For example, on the matter of the envelope authentication, when I posed the possibility that a conscientious (or unbalanced) pilot who felt impelled to go to target might try to convince others to go with him in the way my memo had speculated, the typical response was: “Well, he can’t do that, because he doesn’t know the whole authentication code.”
I would pause at this point, waiting to hear a second thought expressed (which never occurred). Then I would say offhandedly: “Unless he opened the envelopes.”
Even this hint often failed to turn a light on. I’d hear: “But that’s against his orders. If he hasn’t gotten the whole signal, he can’t open it.”
That answer usually hung in the air only a moment or so. The premise was, after all, that the officer in question had come to feel, on some basis or other (like General Jack D. Ripper in Kubrick’s Dr. Strangelove, a few years later), that it was time to commence World War III. He was on his way to drop a thermonuclear bomb on Russia, and he wouldn’t expect to come back. Everyone I encountered came to agree by this point in the discussion that there was a real problem here, however unlikely.
* * *
Moreover, I had by this time discovered that a comparable situation prevailed not only with alert pilots but also with duty officers at the level of bases, carriers, and the entire Pacific Command. And another pervasive phenomenon I found was the non-observance of the two-man rule in command posts throughout the Pacific.
To prevent unauthorized action by a single duty officer with access to Execute codes in any particular command post, there was a universal and supposedly ironclad rule that at least two such officers must be on duty at all times, day and night, and they must both be involved in, and agree on, the authentication of an order to execute nuclear war plans from a higher authority and on their decision to relay this order to subordinate commands.
Since physical conditions varied at different bases, each command post had, I found, devised its own procedures for assuring that this directive was obeyed. A typical procedure would be to have half the authentication code in each of two separate envelopes, with each of the two duty officers to be present at all times holding only one of the envelopes. Then, half the codes to be sent to lower commands for Execute orders and authentications would be filed in one of two separate safes.
Each of the two duty officers would hold one envelope and would possess the combination to only one of the safes. If a signal with an eight-number group, say, was received in the duty office, the officers would open their envelopes and see if the two respective cards inside, each with four numbers, corresponded to the whole group of numbers received. Then, each would open his safe and the two of them would agree (or not) to send the combined messages inside.
In other posts where the office had only one safe, each officer might have just half the combination to it. One way or another, each post purported to have arrangements so that one officer by himself could neither authenticate orders received nor send out authenticated Execute commands.
But in practice, not. As various duty officers explained to me, oftentimes only one man was on duty in the office. The personnel requirements for having two qualified officers sitting around in every such station at literally every moment of the night were just too stringent to be met. Duty rosters did provide for it, but not for backups when one officer “had” to be elsewhere—to get some food or for a medical emergency, his own or, on some bases, his wife’s. Did that mean that all subordinate commands would be paralyzed, unable to receive authenticated Execute orders, if the one remaining duty officer received what appeared to be an order to commence nuclear operations during that interval?
That couldn’t be permitted, in the eyes of the officers assigned to this duty, each of whom had faced up to the practical possibility of this situation. So each of them had provided for it “unofficially,” in his own mind or usually by agreement with his fellow duty officers. Each, in reality, had the combinations to both safes, after all, or some arrangement for acquiring them. If there was only one safe, each officer would, in reality, know the full combination to it. One officer would hold both envelopes when the other had to be away. Where there were more elaborate safeguards, the officers had always spent some of their idle hours late at night figuring out how to circumvent them, “if necessary.” They had always succeeded in doing so. I found this in every post I visited.
The officers would tell me this “off the record” but with some pride, partly to reassure me that they had conscientiously and sometimes ingeniously managed to assure that the system would work (to “Go”) even if they or their partner didn’t happen to be on hand at the crucial moment. But that meant that the two-man rule was only a facade throughout the Pacific. The system’s ability to prevent one man alone from sending off Go commands to subordinate units was a false promise. And that was in addition to the fact that the two-man rule, even if both men were present, was obviously vulnerable to collusion between them or coercion (such as a gun in the hand of one of them), either of these especially plausible in a crisis. Some fifteen years later, when I described these early command and control discoveries, and this one in particular, to journalist Bob Woodward, he informed me that he himself had been a nuclear control officer on a command ship during his active duty in the Navy and could confirm my account. He recalled vividly the “precautions” he and his fellow duty officers had taken to assure that one man alone could “if necessary” send an Execute message to subordinate forces. There must be thousands of other former duty officers with memories of their own arrangements for circumventing the two-man rule (which to this day is trumpeted reassuringly in all official descriptions of the nuclear control system).
Later procedures for controlling the launch of silo-based land missiles became much more elaborate, physical, and, supposedly, reliable. But even these had their vulnerabilities.
John H. Rubel, former deputy director of defense research and engineering, writes that the operators of the Minuteman missiles had circumvented51 the design feature requiring that two different launch control centers, with two duty officers in each, agree within a limited short time to launch. In case one of them had already been destroyed, the system allowed a launch order from just one center to be executed if there had been no signal from the other within a certain predesignated time interval, X. In practice, Rubel found, X was often (perhaps always) set at zero, making it possible for one center alone to launch at any time.
