On April 20, 2010, the Deepwater Horizon drilling rig exploded in the Gulf of Mexico, killing eleven workers and triggering the largest marine oil spill in history. Internal BP emails, engineering reports, and congressional testimony reveal a pattern of cost-cutting decisions that eliminated critical safety tests, ignored worker concerns about equipment failures, and dismissed anomalous pressure readings in the hours before the blowout. This is the documentary record of how corporate decisions prioritizing speed and profit over safety produced an industrial disaster that released 4.9 million barrels of oil into the ocean over 87 days.
At 9:49 PM on April 20, 2010, natural gas from the Macondo well 13,000 feet below the Gulf of Mexico floor traveled up through a failed cement seal, through 5,000 feet of seawater, past a blowout preventer that did not activate, up the riser pipe, and onto the deck of the Deepwater Horizon drilling rig, where it found an ignition source and exploded. The blast killed eleven workers instantly. The rig burned for 36 hours before sinking. The well continued flowing for 87 days, releasing an estimated 4.9 million barrels of crude oil into the Gulf—the largest marine oil spill in history.
This was not an unforeseeable accident. It was the documented outcome of specific, traceable decisions made by identifiable people in the days and weeks before the explosion—decisions that prioritized cost and schedule over safety, that dismissed anomalous test results, and that ignored both engineering warnings and workers who raised concerns about equipment failures.
The documentary record is comprehensive. Congressional investigators obtained thousands of internal BP emails. The Coast Guard conducted seven months of hearings with 79 witnesses. A presidential commission reviewed 20,000 pages of documents. Senate committees subpoenaed engineering reports, risk assessments, and maintenance logs. What emerged was not a story of an accident, but of a system designed to permit exactly this outcome.
Six weeks before the explosion, BP completed an internal risk assessment of the Macondo well. The assessment, obtained by Senate investigators, categorized the project as presenting "high risk" for a blowout. This designation should have triggered enhanced oversight, additional safety protocols, and executive-level review. It triggered none of these. The Macondo well was drilled under the same procedures as any other BP project.
BP had acquired the drilling rights to Mississippi Canyon Block 252 in March 2008, paying $34 million in a federal lease sale. Seismic data suggested the reservoir contained approximately 50 million barrels of recoverable oil—a commercially significant find, but not extraordinary by Gulf of Mexico standards. Drilling began in October 2009 using the Marianas rig, but that rig was damaged in Hurricane Ida. The Deepwater Horizon took over in February 2010.
"The Macondo well was drilled in an area of high pressure and high temperature. The formation was known to be challenging. BP's own risk assessment identified this. The fact that no additional oversight was applied is itself evidence of systemic failure."
William K. Reilly, Co-Chair of National Commission — Testimony to Congress, November 2010By mid-April 2010, the project was 43 days behind schedule and $58 million over budget. BP's internal project status reports—submitted as evidence in Senate hearings—documented mounting financial pressure. Emails between BP engineers in Houston and well site leaders aboard the rig repeatedly referenced the need to "pick up the pace" and "make up lost time." One email dated April 14 stated: "We are getting BP'd in the process and it is costing $millions."
Senate investigators identified five specific decisions BP made in the week before the explosion, each of which increased risk to save time or money. These were not minor operational details. They were fundamental engineering choices about well design and testing protocols.
The casing design decision was particularly revealing. On April 15—five days before the explosion—BP engineers in Houston debated whether to use a single production casing string extending from the wellhead to the bottom of the well, or a liner with a tieback. The liner design provided two independent barriers to flow: if the cement at the bottom failed, the liner hanger at the top would still seal. The single-string design was faster to install and eliminated the need for additional equipment, but it meant the well depended entirely on the cement seal at the bottom.
BP engineer Brian Morel sent an email on April 16 stating: "We have the single string as our best economic case but it's not the safest option." Another engineer, Mark Hafle, wrote in response: "But who cares, it's done, end of story, will probably be fine and we'll get a good cement job."
Halliburton was responsible for designing and pumping the cement that would seal the bottom of the well. The company conducted laboratory tests of the cement formulation in February and April 2010. Both tests failed. The foam cement design BP had specified was unstable—it did not achieve the required compressive strength and was vulnerable to gas infiltration.
