Here is the unspoken truth about the crash of Germanwings Flight 9525 last week: it demonstrates the most difficult choices in risk management that businesses, policymakers, and society ever have to make.

In fact, the crash itself is not the problem confronting us; the crash and its awful loss of 150 lives are merely the consequence of the problem. The real problem is how we handle people like Andreas Lubitz, the troubled co-pilot who deliberately crashed the plane and killed all those people—how we identify and handle human beings who might potentially cause enormous damage to other innocent lives.

With every passing day, more details come out that paint Lubitz as a pitiable man, suffering from depression and hiding that illness so he would not suffer the usual stigmas: loss of job, loss of friends, loss of respect, loss of social contact. You almost can’t blame him, because the truth is that he should have lost his job, at least on a temporary basis. Hiding his illness was an act of self-preservation—a misguided and selfish act with horrific results, to be sure, but the man was suffering from a mental illness. Irrational behavior comes with that territory. Anger at him won’t bring back his 149 victims.

The more difficult, but more important, questions to ask are about the others who knew of Lubitz’s problems or could have known had they pushed harder for answers. His doctors knew he might be a risk. Germanwings and Lufthansa could have known, had they imposed more demanding standards of disclosure about their pilots. Every medical and social worker (in the United States, at least) knows that a patient’s personal health information is private unless he might reasonably “pose a danger to himself or to others.” Lubitz did.

Here’s the risk management trap, however: We only say that about Lubitz in hindsight. In our increasingly inter-dependent world, how can we answer that question in advance without making our world a more and more miserable place to live?

Think about it: Should employers be allowed to ask intrusive questions about your behavior? Should they be allowed to verify your claims without your consent? Should they be allowed to fire or suspend you simply because your flaws might potentially cause severe problems someday?

I suspect most people would answer those questions with a distasteful yes. None of us would want to be Lubitz in that scenario, enduring the intrusion—but we would want to be the passengers on Flight 9525 even less. So we would permit that level of scrutiny if necessary. We would dislike it, live with it, and wonder what new intrusion will come next.

We’ve already seen some of the basic compliance responses you would expect here. More European airlines are changing policy to require two pilots in the cockpit at all times. (The United States requires that already.) We will hear more discussion about what types of information about pilots should be disclosed to airline executives or other authorities. We may have some introspection among some in Europe about whether the high value placed on privacy is worth the remote chance of tragedy, which is what happened here. Many people might not even realize they are debating risk management and difficult choices it can entail—but that is what they will be taking about, make no mistake.

Still, I also can’t help but notice: If you replace the word “your” with “third party” in those above questions about how intrusive we want to be, and then ask them again—this wouldn’t even be a conversation. Of course you can ask intrusive questions about your third parties, we would all say. Of course you can audit their claims. Of course you can dismiss them if they refuse to be honest, or because you simply think the risk that a third party might commit some misconduct someday  is not worth your bother.

Lubitz simply puts a harrowing human dimension to questions that the compliance community asks and answers every day in a more abstract, business-as-usual fashion. He forces us to confront some very unpalatable choices as our world moves forward into its future, and we’ll need to make those choices somehow.