All Sectors

The Fender Hook: KIBO and the Shortcut That Looks Like a Safe System

🕑 5 min read words Safety • Incident • Deck-operations

Vessel: KIBO (Private Pleasure Yacht, 73.94 m, 2,306 GT, Cayman Islands flag)
Date: 3 May 2015, 1057 local time
Location: At anchor, Portals Nous, Majorca, in calm conditions
Outcome: Deckhand fell into the water, suffered hypoxic brain injuries, and died on 7 June 2017
Human Factors: Normalised Shortcut · Permit That Existed But Failed · Supervision Gaps
Sources: Cayman Islands Shipping Registry report (January 2019); CHIRP Maritime report M2890 (1 October 2026)

Part of our ‘Plan. Permit. Stop.’ series on routine jobs that went wrong: KWK Legacy, Arvia and heavy weather at anchor.

Why We're Revisiting This Now

On 1 October 2026 CHIRP Maritime published report M2890. A photograph posted on a social media group showed a crew member working over the side of a yacht, straddling a fender connected to a fender hook while washing, with no harness, apparently relying on the hook alone and working alone. CHIRP pointed to the KIBO accident as a warning of exactly this arrangement, and called it a classic case of the normalisation of deviance. This article goes back to the primary investigation report.

What Happened

KIBO was at anchor off Majorca with the owner and guests aboard. As usual when guests were on board, the crew started early cleaning the exterior. The weather was fine, the sea was extremely calm and the atmosphere was relaxed. It was decided to use the morning to clean the stainless steel parts of the rub rails on the hull, about 3 metres above the waterline. A deckhand, who also worked as an assistant engineer, was chosen, under the supervision of the Third Officer and Chief Officer.

A permit to work was issued, signed by the Third Officer as Responsible Officer. It required safety shoes and a safety harness. It did not require a lifejacket or buoyancy aid. The deckhand's harness was attached by a rope with an ascender/descender to a fender hook on the bulwark. A fender hook is designed to hang inflatable fenders. It weighs 5.5 kg and holds on by the compression of a lambswool lining. The harness, bosun's chair, rope and fender hook were his sole means of support. No separate safety line was rigged.

At 1021 the Third Officer was called away to take guests ashore in the tender, with no formal handover of the Responsible Officer's duties. The Chief Officer checked on the deckhand several times and was satisfied he knew how to use the equipment. At 1050 the deckhand came back to deck level and moved the fender hook along the bulwark, working from outboard of the bulwark. Seven minutes later, at 1057, the Chief Officer returned and saw the fender hook come away from the bulwark with the deckhand still attached to it.

He fell into the water, still tied to a 5.5 kg hook, with a bucket of tools clipped to his harness. He swam slowly for a few seconds, then went under. He was recovered about 13 minutes after the fall. He had suffered severe hypoxic brain injuries from oxygen deprivation, and a small fracture near the eye that was most likely caused by the fender hook. He was left severely disabled and died on 7 June 2017.

What the Investigation Found

The report concluded the most likely cause was that the deckhand lost his footing while repositioning the fender hook on the bulwark, working alone from outboard of it. The hook itself was undamaged. The fall was serious for specific, preventable reasons:

No independent lifeline. The yacht's own Technical Manual required a separate lifeline in addition to the means of support. None was used, so nothing arrested the fall.
No lifejacket. The yacht's own procedures required an inflatable lifejacket, but the permit did not ask for one. None of the 16 over-the-side permits raised in the preceding period required a lifejacket or buoyancy aid. The investigators called this a systematic failure of the permit system.
Supervision below the standard required. The level of supervision was below what the Code of Safe Working Practices recommended and what the yacht's own risk assessment required. The deckhand was working out of sight below the bulwark. It was fortunate the Chief Officer saw the hook detach.
No handover. When the Third Officer left, there was no documented handover of the Responsible Officer's duties as required.
The lifebuoy was not thrown at once. Investigators concluded that had the lifebuoy near the worksite been deployed as soon as he fell, he would probably have stayed on the surface until recovered.
The permit form had little space for the workers to sign, which probably contributed to poor awareness that those doing the job should sign it too. The yacht's fixed pad eyes covered less than half of the length of the rail being cleaned.