On April 18, two days before the explosion, Halliburton cement engineer Jesse Gagliano emailed colleagues stating: "The lab results indicate that the foam cement design is challenged to meet the project requirements." Gagliano's own analysis showed the design had less than a 50% probability of success. He recommended additional testing and possibly redesigning the cement slurry.
Halliburton did not share these test results with BP. Congressional investigators later obtained internal Halliburton emails showing engineers discussed the failed tests but decided not to delay the cement job or recommend against the design because "that is what the customer wanted." Halliburton proceeded with the cement job on April 19, pumping the same unstable formulation that had failed laboratory testing.
The next logical step would have been to verify the cement seal with a cement bond log—a diagnostic test using acoustic waves to measure cement integrity. BP well site leader John Guide approved skipping this test on April 15. The test would have cost approximately $128,000 and caused a 9 to 12-hour delay. It would have revealed that the cement seal had failed.
"If BP had run a cement bond log, we would have seen that the cement at the bottom of the well was not competent. We would have known the well was not sealed. The blowout would not have occurred."
Adam Bourgoyne, Petroleum Engineering Professor, Louisiana State University — Testimony to National Commission, November 2010At 5:00 PM on April 20—less than five hours before the explosion—the Deepwater Horizon crew conducted a negative pressure test to verify well integrity. The test works by reducing pressure on the well to simulate the condition after the heavy drilling mud has been displaced with lighter seawater. If the cement seal is intact, pressure should remain stable. If the seal has failed, hydrocarbons will flow into the wellbore and pressure will increase.
The test produced anomalous results. Pressure readings were inconsistent between different monitoring points. The drill pipe showed 1,400 psi when it should have shown zero. The kill line—an alternative flow path—showed zero pressure. These readings were contradictory and indicated either equipment failure or well control problems.
For 51 minutes, crew members and BP well site leaders debated what the readings meant. Transocean Offshore Installation Manager Jimmy Harrell testified he was awakened from sleep and came to the drill floor, where he found the test results "not conclusive" and recommended shutting in the well for further evaluation. BP well site leaders Donald Vidrine and Robert Kaluza were present. According to multiple witnesses, Vidrine proposed an alternative explanation: perhaps the pressure on the drill pipe was due to a phenomenon called "annular compression" where fluid trapped in the wellbore expands due to temperature changes. Under this theory, the kill line reading of zero was the "correct" reading, and the test was successful.
Harrell testified he objected but was overruled. As the rig's senior manager, Harrell had authority over Transocean employees and rig operations. But under the contractual structure of offshore drilling, BP—as the well operator and lease holder—had authority over all well-related decisions. Vidrine told the crew to proceed with displacing the mud from the riser.
Chief Electronics Technician Mike Williams, who survived the explosion, later testified: "I heard the argument. Mr. Harrell said the test didn't look right. The BP men said it was OK. BP is the one paying the bill. They make the decisions."
With the negative pressure test declared successful—despite readings that multiple witnesses later described as "confusing," "troubling," and "not normal"—the crew began the process of temporary abandonment. This involved displacing the heavy drilling mud in the riser pipe with seawater. The mud, at 14 pounds per gallon, exerted enough pressure to keep hydrocarbons in the formation even if the cement seal had failed. Seawater, at 8.6 pounds per gallon, exerted much less pressure. If the cement had failed, displacing the mud would allow gas to enter the wellbore.
At 8:52 PM, crew members noticed drilling mud flowing back onto the rig when it should not have been. This was the first unambiguous sign that gas was entering the wellbore from below. At 9:01 PM, pumps were shut down to investigate. At 9:08 PM, mud began flowing up through the center of the rig floor—a sign that a large volume of gas was rising through the riser. At 9:40 PM, crew members attempted to activate the blowout preventer. At 9:41 PM, witnesses on the bridge saw a column of mud and water shoot 240 feet above the rig floor. At 9:49 PM, the first explosion occurred.
Mike Williams testified about what happened next: "The lights went out. The rig lifted up. I knew instantly what had happened—we had a blowout. Gas had reached an ignition source and exploded. I heard the second explosion and ran. The whole rig was on fire."
The blowout preventer—a 450-ton, 48-foot-tall device sitting on the seafloor 5,000 feet below the rig—was designed for exactly this scenario. It contained multiple redundant sealing systems, including two blind shear rams capable of cutting through the drill pipe and sealing the well even with the pipe in place. The device should have activated automatically when the rig lost power. It did not.
