Aircraft safety is a matter of significant public importance, and the Federal Aviation Administration ("FAA") plays a central role in monitoring safety through its certification of commercial aircraft. At issue in this case is whether the United States is immune from liability under the Federal Tort Claims Act, 28 U.S.C. 2671-2680 (1994) ("FTCA"), for the FAA's alleged negligence in issuing aircraft certifications. GATX/Airlog Company ("Airlog") brought suit against the United States under the FTCA after the FAA issued a directive modifying the terms of two design certificates for converting passenger airplanes to cargo freighters. The district court dismissed Airlog's complaint for lack of subject matter jurisdiction under the discretionary function exception to the FTCA. See GATX/Airlog Co. v. United States, 79 F. Supp. 2d 1208, 1210-14 (W.D. Wash. 1999). We affirm.

Under the Federal Aviation Act of 1958, 49 U.S.C.S 40101 et seq. (1994 & Supp. IV 1998),1 the FAA is charged with promoting flight safety by establishing minimum standards for, among other things, aircraft design. See 49 U.S.C. 44701(a)(1) (Supp. IV 1998). Accordingly, the FAA has prescribed a comprehensive set of rules and regulations, including a multi-step certification process, for aircraft design and production. A detailed description of this certification process is set out in the Supreme Court's decision in United States v. S.A. Empresa de Viacao Aerea Rio Grandense (Varig Airlines), 467 U.S. 797, 804-07, 816-19 (1984). Three aspects of the design certification process are relevant here: the type certificate, supplemental type certificate, and airworthiness directive.

The first stage of this process is type certification, in which airplane manufacturers seek approval of new aircraft designs. Under federal regulations, aircraft manufacturers must analyze and test their new aircraft designs. See 14 C.F.R. 21.21(b), 21.33(b), 21.35 (2000). Based on the resulting engineering and test data, the FAA then determines the airworthiness of those designs. See 14 C.F.R.SS 21.21(b), 21.33 (2000). If the manufacturer demonstrates that the design complies with federal regulations, the FAA issues a type certificate. See 49 U.S.C. 44704(a) (1994); 14 C.F.R. 21.21(b). In most instances, the type certificate covers an aircraft model, rather than an individual airplane. See 49 U.S.C. 44704 (1994 & Supp. IV 1998).

Any major change to an FAA-approved design then requires additional certification in the form of a supplemental type certificate, also known as an STC. See 14 C.F.R. 21.113 (2000). By issuing an STC, the FAA approves a modification to a previously-certified aircraft design. See 49 U.S.C. 44704(b) (Supp. IV 1998). STCs are obtained through the same process as type certificates: the applicant must provide the FAA with sufficient engineering and test data to demonstrate compliance with federal regulations. See 14 C.F.R. 21.115 (2000); see also 14 C.F.R. 21.33(b).

After issuing a type certificate or STC, the FAA continues to monitor the safety of the certified aircraft. See 49 U.S.C. 44709(a) (1994); 14 C.F.R. 39.1 (2000). The FAA may amend, modify, suspend or revoke a certificate for airworthiness reasons. Such an order takes the form of an airworthiness directive and may require the aircraft owner to alter the aircraft to maintain its certification. See 49 U.S.C. 44709(b) (1994); 14 C.F.R. 21.99, 21.277, 39.11 (2000). After the FAA issues an airworthiness directive, the particular aircraft may only be operated in compliance with that directive. See 49 U.S.C. 44713(a) (1994); 14 C.F.R. 39.3 (2000).

B. The FAA's issuance of the STCs and an Airworthiness Directive

Airlog is in the business of converting passenger airplanes into cargo freighters. Airlog's predecessor entered into a contract with Hayes International Corporation ("Hayes"), an aeronautical engineering company, to design the cargo conversions for Boeing 747 passenger airplanes, and to obtain STCs from the FAA. Because Airlog did not have an engineering staff, it relied on Hayes for engineering expertise.

The approval process involved FAA offices in Seattle and Atlanta and took place over a several-year period. According to Airlog, an important part of this particular approval process was the selection of the engineering methodology that would generate the necessary compliance data, as the methodology would greatly affect the cost and schedule of the project. Two methods were considered: the "comparative" or "equivalent strength" method, and the "original loads" method.