Partly at Rubel’s urging, Secretary of Defense McNamara later compelled the Minuteman developers, against great resistance, to install the equivalent of an electronic lock on the Minuteman, such that it couldn’t be fired without the receipt of a coded message from higher headquarters. Decades later, long after McNamara’s retirement, Bruce Blair, a former Minuteman launch control officer, informed the former secretary that the Air Force had ensured that the codes in the launch control centers were all set continuously at 00000000. According to Blair, McNamara responded, “I am shocked, absolutely shocked and outraged. Who the hell authorized that?” “What he had just learned from me,” Blair continues,
was that the locks had been installed,52 but everyone knew the combination. The Strategic Air Command (SAC) in Omaha quietly decided to set the “locks” to all zeros in order to circumvent this safeguard. During the early to mid-1970s, during my stint as a Minuteman launch officer, they still had not been changed. Our launch checklist in fact instructed us, the firing crew, to double-check the locking panel in our underground launch bunker to ensure that no digits other than zero had been inadvertently dialed into the panel. SAC remained far less concerned about unauthorized launches than about the potential of these safeguards to interfere with the implementation of wartime launch orders. And so the “secret unlock code” during the height of the nuclear crises of the Cold War remained constant at 00000000.
The reality, as I discovered over and over in the Pacific, was that in the minds of commanders and operators at every level up to CINCPAC Admi
ral Harry Felt himself, the first task assigned to our study group—assuring that every unit under his command would receive as promptly and reliably as possible a Go order for general nuclear war operations when Felt issued it—was regarded as incomparably more important than the seemingly parallel aim I had chosen to focus on: assuring that no forces would attack enemy targets when Felt or another higher authority had not issued such an order and did not desire it to be executed. As we’ll see in what follows, these same priorities applied in all commands and at the highest national military and civilian levels during the fifties, and to a considerable degree later.
Throughout the Cold War such priorities reflected a command environment in which
—it was regarded as overwhelmingly more important to assure a Go response when required than to prevent a false alarm or an unauthorized action; and
—there was tremendous emphasis on a fast, immediate response to warnings of a nuclear attack and to a high-level Go command, for two reasons:
to destroy enemy weapons before they were launched; and
to get American weapons launched before they, or command posts and communications, were destroyed.
Effective safety catches, whether in the form of rules or physical safeguards, meant potential delays in response. And delays were anathema, dangerous to the mission—of disarming the enemy—and to the survival of the weapons, the command system, and the nation. For one thing, the military commanders were far more conscious than they tended to acknowledge to civilian superiors or staffers of the extreme vulnerability of command centers and communication links. In the face of an enemy believed to be Hitlerian in savagery and armed with a nuclear force believed (incorrectly) to be superior to our own, all these concerns and considerations of safety and high-level control gave way.
And there was a further reason—so I was given to understand by some officers—for the Joint Chiefs of Staff to tolerate the shortcomings of the control system, to put up fierce and prolonged resistance to measures that would tighten control of nuclear weapons up and down the line. That was their distrust, above all in a crisis, of the judgment of civilian commanders and their staff and advisors, especially their willingness to launch nuclear attacks when military commanders believed them to be urgently necessary. That distrust had emerged under Harry Truman during the Korean War (despite Hiroshima and Nagasaki) and intensified under Eisenhower, especially during the Taiwan Straits crisis of 1958. It was to become even more intense under JFK and McNamara.
This was reflected in what seemed to me a peculiar and startling omission, in the envelope authentication procedures of the Pacific Air Forces, which I came across early on in my research in 1959. It proved to be true as well of the strategic forces in SAC. There was only one card in the envelope (and only one envelope) with which to authenticate the last four digits in the eight-character signal. It was, in effect, a Go code to execute the general war plan.
There was no Stop or Return code in the envelope or otherwise in the possession of the plane crew. Once an authenticated Execute order had been received, there was—by design, it turned out—no way to authenticate an order to reverse course from the president or anyone else. And no such unauthenticated order was to be obeyed.
There was no officially authorized way for the president or the JCS or anyone else to stop planes that had received an Execute order—whether they had just taken off or had passed beyond their positive control line—from proceeding to the target and dropping their bombs. From that point on, the planes, whether tactical or strategic, could no more be called back by the president or any subordinate from their attack project than a ballistic missile. This despite the fact that for many SAC planes launching from the United States, the remaining time before they reached their assigned targets after receiving an Execute order might be twelve hours or more: time enough for world history and the framework of civilization to have altered decisively since the initial order, whether by nuclear explosions, coups in the Sino-Soviet bloc, or convincing offers of Soviet surrender, not to mention the discovery of a terrible error.
But that meant there would also be time enough after issuance of an Execute order—as several high-level staff officers told me their superiors worried about—for a presidential change of mind. Fear of that contingency was not the first explanation to be proposed by a control officer for the absence of a Stop or Return order from the authentication envelopes. A common one offered was that if there were two cards in the envelope, one with numbers corresponding to Stop and the other to Go, in the pressure of the crisis the crew member designated to open the envelope might look at the wrong card by mistake. That was pretty feeble as an explanation; if there had been no code received corresponding to a Go card, a Stop code would be unnecessary and meaningless.