Transocean maintenance records obtained by investigators showed recurring problems with the blowout preventer in the months before the explosion. In March 2010—one month before the disaster—a test of the emergency disconnect function failed. The crew reported the failure to supervisors. The rig continued drilling operations.
"The blowout preventer had a leak in the hydraulic system. It had a failed solenoid valve. The batteries in the emergency backup system were depleted and could not provide enough power to close the rams. The device was not properly maintained. When it was needed, it failed."
Det Norske Veritas — Forensic Examination Report, March 2011When the blowout preventer was recovered from the seafloor in September 2010 and subjected to forensic examination, investigators found multiple failures. One of the blind shear ram's control pods had a failed solenoid valve. The emergency backup batteries were depleted and unable to provide sufficient power. Most critically, when the shear rams did close, the drill pipe was not centered in the wellbore—it had been pushed off-center by the force of the rising gas. The rams cut into the pipe but did not fully seal it, leaving a gap approximately three inches wide through which oil continued to flow.
The Coast Guard received the first distress call at 9:53 PM. Helicopters and vessels were dispatched immediately. By the time rescuers arrived, 115 crew members had evacuated into life rafts or the water. Eleven were never found. The rig burned through the night and into the next day, collapsing and sinking on April 22.
BP initially estimated the well was leaking 1,000 barrels per day. Independent scientists using video footage and subsea measurements calculated the rate at 25,000 to 30,000 barrels per day in the first month—25 to 30 times BP's estimate. By the time the well was finally capped on July 15, an estimated 4.9 million barrels had been released—approximately 200 million gallons.
BP CEO Tony Hayward initially minimized the disaster, telling reporters that "the Gulf of Mexico is a very big ocean" and that "the amount of volume of oil and dispersant we are putting into it is tiny in relation to the total water volume." On May 30, while oil continued pouring into the Gulf, Hayward told reporters, "There's no one who wants this thing over more than I do. I'd like my life back." Eleven families were burying husbands, fathers, and sons.
The Coast Guard and Bureau of Ocean Energy Management launched a joint Marine Board investigation—the highest level of inquiry the Coast Guard conducts. The investigation held nine public hearings over seven months, heard testimony from 79 witnesses, and reviewed more than 20,000 pages of documents. The presidential commission held additional hearings and conducted its own investigation. Senate committees issued subpoenas and obtained internal communications from all three companies.
What emerged was evidence of systematic cost-cutting, ignored warnings, and a regulatory system that had been captured by the industry it was supposed to oversee. The Minerals Management Service—the Interior Department agency responsible for offshore drilling oversight—had approved BP's Macondo exploration plan in a single day with a categorical exclusion from environmental review. MMS employed only 55 inspectors to oversee approximately 3,000 offshore facilities in the Gulf. An Inspector General report found the agency had accepted gifts from oil company representatives and had approved departures from standard procedures that allowed companies like BP to use cheaper, faster designs.
"The blowout was not the product of a series of aberrational decisions made by rogue industry or government officials. It resulted from clear mistakes made in the first instance by BP, Halliburton, and Transocean, and by government officials who, relying too much on industry's assertions of the safety of their operations, failed to create and apply a program of regulatory oversight."
National Commission on the BP Deepwater Horizon Oil Spill — Final Report, January 2011In November 2012, BP pled guilty to 14 criminal charges including 11 counts of felony manslaughter, one count of felony obstruction of Congress, and violations of the Clean Water Act and Migratory Bird Treaty Act. The company agreed to pay $4 billion in criminal penalties—the largest criminal resolution in U.S. history at the time. BP later reached a civil settlement with the federal government and five Gulf states totaling $20.8 billion—the largest environmental penalty ever imposed.
Transocean pled guilty to violating the Clean Water Act and paid $1.4 billion in civil and criminal penalties. Halliburton pled guilty to destroying evidence—the company admitted it had deleted cement test results and computer simulations after the disaster—and paid $1.1 billion in settlements.
Only two individuals were charged with crimes related to the deaths: BP well site leaders Donald Vidrine and Robert Kaluza were indicted on 11 counts of manslaughter and one count of Clean Water Act violation. In 2015, a federal judge dismissed the manslaughter charges on the grounds that the government's legal theory of seaman's manslaughter did not apply. Vidrine later pled guilty to a misdemeanor Clean Water Act violation and received 10 months probation. Kaluza was acquitted at trial.
