What impressed me while reading Wohlstetter’s passages above was not only that he had directed attention to the ambiguity of warning, he had also pointed to the cognitive and behavioral effects of this ambiguity. It would inevitably delay responses by the various command levels (as it should) and by the president himself. In the era of missiles, a delay of minutes could mean the destruction of a retaliatory capability, along with the commanders. But what were the president or lower levels of command to do, on the basis that “perhaps” an attack was on the way, or even on 99.9 percent certainty from a computer program that might possibly be overwrought?
Wohlstetter had successfully proposed a way of increasing the survivability of alert bombers on the basis of ambiguous or equivocal warning without committing us to war. Albert took credit for originating the “positive control” process as a partial answer to the problem of false alarms and poor information. This introduced a “launch on warning” (LOW) option with respect to bombers that was separable from the decision to execute the war plans, i.e., to send the bombers to target. The planes launched on warning under positive control were to fly to a pre-designated rendezvous area, where they would circle unless they got an explicit, “positive” order to “Execute,”—i.e., to proceed to predesignated targets—or an order to return to the base.
If they received no order at all, they were to return to their base at the point when they had just enough fuel to do so safely. (This option doesn’t exist for operational ballistic missiles, which can’t be recalled once launched. President Reagan once made a public statement47 to the contrary for submarine-launched missiles. He really may not have known better. This is a dismaying confusion for a president to suffer.)
But how reliably were these safeguards observed in actual practice? No military secrets were more tightly guarded than the details of how, by whom, and under what circumstances decisions to execute nuclear war plans—both planes and unrecallable missiles—would really be arrived at and implemented. An opportunity to study these in the field, with high access—though not at the president’s level—arose a few months into my research. The Commander in Chief, Pacific Command (CINCPAC), Admiral Harry D. Felt, called for a study of his problems of nuclear command and control in the Pacific to be done by the Office of Naval Research (ONR). I was glad to have RAND lend me to the study.
In the fall of 1959 I moved to Camp Smith in Oahu, Hawaii, CINCPAC headquarters, to join an ONR study group headed by Dr. John Wilkes. I didn’t agree to stay for the whole year, since my wife wasn’t prepared to move the family there with me, so I went for several months at first, then came back repeatedly during 1960 to help the group in the later stages of their study. Much of our work was at the headquarters of CINCPAC and of the Pacific Air Forces (PACAF) on Oahu, but we made extensive field trips throughout the Pacific theater. I observed operations and held discussions with commanders, planners, and operators in almost every command post in the Pacific.
The basic problem that CINCPAC most wanted our team to focus on was how to assure, if and when a decision were ever made to use nuclear weapons, that his own “Execute” message ordering the implementation of nuclear war plans would get out to the various forces in the Pacific in a reliable and timely way. This would have to be done before various command posts, communications in the theater, or his offensive forces were destroyed by a Soviet attack. But a problem that I took on personally to investigate was the obverse of that one: reducing the possibility of unauthorized action. How to assure that no subordinate would be inclined or able to launch the forces under his control in the absence of an authorization from his superiors or the president?
In principle, unauthorized action was simply forbidden. According to all the Top Secret war plans, an Execute order at any level of command to carry out a nuclear war plan had to be based on an immediate, explicit order from higher authority, ultimately from the president himself. However, there were provisions in the plans for taking various preparatory actions on local authority, and even for launching planes on warning of imminent enemy attack, to protect them from destruction. This was Wohlstetter’s “positive control” process. Such a launch was not supposed to be tantamount to a decision to execute a war plan—to proceed to targets.
This procedure was also known as “fail-safe.” If there were a failure from the base to transmit an intended signal, either to go ahead or to return, the planes were to act as if they had gotten a return signal. This response might be an error if there was actually a war on and communications were destroyed, but it was a safer error—less dangerous—than the mistake of going to target when no war was going on and communications were out for technical or atmospheric reasons.
The term “positive control,” and its synonym “fail-safe procedure,” meant that the pilots were to be trained and drilled to understand that they were never to go to target under any circumstances without a positive order—explicit and immediate—from a higher authority to do so. And an Execute order had to be “authenticated” as coming from the highest authorities, meaning it had to be accompanied by coded evidence and to come in such a manner that made its origins at the highest levels unmistakably clear.
But how reliably would their behavior conform to these instructions? How safe was this process, really? I had raised this question48 in the very first memo I had written on a Defense Department contract, just a month after I had come to the RAND Corporation as a summer consultant in 1958. It was titled “Strains on the Fail-Safe System” and it was addressed to Wohlstetter, the author of the fail-safe procedure, and to Frank Eldridge, the leading communications expert at RAND, one of the RAND analysts I had consulted. It reflected my own experience—ending just the year before—in a highly disciplined organization, the Marine Corps, and my reading of military history. I was aware that the behavior of conscientious officers would reflect not only what they had earlier been told to do under prescribed conditions but also their sense of the mission and their actual beliefs about the current situation, based on their immediate experience and observations.
