The Doomsday Machine

by Daniel Ellsberg

  Thus, a launch order might be followed closely by a large high explosive or even nuclear detonation on a U.S. base, accompanied by an outage of communications, precisely because it would have led to the actual launching of numbers of planes with nuclear weapons that were known to be less than maximally safe. In fact, these probabilities, individually low but not independent, could cascade even further.

  If the false alarm leading to precautionary launch was widespread in the theater or even worldwide, the numbers of bases and planes involved would greatly increase the chance of an accidental explosion somewhere. But even if the initial takeoffs were at the initiative of a single base commander, a large explosion—especially with high explosive alone, which wouldn’t knock out all communications—might lead to many precautionary launches elsewhere, likewise increasing the chances of a second explosion. And any of these might simultaneously disrupt communications.

  My knowledge of military interpretation of orders and military dedication, based on my own experience in the Marines and, by now, on a lot of time talking with high-level Air Staff officers, convinced me that in such a situation many of the pilots would regard it as their duty to carry out their mission, the general war mission, in violation of the strict letter of their orders to await a positive authorization. Such authorization would likely not come, they would suddenly realize, if an enemy attack had intervened soon after their launch orders. Thus, without the commander realizing it, his command to initiate a precautionary launch might be tantamount to an Execute order after all.

  When I tried out this line of reasoning to experienced staff officers at various command posts and bases in the Pacific, nothing I heard back was reassuring. They found it unfamiliar and immediately plausible. No one came up with some operational characteristic or practice I had left out that lowered the odds of the disastrous sequence I was projecting.

  Finally I felt I needed to test out these thoughts at the lowest level of command. Looking at a map at a headquarters near Tokyo, I picked out a small U.S. airbase in South Korea: Kunsan. It was the northernmost base with nuclear-alert planes in Korea (that is, in the Pacific). In fact, its alert planes with nuclear weapons may have been closer to Communist territory than those on any other Pacific base. Individuals in our group could get rides on military planes, and we had “go anywhere, talk to anyone, see anything” clearance from Admiral Felt. On short notice, I decided to take a trip to Korea to talk to the officer in charge at Kunsan.

  I landed in Seoul and secured a ride on a light plane over barren, unpopulated hills up to Kunsan. I found myself landing on a dusty airstrip in something like a little town in a frontier Western. The officer in charge of the base was an Air Force major. He was in command of twelve F-100s, each with an underslung Mark 28 thermonuclear weapon with a yield of 1.1 megatons. Each one of those bombs had the explosive equivalent of half the tonnage the United States dropped in all of World War II, in both Europe and the Pacific. That had been two million tons worldwide. The major in charge of this little collection of Quonset huts and planes in the hills controlled six and a half times World War II’s worth of firepower.

  As best I recall, as at Kadena, these weapons were not one-point safe at that time. In answer to my question, the major informed me that the pilots didn’t practice taxiing or taking off in drills with weapons aboard. A portion of this squadron was on alert at all times. We were just minutes of flying time away from North Korea, but these planes were targeted on northeast Russia, perhaps an hour longer. I asked the major how long it would be, if they took off toward their rendezvous area, before they would be picked up on North Korean or Russian radar, and how long before they were out of line-of-sight communication with their base. He got edgy, said these were very sensitive questions, and refused to answer unless he “saw my authorization.”

  After he did this a couple of times, I got irritated and said, “Well, we’ll just have to call Japan and let you talk to someone.” We went into his command hut and he tried to get headquarters in Japan by radio. This brought out the interesting fact that he was out of communications with Japan, and had been for the past few hours. He couldn’t get through to Japan via the main headquarters in Korea at Osan either. I asked him how often this happened, and he said that “about once a day” atmospheric troubles of different kinds put him out of touch with Japan.

  I didn’t think it was worth pursuing our discussion until he had talked to the operations desk in Japan about my access, so I waited for almost an hour, reading magazines in his hut. Osan had an alert strip too, where I’d had some discussions before I flew up to Kunsan. It occurred to me that if there were a nuclear explosion there for the reasons I was exploring, Kunsan could be cut off from communications with the rest of the world.

  Finally he got through to Japan and got the word that he could tell me “anything.” He asked me to run my questions by him again. I did, and he shook his head and said calmly that he didn’t know the answers. That was somewhat amusing, after his expressed concern about security that had delayed us for the last hour. I asked myself if he was kidding me now, but he seemed sincere and I let it pass. From then on, he got quite communicative. He hadn’t run into any researchers before at Kunsan and seemed to enjoy speculating about the issues I was raising.

  Because this base was so close to Communist radar, I’d been told at Osan, the base commander at Kunsan didn’t have the normal authority to launch his planes at his own initiative on positive control, even as a precaution against attack. He wasn’t to launch them at all, under any circumstances, except on direct order from higher headquarters via Tokyo, possibly relayed through Osan. I wanted to hear him confirm that, then go on to test him on some hypothetical circumstances. It didn’t end up happening that way.