No executives were charged. BP's CEO Tony Hayward resigned in October 2010 with a severance package worth approximately $17 million and a pension valued at $930,000 annually.
The most damning evidence came from BP's own internal communications. An email from April 16, 2010—four days before the explosion—summarized the casing design debate. BP engineer Brian Morel wrote: "We have the single string as our best economic case but it's not the safest option." His colleague Mark Hafle responded: "But who cares, it's done, end of story, will probably be fine."
Another email, dated April 14, discussed the decision to use only six centralizers instead of the 21 recommended by Halliburton. BP engineer Brett Cocales wrote: "But, who cares, it's done, end of story, will probably be fine and we'll get a good cement job." The phrase "who cares" appeared in multiple emails obtained by investigators—a phrase that became emblematic of BP's approach to safety decisions.
Halliburton's internal communications were equally revealing. After the blowout, the company admitted it had conducted laboratory tests showing the cement design was likely to fail—but had not shared these results with BP or recommended against using the design. When congressional investigators asked why, a Halliburton executive testified: "That is what the customer wanted."
Deepwater Horizon was not BP's first deadly disaster. In March 2005, an explosion at BP's Texas City refinery killed 15 workers and injured 180. A subsequent investigation found BP had ignored known safety hazards and had failed to implement recommendations from previous safety audits. In 2006, corrosion in a BP pipeline in Prudhoe Bay, Alaska caused a 200,000-gallon oil spill. Investigators found BP had deferred maintenance and had ignored corrosion warnings to save money.
After Texas City, BP hired James Baker—former Secretary of State—to lead a safety review. The Baker Panel report, released in 2007, found that BP had "not provided effective process safety leadership" and that cost-cutting had "likely hindered" safety improvements. Tony Hayward, who became CEO that same year, promised to make safety BP's top priority. He launched a campaign with the slogan "Every accident is preventable." Three years later, the Deepwater Horizon exploded.
The Minerals Management Service—renamed the Bureau of Ocean Energy Management after the disaster—had functioned more as an industry partner than a regulator. The agency approved BP's Macondo exploration plan in one day despite the plan containing demonstrably false statements. BP's plan claimed the well location presented "no risk" for offshore oil spills affecting the coastline. It stated that in the "unlikely event" of an uncontrolled blowout, BP had "proven equipment and technology" to respond to a worst-case discharge of 162,000 barrels per day. The plan's oil spill response section included contact information for a marine biologist who had been dead for five years.
MMS approved it without question. The agency had not updated its blowout preventer testing requirements since 1988. It did not require acoustic triggers—emergency backup systems that were mandatory in Norway and Brazil. It allowed companies to write their own safety and environmental management plans with minimal oversight. An Inspector General investigation found MMS inspectors in the Gulf region had accepted meals, tickets to sporting events, and in some cases had engaged in sexual relationships with representatives of companies they regulated.
"MMS had been systematically captured by the oil and gas industry. The agency saw itself as facilitating energy production, not regulating it for safety. That regulatory failure made Deepwater Horizon possible."
Senator Jeff Bingaman — Senate Energy Committee Statement, November 2010The Deepwater Horizon disaster produced immediate regulatory changes. The Obama administration reorganized MMS into three separate agencies, imposed a six-month moratorium on deepwater drilling, and implemented new safety requirements including mandatory use of acoustic triggers and independent third-party certification of blowout preventers. Criminal penalties were increased. Offshore drilling oversight was centralized under the Bureau of Safety and Environmental Enforcement.
Whether these changes have fundamentally altered offshore drilling safety remains contested. Industry representatives argue the reforms have made drilling safer while environmental groups point to continued incidents and near-misses. What is not contested is that the disaster was preventable—that it resulted from identifiable decisions made by specific individuals who chose cost and schedule over safety, who dismissed warnings from their own engineers, and who proceeded despite test results that should have stopped work.
Eleven workers died because BP decided $7 million and seven days were too expensive. Four million barrels of oil poured into the Gulf because a cement seal that had failed laboratory testing was used anyway. A blowout preventer that had failed testing one month earlier was not repaired. A negative pressure test that produced contradictory readings was declared successful after 51 minutes of debate.
The documentary record is clear. This was not an accident. It was a crime.