To paraphrase my memo, what I foresaw was that the lack of a positive order to execute, following an order to launch that was accompanied or followed by strong signs of an enemy attack, would itself inevitably be ambiguous, perhaps no less so than the tactical warning that gave rise to the launch. The lack of any signal might mean that a return to base was desired. It was certainly supposed to be responded to as if it surely meant that, according to the written rules. Nevertheless, it might mean that an order to execute had been sent but had not arrived yet, and might not arrive in time for it to be carried out with the remaining fuel. Or that it would have been sent and received had not enemy nuclear attacks wiped out the commander or the transmitter or interfered with the transmission.
It could, in other words, be a very ominous indication, depending on what other evidence was available. For example, how often had pilots had the experience of getting to this point, of circling in a rendezvous area, without receiving a message to return and without, as it turned out, their base having been under attack? Ever?
If the whole procedure were practiced often enough up to this point, the pilots would come to expect on any given occasion, in the absence of any other evidence, that they were taking part in a drill. They would have acquired a habit of returning. They wouldn’t feel any pressure to break that habit, to disobey their standing orders and to take off for their targets, even if they got no further orders. They would return to their base routinely.
But as I conjectured at RAND—and as I discovered when I was able to investigate this question in the field, in our CINCPAC study group—it was not at all clear that most pilots in the Pacific got a chance to acquire such a habit. In fact, although we heard different opinions on this, it seemed very unlikely.
As our group actually witnessed on a visit to Kadena Air Base on Okinawa, the first part of the launch-on-warning procedure was practiced frequently, in fact daily, at random times, up to the point when pla
nes were ready to taxi for takeoff. At Kadena, the pilots weren’t continuously in the alert planes or in the alert hut on the strip. They were allowed to be elsewhere, at the PX or in their quarters, each with his individual jeep and driver, because they practiced the alert at least once a day.
The officer in charge told our research group we could choose the time for that day’s rehearsal. When our leader, John Wilkes, said later, “OK, now,” the klaxons sounded all over the area, and almost instantly jeeps appeared on all the roads leading to the strip, rushing around curves, with pilots leaping out as they reached the strip and then scrambling into the cockpits, still tightening their helmets and gear. Engines starting in ten planes, almost simultaneously. Ten minutes.
That drill assured that the planes would be ready to take off in time when ordered. At that, practice had made perfect. But the later part of the exercise, to assure that they would fly to their rendezvous area and eventually come back from it unless they were ordered to proceed, was much more time-consuming and expensive in fuel and maintenance. It was obvious that it would be practiced much less often. We asked, was it ever rehearsed at all? Answers on that were vague and conflicting. It was understood that SAC, which had invented this procedure, did do full-scale rehearsals of it frequently, but it was not clear that theater forces ever did.
In fact, we learned at Kadena that the tactical alert planes there never actually left the ground in their daily drills, and that wasn’t just for reasons of expense. They were barred even from taxiing from their alert pads to the point of takeoff. The reason, we were told, was the danger of accident, possibly a nuclear accident.
Each of the alert planes, single-person F-100s, was carrying a Mark 28 thermonuclear weapon outside the plane, beneath the undercarriage. These weapons, we were told, were designed to be carried inside a plane for greater safety. But there was no room for that in these tactical fighter-bombers.
Moreover, they were not “one-point safe.” All H-bombs, thermonuclear fusion weapons like these, were triggered by a plutonium bomb of the type that destroyed Nagasaki. The plutonium core was surrounded by a spherical web of shaped charges of high explosive. When these all detonated simultaneously, they imploded the plutonium core inside, squeezing it to a density of greater than critical mass, leading to a nuclear fission explosion that in turn triggered the thermonuclear fuel.
“One-point safe” meant that the design ensured that if one of the high-explosive shaped-charge sections exploded accidentally, no significant nuclear yield would result. Or more precisely, there would be a “less than one in a million chance” of a nuclear yield greater than four pounds. Only if more than one went off—from being dropped, burned, or fired into, or from an electrical malfunction—might there be a partial nuclear explosion. That might be on the scale of the Hiroshima bomb.
Since these weapons were not one-point safe, there was a danger that if they were dropped or involved in a crash or a fire or an explosion and one or two sections of the high explosive detonated, it would mean not only the dispersal of radioactive contamination from the plutonium trigger over a large area but also a possible partial or total nuclear explosion. While the probability of the latter was small, the risk was not worth taking in a practice drill, which, after all, happened once a day.
Therefore, in these practice alerts, the pilots would jump into their planes and gun up the engines. But they didn’t go to the point of racing down the runway, or even taxiing over to the runway from their pads, let alone taking off. When they were not on alert, the pilots, of course, often flew their planes without weapons. And apparently they also did training missions with actual weapons when not on alert. But we found it hard to get a clear answer whether pilots on actual standby alert ever took off, in a practice drill, from their alert pads with weapons aboard. Certainly not very often, if ever, we were told. Probably never.