  I asked if there were any circumstances in which he would send his planes on alert into the air—for example, if he thought they were about to be attacked. The major said, “Well, you know when I’m supposed to do it, don’t you?” He seemed to be testing me, what I knew.

  I said, “Yes, only when you get an order from Japan or Osan.”

  He said, “That’s right.” Without any break he went on to say, “But let me tell you, I’m the commander of this base, and every commander has an inherent right to protect his forces. That is a fundamental law of war. It’s the oldest principle of war that as a military commander I have the right and authority to protect my forces, and if I believed that they were endangered by anything, I would send them off.”

  I couldn’t figure out why he was telling me this, why he seemed to want to put it on the record. We had just established that I was there investigating nuclear command and control for the Commander in Chief of Pacific Command, Admiral Felt, and he was telling me in the most matter-of-fact way that he felt empowered by fundamental principles of war to violate specific and explicit directives sent down by CINCPAC. It was hardly a surprise to me that a field commander might come to feel like that under some circumstances. That was the intuition that had brought me to Korea. But I didn’t expect that he had already thought it through, or that he was so ready to tell me right out that he didn’t feel bound by his orders from the headquarters I came from.

  Those orders, after all, weren’t just arbitrary. They were specific to Kunsan precisely because of the closeness to enemy territory and radar. A sudden squadron takeoff might be detected and interpreted by the Communists as a warning of imminent attack. (In fact, in view of what the major was about to tell me, the enemy wouldn’t be foolish to think that.) So there was strong reason to keep his planes tightly under higher control, whether or not the major thought that violated principles of war.

  But I didn’t react. I wanted to explore what conditions might lead him to launch his planes. I asked him how he would interpret a sudden outage of communication that came during an intense crisis (like the Quemoy crisis just a year before). He said yes, that “might well” lead him to get his planes off the ground without orders from above.

  Again
, that wasn’t a surprise in itself, or wouldn’t have been on some other base, where it didn’t imply any violation of their directives. This was so even in an era when an outage of communications from natural disturbances was a fairly frequent phenomenon. Atmospheric disturbances disrupting high-frequency communications occurred virtually every day all over the Pacific: about once a day at Kunsan itself, the major had told me. Even underwater cables to Japan had recently been cut accidentally by trawlers. During an actual crisis, all communications between NORAD and our Ballistic Missile Early Warning System had gone out at the same time, because, as I recall, a forest fire destroyed one set of landlines on one side of the continent and an earlier earthquake had destroyed the lines on the other.

  Nevertheless, commanders and staff officers had told me that they would regard a sudden disruption of communications during a crisis as a very ominous sign, requiring at the least a high level of alert and perhaps a launch of some planes. So the major wasn’t answering differently from other bases. He just wasn’t acknowledging that his directives, which were different from theirs, were supposed to slow him down.

  How about a report of a nuclear explosion, somewhere else in the western Pacific? Yes, he said, that would be more than sufficient. He wouldn’t wait for an order.

  Now the big question. I asked him what he thought would happen if he did order the planes off. He said, “Well, you know what the orders are. They go to a rendezvous area and fly around, waiting for further orders. They can do that for about an hour and still have enough fuel to get to their targets or to come back. If they don’t get an Execute message, they’re supposed to come back. Those are their orders.”

  They would be out of communications with the base at their rendezvous area, he’d told me earlier. If they were there as part of a theater-wide alert, there would be a coordinating plane with them at the rendezvous with stronger communications gear, sent from another base. But if he had sent them up himself, they would be circling up there by themselves, unable to send any messages out.

  I asked, “How do you think that would work?”

  The major said, “If they didn’t get any Execute message? Oh, I think they’d come back.” Pause. “Most of them.”

  The last three words didn’t register with me right away because before they were out of his mouth, my head was exploding. I kept my face blank but a voice inside was screaming, “Think? You think they’d come back?!”

  This was their commander, I thought, the one who gave them their orders, the man in charge of their training and discipline. As I reeled internally from that response, the next words, “most of them,” got through to me.

  He added, “Of course, if one of them were to break out of that circle and go for his target, I think the rest would follow.” He paused again; then he added reflectively, “And they might as well. If one goes, they might as well all go. I tell them not to do it though.”

  I managed to keep a blank face. I had a few more questions to ask. Wasn’t it true that there was a chance these Mark 28 weapons underneath the planes had some risk of a partial nuclear explosion if there was an accident on the runway? He nodded. I set the scene. What if the first five pilots to take off were to look back and see a mushroom cloud over the base, after the sixth plane fell over and exploded on the runway? What would they think, what would they do, after they felt the blast wave?

