paid damages. Then the company went into receivership. The damages were partially paid. The families received fractions of their losses. The courtroom could assign blame. It could not prevent the next failure.

Prevention required inspection. Inspection required authority. Authority required law. The law required a legislature willing to say that a dam was not a purely private matter.

Pennsylvania’s legislature was not quick to say it. The state had a long tradition of deference to industrial property rights. Coal companies, steel companies, railroad companies — each operated with substantial autonomy. The state regulated mines for safety. It regulated railroads for rates. It did not regulate dams. Dams were improvements. Improvements were private property.

The South Fork and Austin failures tested that deference. Two dams in Pennsylvania. Two valleys destroyed. Two towns devastated. The legislature considered a dam safety act. The act would give the state engineer authority to inspect dams. It would require owners to maintain them to a standard. It would empower the state to order repairs. It would create a public record of dam conditions.

The act did not pass immediately. It was introduced, amended, delayed, opposed. The opposition came from property owners. It came from industrial companies that operated dams. It came from the Pennsylvania Railroad, which maintained dams and reservoirs for its own operations. The opposition argued that the act was an unconstitutional taking. It argued that inspection was a search without a warrant. It argued that the state engineer would be an unelected official with power over private property.

The opposition was not wholly wrong. The act would give an official power over private property. The power was the point. The South Fork Dam was private property. The water behind it was private property. The failure was a public catastrophe. The public catastrophe was the justification for the power. But the public catastrophe had to be connected to the private property. The connection was the engineering analysis. The analysis showed that the private property was dangerous. The danger was not speculative. It was measurable. The spillway was too small. The crest was too low. The pipes were gone. These were facts. The facts were the basis for the power.

The legislature eventually passed a dam safety act. The act gave the state waterway commission authority to inspect dams. It required owners to submit plans for new construction. It required owners to repair dams that the commission found unsafe. It gave the commission power to order the removal of dams that could not be made safe.

The act was not comprehensive. It applied to new dams and to dams that came to the commission’s attention. It did not require systematic inspection of every dam in the state. It did not create a registry. It did not mandate periodic inspection on a fixed schedule. It was a beginning. It was not a system.

The act’s limits were visible in its enforcement. The state waterway commission had a small staff. It had engineers. It had inspectors. It did not have enough of either. The inspectors visited dams when complaints were filed. They visited dams when downstream property owners requested inspections. They visited dams when newspapers reported problems. They did not visit dams on a schedule. They did not visit dams that no one complained about. The South Fork Dam had drawn no complaints before 1889. The residents had no way to know the dam was dangerous. They could not see the spillway. They could not measure the crest. They could not check the discharge pipes. They trusted the dam because it was there. It had always been there. Its presence was its warranty.

The warranty was false. The dam’s presence proved only that it had not yet failed. The engineering profession understood this. The insurance industry understood it. The state legislature, after Austin, understood it. The public did not. The public understood that a dam was a wall that held water. If the wall stood, the water held. If the wall broke, the water fell. The public’s understanding was not engineering. It was common sense. Common sense was the enemy of inspection. Common sense said the dam had held for years. It would hold for more years. Inspection said the dam had held because the conditions had not yet tested it. When the conditions tested it, it would fail.

The conditions that tested it were not extraordinary. The ASCE committee made this point in 1891. The storm of May 30–31, 1889, was large. It was not unprecedented. The rainfall was heavy. It was not a record. The dam failed because it was defective. The storm exposed the defects. The storm was the test. The dam was the subject.

This distinction — between the storm and the dam — was the foundation of the public-trust principle. If the storm caused the flood, the flood was an act of God. If the dam caused the flood, the flood was an act of man. The ASCE committee’s report placed the cause in the dam. The legal system’s exonerations placed the cause in the storm. The engineering profession’s literature placed the cause in the dam. The insurance industry’s underwriting placed the cause in the dam. The legislature’s eventual act placed the cause in the dam.

The public-trust principle followed from that placement. If the dam caused the flood, the dam’s owner was responsible. If the owner was responsible, the owner could be required to maintain the dam. If the owner could be required to maintain the dam, the state could inspect it. If the state could inspect it, the dam was not a purely private matter.

The logic was clean. The implementation was not.

The implementation required engineers who could inspect dams. It required a legal framework that authorized inspection. It required owners who complied with orders. It required a political system that funded the inspection program. Each requirement was a point of friction.