The report also records that the ship's nurse took charge of the medical response and that her actions greatly improved his chances of survival. After the accident the yacht manager reviewed its procedures, retrained crew on working at height and over the side, and issued fleet circulars. The yacht code was revised to require overside working systems that give safe access to every part of a yacht where crew work. The report made no further recommendations.

The Mirror Image Of KWK Legacy

Read this alongside KWK Legacy. On KWK Legacy, the bosun went over the side without a permit and clipped to the equipment he was standing on. On KIBO, a permit did exist and an officer was supervising, and the same outcome nearly followed because of an equipment shortcut, a permit that missed the buoyancy requirement, and a supervisor who was called away. A permit is not a control. It is a record of whether the controls were thought through.

Where The Routine Job Broke — Stage By Stage

Both the 2015 report and the 2026 CHIRP photograph show the same routine job. Here is where the chain broke on KIBO and what would have caught it.

Stage	How it went wrong here	Preventive action
1. Plan the scope	Rub-rail cleaning was chosen as a good use of a calm morning. The yacht's fixed access points were not designed with this task in mind and covered less than half the rail.	Check whether the task has a designed access arrangement. If it doesn't, plan one before the job starts.
2. Test the risk assessment	The on-board risk assessment required a level of supervision that was not provided, and the Technical Manual required an independent lifeline that was not used.	Check the plan against the ship's own manual and risk assessment before the job starts, not after.
3. Set the permit trigger	A permit existed, but none of the 16 over-the-side permits required a lifejacket. The form gave little room for the workers to sign.	Audit permits for what they leave out. Require buoyancy and an independent lifeline on every over-the-side permit.
4. Brief and walk the site	The Responsible Officer left with no documented handover, and the deckhand worked out of sight below the bulwark.	Hand over formally when a supervisor leaves. Keep the worker in sight, or in constant communication, with rescue ready.
5. Stop work in the first second	The deckhand repositioned the 5.5 kg hook alone from outboard of the bulwark, the one moment it was not properly seated. Nobody was in position to stop it.	Reposition from inboard, with the lifeline attached. Treat any step that unseats the support as a stop point.

Human Element Analysis

Normalised Shortcut

A fender hook is a convenient, strong-looking fixing already on the bulwark, and an improvised method that works many times becomes the way the job is done. CHIRP's comment on the 2026 photograph is that an arrangement used successfully many times feels safe while the underlying risk is unchanged.

A Permit That Existed But Failed

Sixteen permits for over-the-side work had been raised and none required buoyancy. The system produced paperwork reliably and did not produce protection. This is why a permit system has to be audited for what is missing from it, not just whether it was signed.

Supervision Gaps

There was supervision on paper: a Third Officer and a Chief Officer, each checking in. But the Third Officer left, the handover did not happen, and for the critical moment the deckhand was working alone, out of sight.

Industry	Incident	The Parallel
Space	Space Shuttle Challenger, 1986	A known anomaly was accepted as normal because it had not yet caused a failure. This is the original case of normalisation of deviance — an improvised or degraded practice becoming standard until it fails.
Space	Space Shuttle Columbia, 2003	Repeated foam strikes were accepted as routine after each flight without consequence, until one was not. Past success was read as proof of safety.
Oil & Gas	Piper Alpha, North Sea, 1988	A permit-to-work system existed and was used, but a failure at the handover between shifts meant critical information about an isolation was lost — the same kind of handover gap as the Responsible Officer leaving KIBO's worksite.

Test Your Knowledge

Think you've got this covered? Put it to the test in Crew Connect's free Knowledge Checker — try a quick safety round and see how you score.