  That was obviously a new question for him, and he seemed to find it interesting. His first response was indirect. “Well, of course it’s not like Okinawa, where that would mean to the pilots that their families had just been destroyed.” He meant, it turned out, that the likelihood that pilots would disobey their instructions and go on to target without explicit orders would turn on who had been killed in that explosion, as much as whether they thought it was an accident or an attack. “On Okinawa,” where some of them had dependents stationed on the base, he said, “they’d go on, of course,” if a blast wiped out their families. After all, they couldn’t be sure it was an accident, and, he implied, they wouldn’t feel they had much to live for anymore. On Kunsan, if the pilots in the air realized that they’d lost (only) the major and the base but they weren’t sure it was an enemy attack, they might look for an alternate base and come back to it if they didn’t get a go-ahead order.

  After he had made this distinction, I reminded him that the premise of the question was that pilots had been launched on alert for the first time ever, whether by Tokyo or Osan, or by the major. With that in mind, and all the more if this had arisen out of a crisis, he agreed that a partial nuclear explosion on Kunsan, or for that matter a report of one on Osan or Kadena, would make his pilots certain that an attack was under way. Communications would be out, so they couldn’t get an order to return. They would go on to their targets.

  * * *

  I returned to Camp Smith feeling that one of my questions had been pretty well answered: whether there were realistic circumstances in which even a disciplined officer—not a rogue or a madman—might disobey orders not to execute nuclear war plans without an explicit, authenticated order from superiors. But throughout my work on command and control, at RAND and in the Pacific Command (PACOM), I had also been asking another question as well. What if they did receive such an order; how certain was it that it truly came from the president or other high authority? Could one subordinate individual, on his own initiative, issue such an “authenticated” order?

  In theory—meaning, by explicit command directives—the answer was no. But in my first month at RAND in 1958, I had come across a SAC manual49 describing the procedures for authenticating the Execute order for bombers. It had indicated to me another vulnerability in the fail-safe system that I described in my first item of classified research.

  I posed the possibility in that memo that, perhaps on the basis of the circumstances described above, one pilot on alert had decided that “while it isn’t certain that the war is on, the chances were good enough to justify going ahead.” It would seem to make sense to him, I suggested, “to try to take some of his buddies with him, if he could, by sending them an apparently authentic ‘go-ahead’ signal. Whether or not these conditions seem likely,” I wrote, “I find it interesting that it appears he would be able to do this.” (emphasis in the original)

  According to SAC procedures, the alert pilot had in his plane (or on his person) an envelope that had a group of code numbers—say, four—on the outside and another group of four in a card inside the sealed envelope. After receiving a radio signal with a group of eight numbers, the first four matching the numbers on the outside of his envelope, the pilot was to open the envelope and check the numbers on the card inside. If they matched the last four numbers in the signal, he has received an authenticated Execute code and should proceed to target.

  Several RAND colleagues who were knowledgeable about SAC procedures supported my guess that the numbers in the code were the same for all planes in the SAC alert force. Only a single radio signal needed to be sent out. And their understanding was that the code was changed very seldom.

  What I found in the land-based tactical forces in the Pacific was that the procedure, code-named Spark Plug, was essentially the same as in SAC. According to my notes from a directive, “Spark Plug procedures are the only method50 by which Quick Strike [alert] forces may initially be launched or initially directed to expend [nuclear weapons on targets].… Presidential authority to use atomic weapons is implicit in … an authentic Spark Plug expend message.”

  Each alert plane or command post had a double envelope. When a Spark Plug message was received:

  Outside [of the outer envelope] tells the series.… If message gives the correct series, open the envelope. The face of the inner envelope gives first two phonetic code letters; if these correspond to first two letters in message, “Launch.” If a message is received (then or later) containing four letters, first two of which correspond to those on the face of inner envelope, open inner envelope. If card inside has all four letters, “Exp
end” weapons on assigned target.

  Where feasible, and in order to reduce probability of an inadvertent or unauthorized act, the envelope should be opened while in the presence of at least one other person who is knowledgeable of Spark Plug procedures (this cannot be applied to airborne bomb commanders).

  This two-man requirement applied only to command post procedures, either for launch or expend, since nearly all PACAF bombers, unlike SAC’s, were single-pilot planes. “On receipt of message, facilities will transmit message in the clear [i.e., not encrypted] immediately at designated time intervals for one hour, unless directed to stop.”

  It turned out to be true for both SAC and the Pacific forces that the codes were the same for all planes and changed infrequently. In both SAC and PACAF, that meant that any pilot in the alert force, whether aloft or not, simply by opening his envelope—for PACAF, two envelopes—could learn the entire authentication code.

  Since any pilot in the air receiving such a signal was directed to pass it along to other planes in his squadron by direct line-of-sight, ultra-high-frequency radio, a pilot who had been launched on warning and who wanted to take a group of alert bombers with him to Russia could, having ripped open his envelopes, radio other planes at the positive control line that he had received a very faint long-distance, high-frequency signal with the code in question. Especially under the circumstance such as I described above, that initiative would probably be effective.

  Looking back at that first memo of mine on national security matters, I find that it both influenced the questions I investigated at various air bases throughout the Pacific Command the following year and foresaw the alarming responses I heard. No one I spoke with had earlier considered any of these issues, but none considered them unrealistic when I raised them.