The engineers were available. The ASCE had members. The state engineering offices had staff. But the staff was small. The dams were many. Pennsylvania had hundreds of dams. Some were large. Some were small. Some were old canal reservoirs. Some were new industrial impoundments. Some were farm ponds. Each was a potential failure point. The inspection staff could not visit them all. It visited the ones it knew about. It did not know about all of them.

The legal framework existed after the act passed. But the act had limits. It gave the commission authority to inspect. It did not always give the commission authority to enforce. The commission could order repairs. If the owner refused, the commission could go to court. The court could enforce the order. But the court process was slow. The owner could appeal. The appeal could take months. The dam stood during the appeal. If the dam was dangerous, the danger persisted through the legal process.

The owners did not always comply. Some did. Some objected. Some ignored the commission’s letters. Some repaired their dams. Some did not. The ones who did not were the problem. The commission’s authority was only as strong as its enforcement. Its enforcement was only as fast as the courts. The courts were not fast.

The political system funded the inspection program at a level that allowed partial enforcement. Partial enforcement meant some dams were inspected. Some were ordered repaired. Some were repaired. Some were not. The ones that were not were the problem. The gap between the principle and the practice was where dams stood uninspected, unrepaired, and dangerous.

The South Fork case was the precedent. It was cited in the legislative debates. It was cited in the engineering literature. It was cited in the insurance manuals. It was cited in the state waterway commission’s reports. Each citation carried the same message. The dam failed because no one inspected it. No one inspected it because no one had the authority. No one had the authority because the law did not grant it. The law did not grant it because the dam was private property. The law changed because the dam failed. The dam failed because the law had not changed. The circle was the history.

The public-trust principle was the break in the circle. It said the dam was not only private property. It was a public hazard. The public had an interest in its condition. The public’s interest justified inspection. Inspection justified orders. Orders justified enforcement. Enforcement justified prevention. Prevention was the goal.

The goal was not fully reached. The principle was stated. The practice was partial. The gap between principle and practice was the space where dams stood uninspected, unrepaired, and dangerous.

The engineering profession’s role was to narrow the gap. The profession did this through standards. The ASCE published guidelines for dam design. The guidelines covered spillway capacity, freeboard, foundation treatment, and discharge systems. Each guideline had a lineage. The spillway capacity guideline traced to South Fork. The freeboard guideline traced to South Fork. The discharge system guideline traced to South Fork. The guidelines were the committee’s report translated into prescription. The report said what went wrong. The guidelines said how to avoid it.

The guidelines were voluntary. They carried the authority of the profession. They did not carry the authority of law. A dam owner could follow them or not. If he followed them, his dam was more likely to be safe. If he did not, his dam was more likely to fail. The likelihood was engineering. The consequence was legal. The legal consequence depended on the jurisdiction.

In Pennsylvania, the dam safety act gave the guidelines legal force. The state engineer could require a dam to meet the standard. If the dam did not meet the standard, the engineer could order repairs. The order was legal. The standard was professional. The two systems — law and engineering — were joined. The joining was the public-trust principle in operation.

The joining was imperfect. The state engineer’s authority was limited to dams that came to his attention. Dams that did not come to his attention were not inspected. Dams that were not inspected were not ordered repaired. Dams that were not ordered repaired remained as they were. Some were safe. Some were not. The ones that were not were the South Fork Dams of the future.

The absentee ledger was the other hidden subject. The South Fork Club’s members lived in Pittsburgh. The dam was in the mountains. The members did not see the dam. They did not visit the dam. They did not measure the spillway. They did not check the crest. They paid dues. The dues paid for the club’s operations. The club’s operations included the dam.

The dam was maintained by a caretaker. The caretaker was not an engineer. The caretaker was a groundskeeper. The members trusted the caretaker. The caretaker trusted the dam. The dam was not trustworthy.

The ledger was balanced. The members paid their dues. The club paid the caretaker. The caretaker maintained the grounds. The dam was part of the grounds. The dam was not maintained.

The ledger did not show the difference. The ledger showed dues in and expenses out. The dam was an expense. The expense was minimized. The minimization was the debt.

The debt was not on the ledger. The debt was in the dam. The dam paid the debt on May 31, 1889. The valley paid the debt after that.

The public-trust principle was an attempt to close the absentee ledger. If the state inspected the dam, the dam’s condition became a public record. The public record was a second ledger. It showed the dam’s condition. It showed the spillway width. It showed the crest height. It showed the discharge pipe status. It showed whether the dam was safe. The owner could not say the dam was fine. The record said otherwise. The record was the public’s ledger. The public’s ledger was the check on the owner’s ledger.