Under the equivalent strength method, each component or section of the proposed modified aircraft is compared to similar components or sections of a previously-approved aircraft. In contrast, the original loads method does not involve component-by-component or section-by-section analysis. Rather, it requires the designer to determine what forces are actually applied to the airplane's structure under various flight scenarios ("external loads"); how those external loads are distributed within the structural elements of the airplane ("internal loads"); and whether the structure is strong enough to withstand the internal loads, within the margin of safety required by federal regulations. According to Airlog, the original loads method is more costly and time-consuming than the equivalent strength method.

Airlog claims that in 1986, the FAA determined that the equivalent strength method was acceptable from an engineering standpoint to assure that Hayes's conversion design complied with federal regulations. The FAA reaffirmed this conclusion in 1987 and 1988. In 1988, based on data provided by Hayes and generated by the equivalent strength method, the FAA issued Hayes two STCs, thereby approving its conversion design. Hayes, with the FAA's authorization, assigned the STCs to Airlog. Between 1988 and 1994, the certified design, which related to the cargo door and cargo compartment, was then used to convert ten Boeing 747 airplanes into cargo freighters.

Following conversion, the FAA received multiple reports that the converted airplanes were experiencing substantial-and potentially dangerous--in-flight problems. In one incident the pilot had to recover from a dive maneuver; in others, the airplanes suffered substantial structural damage. Consequently, the FAA reconsidered the conversion design and determined that its deficiencies required a reduction in the airplanes' maximum allowable payload. The FAA issued an airworthiness directive to this effect in 1996 in which it reduced the allowable payload by approximately 100,000 pounds. See Airworthiness Directives, 61 Fed. Reg. 116 (Jan. 3, 1996).

In the airworthiness directive, the FAA concluded that "[a]irplanes modified in accordance with all of the STC's . . . are unsafe, and the FAA approved these STC's in error." Id. at 117. Specifically, the FAA stated that "the ultimate strength of the main deck floor and . . . the surround structure of the main deck and side cargo door are inadequate. " Id. The FAA went on to note that because "there would be no warning prior to collapse of the main deck floor . . . the only immediate option . . . would be to reduce the weight of the cargo on the main deck." Id. The FAA also concluded that, as a result of the lack of reinforced fuselage near the side cargo door, "[i]n the worst case, the aft fuselage may collapse and separate from the airplane" without warning. Id. Finally, the FAA stated that in order to reinstate the full load capacity, additional data would have to be generated under the original loads method, rather than the equivalent strength method. See id. at 118. The equivalent strength method was insufficient because, as it turned out, the Hayes design was not sufficiently similar to the design that the FAA had previously approved. See id. at 116.

The practical effect of the airworthiness directive was that the cargo capacity of the converted airplanes was significantly reduced. As a result of the reduction in payload, owners of the converted airplanes brought suit against Airlog. Airlog then brought this action against the United States, claiming that the FAA had been negligent in approving the equivalent strength method, and in issuing STCs based on that method. The government moved to dismiss Airlog's complaint, arguing that the district court lacked subject matter jurisdiction, because the FAA's alleged conduct was protected by the discretionary function exception to the FTCA. The district court granted the government's motion. This appeal followed.

We review de novo a dismissal for lack of subject matter jurisdiction under the discretionary function exception. Gager v. United States, 149 F.3d 918, 920 (9th Cir.), cert. denied, 525 U.S. 966 (1998). In reviewing the district court's dismissal, we must accept as true the factual allegations in the complaint. See United States v. Gaubert, 499 U.S. 315, 327 (1991).

The Federal Tort Claims Act grants federal courts jurisdiction over damages claims against the United States "for injury or loss of property, or personal injury or death caused by the negligent or wrongful act or omission of any employee of the Government while acting within the scope of his office or employment." 28 U.S.C. 1346(b) (Supp. IV 1998). Under the FTCA, the government may be held liable for negligence "in the same manner and to the same extent as a private individual under like circumstances." 28 U.S.C. 2674. The government has not waived its immunity under the FTCA, however, for claims

based upon the exercise or performance or the failure to exercise or perform a discretionary function or duty on the part of a federal agency or an employee of the Government, whether or not the discretion involved be abused.

28 U.S.C. 2680(a). This "discretionary function" exception is designed to "prevent judicial `second-guessing' of legislative and administrative decisions grounded in social, economic, and political policy." Gaubert, 499 U.S. at 323 (quoting Varig Airlines, 467 U.S. at 814). Where the exception applies, the court lacks subject matter jurisdiction. Reed v. United States Dep't of the Interior, 231 F.3d 501, 504 (9th Cir.2000); Vickers v. United States, 228 F.3d 944, 949 (9th Cir. 2000).