The stronger reason given to me in 1960 was that “the Soviets might discover the Stop code and misdirect the whole force back.” This is precisely the explanation given to the president in Dr. Strangelove for his lack of ability to send a Stop order to the planes that have been launched by the mad base commander General Jack D. Ripper.
I was dumbstruck by the realism of this point, among others, when I first saw the movie in 1964. Harry Rowen and I had gone into D.C. from the Pentagon during the workday to see it “for professional reasons.” We came out into the afternoon sunlight, dazed by the light and the film, both agreeing that what we had just seen was, essentially, a documentary. (We didn’t yet know—nor did SAC—that existing strategic operational plans, whether for first strike or retaliation, constituted a literal Doomsday Machine, as in the film.)
How, I wondered, had the filmmakers picked up such an esoteric, highly secret (and totally incredible) detail as the lack of a Stop code, and the alleged reason for it? Or, for that matter, the real lack of any physical restraint on the ability of a squadron commander, or even a bomber pilot, to execute an attack without presidential authorization? It turned out that Peter George, one of the screenwriters and the author of Red Alert, the novel on which the film was based, was a former Royal Air Force (RAF) Bomber Command flight officer. That suggests that Bomber Command’s control system had the same peculiar characteristics as SAC’s. And probably for the same underlying reasons.
The real concern, I was told privately by more than one credible staff officer—among others, by Lieutenant Colonel, later Major General, Bob Lukeman in the Air Force office for war plans—was that a civilian president or (if the president were unavailable or Washington was destroyed) some civilian deputy, on whatever basis, might have second thoughts about the attack under way after an Execute order had been sent, and try either to modify it midway or to cancel it. At best, he would be passing up the opportunity for a coordinated surprise attack, and at worst, leaving our forces totally disorganized and vulnerable—along with the country—to an enemy attack either already under way or launched as soon as the enemy had detected and figured out what had just happened on our side.
That’s the exact argument of General Buck Turgidson, played by George C. Scott in Dr. Strangelove, against the president’s attempting to recall all the planes that General Ripper had launched toward Russia. It represented fairly the view to be expected in such a situation from any number of Air Force officers, high or low. As the major in Kunsan had put it to me, “If one goes, they might as well all go.”
Whether or not this distrust of high-level civilian readiness to initiate nuclear war—which I encountered over and over in my experience in the Pentagon—was a key motive for the absence of a card with a Stop code in the envelopes of the alert forces, it was a fact that the systems designed and operated by the military assured the practical inability of the president53 or any civilian to reliably stop any bombers from carrying out attacks once they had received authenticated Execute orders (from whomever).† Nor could the president then or now—by exclusive possession of the codes necessary to launch or detonate any nuclear weapons (no such exclusive codes have ever been held by any president)—physically or otherwis
e reliably prevent the Joint Chiefs of Staff or any theater military commander (or, as I’ve described, command post duty officer) from issuing such authenticated orders. That is, of course, contrary to the impression given to the public by every president up to the present. The impression is false, as I was to discover.
CHAPTER 3
Delegation
How Many Fingers on the Button?
In 1959 the nuclear control officer on the staff of CINCPAC Admiral Harry D. Felt told me that President Eisenhower had given Felt a secret letter, signed by himself, delegating to Felt the authority to execute his nuclear plans on his own initiative if he felt it necessary at a time when communications were out between Washington and his headquarters in Hawaii.
That meant Admiral Felt had this authority for part of every day. That was how often, on average, communications were out between Washington and Hawaii because of atmospheric disturbances to high-frequency radio transmissions.
I didn’t ask him if he had actually seen the letter, but he seemed certain that it existed. What he was telling me, in great secrecy, contradicted the most frequently reiterated and emphatic dogma about the nuclear control system: that there were was no pre-delegation of authority, that only the president could legitimately make the decision whether or not to go to nuclear war, and that he must make that determination personally at the moment of decision.
That is what the American public has been told throughout the nuclear era. For decades that assurance, of exclusive presidential control of the decision to go to nuclear war and how it is to be conducted, has been symbolized—and more than symbolized, apparently embodied—by the iconic “football,” the briefcase carried by a presidential military aide that is to accompany the president “at all times,” containing codes and electronic equipment by which the president, on receiving warning of a nuclear attack, can convey to the military his choice of a response “option” to be executed. In a truly symbolic gesture that television cameras often capture during the inauguration of a new president, the aide carrying the football visibly shifts his gaze from the departing president to the new one at the moment of his swearing in. That shift signifies not only that the new president has acquired the full authority of his office but also that the existence of a civilian commander in chief of the nuclear forces of the United States—with, supposedly, exclusive control of these almost godlike powers of destruction—must not be and has not been interrupted for a single moment.
The Doomsday Machine Page 8