That said to me that if they were ordered to take off from those pads, it would be an extraordinary, perhaps unprecedented, experience for the alert pilots. Even if it was in fact—unknown to them—only a drill, the first time or two that it happened would almost surely lead them to infer that “this was it.” An enemy attack was under way or else they were leading a preemptive strike. At the least, they would have to infer that the indications of enemy attack were more serious than they ever had been before. It would be in that state of mind that they would head for their rendezvous areas, even if they received no Execute order to follow their launch order.
This particular consequence of the lack of regular rehearsal of takeoff under fully realistic simulated alert conditions didn’t seem familiar to any of the nuclear control officers or pilots that I questioned. In fact, they all admitted that it had never occurred to them. They all seemed to hear my reasoning as new, interesting, and plausible. That was worrisome. They agreed: the first time, even the first few times, that alert pilots found themselves circling in a rendezvous area with bombs aboard waiting for an Execute or a Return message, they would be strongly inclined to expect the worst, simply because it was the first time they had ever gotten that far. They would believe the war was on, or was imminent, because the commanders who had launched them without precedent would appear to have thought so.
What if they had other reasons to think that as well? Suppose this launch came in a time of international crisis, either in the region or elsewhere in the world. Suppose there had been an earlier strategic warning of a heightened danger of war or attack. What if there was an actual war going on in the area, between China and Taiwan, or in Korea, or in Indochina? Or a serious crisis, such as actually occurred in 1954–55 and again in 1958 (soon after I wrote this memo), when the Chinese Communists on the mainland spent months shelling islands a few miles offshore that were occupied by Chinese Nationalist forces? In both these cases there was presidential discussion of using U.S. nuclear weapons to repel an attack or to maintain access to the offshore islands, Quemoy and Matsu. (In early 1958, nuclear warheads for Matador cruise missiles had arrived in both Taiwan and Osan, South Korea.)
What if there were, in the course of a launch on warning or soon after it, a massive explosion on an American airbase in the region, perhaps on this very base? On first thought, that might seem improbably coincidental, stretching too far for a worst-case scenario. On second thought, less so. As far as I could tell from many conversations, no one else in the area had had the first thought, let alone the second. But no one found it implausible after a brief discussion.
It was only necessary to recall why the alert F-100s, despite a command obsession with realistic drills and with meeting standards, rarely if ever rehearsed to the point of takeoff. It was precisely because of the serious danger of a crash and its possible nuclear consequences, with these particular bombloads. The other side of that reluctance, the very basis for it, was an estimate by commanders that if a number of these planes actually taxied to the runway and took off in a great rush, one or more of them might bump into another or otherwise turn over, burn and explode, and produce a huge explosion, spreading lethal radioactivity over a large area, and just possibly, a nuclear fireball.
That possibility itself wasn’t remote from people’s thoughts. It was why they didn’t taxi. What they hadn’t thought about was the next question. What would the effect of that event be on the minds of the alert pilots who had already taken off, either from that base, or from another one nearby, or even from a distant base in the same region?
They might, of course, guess at the true reason: that an unprecedented accident had occurred. But even if that occurred to them at all, it would be competing with another explanation, which might seem much more likely under the circumstances. After all, why were they in the air at all with their bombs aboard? Was it an unprecedentedly realistic, no-warning drill, despite the risks? Or was it because a higher authority had perceived evidence of an imminent enemy attack, stronger than ever before, perhaps certain? And now this explosion! Whether it was nuclear or not might not be immediately clear,
especially in the initial reporting or observation by the planes that had already taken off. The attack might appear to be taking place.
At this point a lot of communications would be taking place among the airborne planes and they would be attempting to communicate back to their base. But if there had been a partial nuclear explosion at that base, that would be impossible. The blast itself probably would have destroyed all transmitting points at the base, but beyond that the electronic effects of the explosion would have disrupted all high-frequency, long-distance communications in a considerable area.
That would mean that the last signal these planes would receive from their base, and perhaps, for quite a while, from any other bases in their vicinity, might be the sight of a mushroom cloud rising over the runway they had just left. They would then be out of communications locally: the explosion itself would black out radio transmissions. The later lack of an Execute or a Return order, or any other, would have an easy explanation: enemy attack. All this in the context of the fact that they had just received a launch order that was unprecedented, or nearly so—a circumstance that in itself would make some or all of them nearly certain that an attack had been imminent.
What this meant to me was that a false alarm deemed serious enough to trigger a launch command to alert tactical forces on any base in the Pacific—and probably anywhere in the world, at least where the weapons carried were such as to preclude frequent rehearsals of launch—was likely to generate the belief in the minds of some airborne pilots armed with thermonuclear weapons that, although they had not received an Execute order, general nuclear war was under way and that they had no ability to receive an Execute order because communications had been disrupted by the war.
The Doomsday Machine Page 6