In Berkovitz v. United States , 486 U.S. 531, 536 (1988), the Supreme Court laid out a two-part test that governs application of the discretionary function exception. First, for the exception to apply, the challenged conduct must be discretionary--that is, it must involve an element of judgment or choice. This requirement is not satisfied--and the suit may therefore proceed--where a "federal statute, regulation, or policy specifically prescribes a course of action for an employee to follow," because "[i]n this event, the employee has no rightful option but to adhere to the directive." Id. In short, where alleged conduct violates a mandatory directive, it is not discretionary. Gaubert, 499 U.S. at 324; In re Glacier Bay United Cook Inlet Drift Ass'n v. Trinidad Corp. , 71 F.3d 1447, 1452 (9th Cir. 1995). Thus, discretion is the benchmark of this self-referential prong of the discretionary function test.

If the conduct does involve choice or discretion, the court must then "determine whether that judgment is of the kind that the discretionary function exception was designed to shield." Berkovitz, 486 U.S. at 536. The focus is on "the nature of the actions taken and on whether they are susceptible to policy analysis." Gaubert, 499 U.S. at 325. The decision " `need not actually be grounded in policy considerations' so long as it is, `by its nature, susceptible to a policy analysis.' " Nurse v. United States, 226 F.3d 996, 1001 (9th Cir. 2000) (quoting Miller v. United States, 163 F.3d 591, 593 (9th Cir. 1998)). When a statute or regulationallows a federal employee to act with discretion,"it must be presumed that the agent's acts are grounded in policy when exercising that discretion." Gaubert, 499 U.S. at 324.

Whether a challenged action falls within the discretionary function exception requires a particularized analysis of the specific agency action challenged. See Glacier Bay, 71 F.3d at 1451, 1455. The government bears the burden of proving that the discretionary function exception applies. Reed, 231 F.3d at 504.

A. The FAA's conduct here was discretionary.

Under the first prong of the Berkovitz test, the FAA's conduct was discretionary, as no federal statute, regulation, or policy prescribes a specific course of action for the FAA to follow when issuing STCs.2 The FAA receives information from aircraft manufacturers, who are responsible for conducting inspections and tests necessary to demonstrate that proposed design modifications comply with federal regulations. See 14 C.F.R. 21.115; see also 14 C.F.R. 21.33(b). Based on that data, the FAA exercises its discretion to determine whether to issue an STC.

Airlog argues that FAA Order 8110.4 eliminates the FAA's discretion in the STC process. Airlog points to no other statute, regulation or order as the basis for its challenge. Section three of FAA Order 8110.4 governs STCs and provides, in relevant part:

A supplemental type certificate will be issued only if the pertinent technical data have been examined and found satisfactory, all necessary tests and com pliance inspections have been satisfactorily com pleted and the modification has been found to conform with the technical data.

(Emphasis added.) According to Airlog, under this regulation, the FAA had no discretion to issue STCs based on the equivalent strength method, because that method did not generate "pertinent technical data."

Airlog's argument is misplaced, as FAA Order 8110.4 does not "specifically prescribe[ ] a course of action for an employee to follow" when deciding whether to issue an STC. Berkovitz, 486 U.S. at 536. Even the question of what constitutes "pertinent technical data" necessarily involves a judgment call. The order does not dictate the nature or extent of the data, nor does it mandate any particular method of analysis. To argue, as Airlog does, that the FAA violated its mandate on "pertinent technical data" because it reviewed data generated by the equivalent strength method simply begs the question. The FAA was under no mandate to examine a specific type of data, nor to benchmark the data against any particular standard.

Airlog attempts to circumvent the FAA's discretionary decision by claiming that the FAA's approval under the equivalent strength method was akin to using an incorrect mathematical formula, and thus did not involve an element of choice. This argument assumes that the FAA faced a simple binary decision at the outset--whether the equivalent strength method or the original loads method applied--and that the decision would then dictate the outcome of the safety analysis. The argument fails for several reasons: (1) the ultimate decision of what data to submit rested with the manufacturer, Hayes, not the FAA; (2) it was Hayes's responsibility, not the FAA's, to ensure that the proposed design complied with federal airworthiness standards; and (3) the FAA engineers were of differing views regarding which engineering method was appropriate. Indeed, FAA engineers came to different conclusions about whether the Hayes design was sufficiently similar to the previously-approved design and, therefore, whether the equivalent strength method would generate the data needed to show compliance with federal regulations. The decisions toissue the STCs and the subsequent airworthiness directive were based on a series of judgment calls that cannot be collapsed into a directive, or a mandatory course of action.