But the public’s ledger only existed if the inspection happened. The inspection only happened if the state knew about the dam. The state knew about the dam if someone told it. No one told the state about the South Fork Dam before 1889. No one told the state about many dams. The dams stood in the mountains. The state did not know they were there. The dams were on private property. The property was posted. The state had no inventory. The state had no registry. The state had no map of dams.

The absence of a registry was the structural limit of the public-trust principle. The principle said the public had an interest in every dam. The practice said the public could only act on the dams it knew about. The dams it did not know about were uninspected. The uninspected dams were the South Fork Dams of the future.

The professional societies understood this limit. The ASCE advocated for dam registries. The advocacy was slow. The registries required legislation. The legislation required political will. The political will required a constituency. The constituency was the public. The public did not know which dams threatened it. The public could not advocate for inspection of dams it did not know about. The circle was the same. The circle was the history.

The circle was breaking slowly. Each failure added pressure. Each pressure produced a response. Each response was partial. Each partial response narrowed the gap. The gap was where dams stood uninspected. The gap was where the next flood was being prepared.

The counter-argument had force. The storm was large. The dam was old. The owners were not engineers. They were businessmen who bought a reservoir for fishing. They did not build a dam for flood control. They did not design it. They modified it. The modifications seemed minor. They lowered the crest a few feet. They narrowed the spillway. They removed the pipes. Each modification was small. Each was within the owner’s rights. The cumulative effect was catastrophic. But the cumulative effect was not visible to the owners. The owners did not calculate the cumulative effect. The calculation was engineering. The owners were not engineers.

The counter-argument failed on the facts. The ASCE committee showed that the modifications were not minor. The lowering of the crest reduced freeboard. The narrowing of the spillway reduced discharge capacity. The removal of the pipes eliminated the only means of drawing down the reservoir in an emergency. Each modification was a reduction in the dam’s safety margin. The reductions were cumulative. The cumulative reduction was dangerous. The danger was measurable. The measurement was engineering. The owners did not make the measurement. But the measurement was available. Engineers existed. The owners did not hire them. The owners did not hire engineers because the owners did not see the dam as an engineering structure. They saw it as a lake. The lake was for fishing. The dam was the edge of the lake. The edge of the lake was scenery.

The scenery was the problem. The dam was not scenery. It was infrastructure. Infrastructure required maintenance. Maintenance required engineering. Engineering required inspection. Inspection required authority. The chain of requirements ran from the dam to the state. The chain was the public-trust principle.

The principle was a change in expectation. Before Johnstown, a dam was a private structure. After Johnstown, a dam was a public hazard. The change was slow. It was uneven. It was resisted. But it was real. The change was visible in the engineering literature. It was visible in the insurance manuals. It was visible in the state legislation. It was visible in the inspection programs. It was visible in the dam safety acts that other states adopted. Each state’s act was different. Each act had its own history. But each act traced to the same principle. A privately owned reservoir above a populated valley could no longer be treated as a purely private risk.

The principle had limits. The limits were the uninspected dams. The limits were the unenforced orders. The limits were the underfunded programs. The limits were the political resistance to regulation. The limits were the property owners who wrote letters saying the dam was their business. The limits were the courts that waited for catastrophe. The limits were the legislatures that passed acts and did not fund them.

The limits were visible in a specific case. In the 1920s, a Pennsylvania dam was found to be unsafe. The state waterway commission inspected it. The commission ordered repairs. The owner objected. The owner said the dam was on his property. The state had no right to order repairs. The owner appealed. The appeal went to court. The court process took months. The dam stood during the months. The dam was unsafe during the months. The repairs were delayed. The dam did not fail. But it could have. The gap between the order and the repair was the gap in which the public-trust principle failed. The principle said the dam was a public hazard. The practice said the public had to wait for the owner’s appeal. The waiting was the risk. The risk was the gap.

The dam stood. The order sat. The appeal waited. The rain had not come. The dam held.

The principle held. The gap held. The gap was the space between the principle and the practice. The gap was where the next flood was being prepared. The flood was being prepared by the same mechanism that had prepared the first one.

A dam was unsafe. The owner knew. The state knew. The public did not know. The repair was delayed.

The dam stood. The water rose behind it. The spillway was too small. The crest was too low. The dam held because the rain had not come.

The rain would come. The rain was weather. Weather was inevitable. The dam’s condition was not inevitable.

The dam’s condition was the result of maintenance deferred. The maintenance was deferred because the owner appealed. The appeal was the owner’s right. The right was the limit of the public-trust principle. The principle said the public had an interest in the dam. The right said the owner’s property interest was stronger. The conflict was not resolved. The conflict was the history.