In short, although the FAA must examine "pertinent technical data" before issuing an STC, the FAA has discretion to determine what constitutes "pertinent technical data" and whether to issue an STC.3 Because the FAA's conduct involved judgment or choice, the government has satisfied the first prong of the Berkovitz test.

B. The FAA's conduct is susceptible to policy analysis.

The government also meets its burden under the second prong of the Berkovitz test: the FAA's conduct is susceptible to policy analysis. As a starting point, we turn to the presumption articulated by the Supreme Court in Gaubert : "When established governmental policy . . . allows a Government agent to exercise discretion, it must be presumed that the agent's acts are grounded in policy when exercising that discretion." Gaubert, 499 U.S. at 324. We conclude that Airlog has not overcome this presumption.

Airlog challenges the FAA's conduct in connection with its responsibility to establish and enforce federal air safety regulations--specifically, the FAA's decisions to issue the STCs and, thereafter, an airworthiness directive that amended the conditions of those STCs. See 49 U.S.C.SS 44701(a), 44704(b), 44709(b). Our analysis therefore fits squarely within that of the Supreme Court in Varig Airlines.

In Varig Airlines, the Court held that the discretionary function exception protected the government from liability for the FAA's alleged negligence in connection with its issuance of a type certificate and an STC. 467 U.S. at 819-20. After the crash of two commercial airplanes, the plaintiffs brought suit against the government under the FTCA, arguing that the FAA and its predecessor, the Civil Aeronautics Agency, were negligent in certifying the airplanes because the airplanes did not comply with safety regulations. Id. at 814. The government argued that the responsibility for satisfying air safety standards rests with the manufacturer, not with the FAA. Id. at 815. The role of the FAA, according to the government, is merely to police the conduct of private individuals by monitoring their compliance with federal regulations, which it does through a "spot-check" program. Id. The government argued that such regulatory activity is the sort of conduct protected by the discretionary function exception. Id.

The Court agreed with the government and held that the discretionary function exception shielded the FAA from liability. Id. at 815-16. The Court noted that "the duty to ensure that an aircraft conforms to FAA safety regulations lies with the manufacturer . . . , while the FAA retains the responsibility for policing compliance." Id. at 816. Recognizing that only a "relatively small number of engineers" is available to evaluate data submitted by applicants for compliance with air safety regulations, id. at 818, the Court concluded that the FAA's decision to use a spot-check system was an exercise of discretion based on policy considerations:

When an agency determines the extent to which it will supervise the safety procedures of private individuals, it is exercising discretionary regulatory authority of the most basic kind. Decisions as to the manner of enforcing regulations directly affect the feasibility and practicality of the Government's regulatory program; such decisions require the agency to establish priorities for the accomplishment of its pol icy objectives by balancing the objectives sought to be obtained against such practical considerations as staffing and funding. Here the FAA has determined that a program of "spot-checking" manufacturers' compliance with minimum safety standards best accommodates the goals of air transportation safety and the reality of finite agency resources.

Id. at 819-20. Judicial intervention under these circumstances was "precisely th[e] sort of judicial intervention in policymaking that the discretionary function exception was designed to prevent." Id. at 820. Therefore, both the decision to use a "spot-check" system and decisions not to check certain items during inspections were protected by the discretionary function exception. Id.

Following the Supreme Court's lead, we have held that the FAA's role in the safety and certification process requires policy analysis. In Natural Gas Pipeline Co. v. United States, 742 F.2d 502 (9th Cir. 1984), we addressed alleged FAA negligence in connection with aircraft certification. In that case, aircraft owners claimed that the FAA had negligently issued an STC and other approvals. See id. at 503. In a sequence of events that is strikingly similar to the circumstances here, the FAA issued an STC, later discovered safety defects in the modified aircraft, and ultimately issued an airworthiness directive that led the modified aircraft to be grounded. See id. at 503-04. The suit was barred by the discretionary function exception. See id. at 504-05.

Two years later, in Proctor v. United States, 781 F.2d 752, 754 (9th Cir. 1986), we affirmed dismissal of a suit alleging negligent inspection of a cargo compartment in the aircraft certification process. We emphasized that "[a]lthough Varig involved an alleged negligent failure to inspect, the Supreme Court wrote broadly in concluding that `the discretionary function exception precludes a tort action based on the conduct of the FAA in certificating . . . aircraft for use in commercial aviation.' " Id. at 753 (quoting Varig Airlines, 467 U.S. at 815-16).

Finally, in West v. FAA, 830 F.2d 1044, 1048-49 (9th Cir. 1987), we held that the FAA's adoption of airport departure procedures fell within the discretionary function exception and that its "judgment in deciding what tests were necessary to meet reasonable safety requirements . . . require[s] a balancing of social and economic interests and a tailoring of safety requirements to local conditions." In so holding, we noted that "[d]etermination of safety requirements involves a balancing of social, economic or political policies " and that "when Congress leaves the establishment and enforcement of safety standards to an agency, it intends an exercise of that discretion to fall within the discretionary function exception." Id. at 1047-48 (citing Cunningham v. United States, 786 F.2d 1445, 1447 (9th Cir. 1986)); accord Colorado Flying Acad., Inc. v. United States, 724 F.2d 871, 876-77 (10th Cir. 1984) (holding that terminal control area design was left to the discretion of the FAA designer and that "[c]ompeting interests were weighed and then policy decisions were made which the [discretionary function] exception was intended to cover").

Sidestepping these cases, Airlog argues that the FAA's actions are not susceptible to policy analysis because they were based on objective scientific standards. See Glacier Bay, 71 F.3d at 1453-54 (holding that "scientific hydrographic judgment" and "purely scientific considerations" do not involve policy considerations and are not protected by the discretionary function exception); Kennewick Irrigation Dist. v. United States, 880 F.2d 1018, 1031 (9th Cir. 1989) (holding that the decision not to remove materials during canal con-struction "was based not on policy judgments but on technical, scientific, engineering considerations" and, thus, is not susceptible to policy considerations); see also Arizona Maint. Co. v. United States, 864 F.2d 1497, 1504 (9th Cir. 1989) (holding that the decision regarding the amount of dynamite that would be safe under the circumstances was "governed by objective standards which the government must use due care in following" and is not susceptible to policy analysis).

The cases cited by Airlog do not involve the type of policy judgments at issue here or in Varig Airlines. Simply because technical data is at issue does not mean that the decisions are stripped of their policy implications. The decision as to how comparable or identical a modification must be in order to meet an acceptable safety margin implicates a fundamental regulatory and policy function of the FAA. Any exercise of engineering judgment in connection with the FAA's decision to give Hayes the option to use the equivalent strength method was part and parcel of the FAA's issuance of the STCs, which is protected by the discretionary function exception.

Here, the FAA exercised its authority to oversee compliance with federal safety regulations. Its decisions regarding the nature of the data appropriate to demonstrate compliance with federal regulations, the extent to which it would review data provided by Hayes, issuance of the STCs, and issuance of the airworthiness directive are susceptible to policy analysis. Indeed, a careful review of the airworthiness directive, which is the action that sparked this controversy, reveals that the FAA weighed a variety of concerns, including safety, and considered a number of alternatives in formulating an emergency solution to a critical safety problem. See 61 Fed. Reg. at 117-18. For example, the FAA considered structural modifications and "considered imposing altitude, airspeed, center of gravity, and payload limitations." Id. at 118. But, ultimately, the FAA determined that none of these options, except the payload reduction, would restore safety to the airplanes. See id. The FAA candidly stated that "the operational limitations imposed by this [airworthiness directive] may severely impact the economic viability of the operators of these modified airplanes." Id. at 119. But the bottom line was clear:

[T]he FAA must impose these restrictions to ensure continued operational safety of these airplanes.

The FAA further acknowledges that these restrictions may be conservative. However, an alternative solution to this complex matter--one which will ensure the safety of these airplanes and the flight crews--has not yet been developed.

Id.

The policy judgments embodied in the FAA's airworthiness directive are precisely the type of policy decisions protected by the discretionary function exception. To allow Airlog's suit to proceed would result in second-guessing those judgments. From a practical and policy standpoint, Airlog's position would lead to absurd results. Although the FAA is charged with overseeing air safety, it would be paralyzed by the prospect that it could be held liable for making safety judgments and modifying its prior certifications. And the notion that the FAA could be held liable for a policy judgment that would save lives--such as the issuance of an airworthiness directive--is antithetical to the discretionary function exception. We conclude the FAA's conduct satisfies the second prong of the Berkovitz test and is protected by the exception.

The district court properly dismissed this case for lack of subject matter jurisdiction. The FAA's conduct in issuing the supplemental type certificates and its subsequent action modifying the terms of those certificates through issuance of the airworthiness directive is protected by the discretionary function exception to the Federal Torts Claims Act.4

AFFIRMED.