Command and Control

Acceptable Risks

Three weeks after winning an Oscar for best actor in The Philadelphia Story, Jimmy Stewart enlisted in the Army. It was the spring of 1941, long before Pearl Harbor, but Stewart thought the United States would soon be at war and wanted to volunteer his skills as a pilot. The previous year he’d failed an Army physical for being ten pounds underweight. This time he passed, just barely, and at the age of thirty-two entered the Army Air Corps as a private. By 1944, Major Jimmy Stewart was flying the lead plane in bombing runs over Germany. While other Hollywood stars like Ronald Reagan and John Wayne managed to avoid combat during the Second World War, Stewart gained a reputation in the Eighth Air Force as a “lucky” commander who always brought his men back from dangerous missions. He flew dozens of those missions, shunned publicity about his wartime exploits, and never discussed them with his family. “He always maintained a calm demeanor,” a fellow officer recalled. “His pilots had absolute faith in him and were willing to follow him wherever he led.”

After the war, Colonel Jimmy Stewart returned to Hollywood and starred in a series of well-received films — It’s a Wonderful Life, Harvey, Rear Window — while serving in the Air Force Reserve. Deeply concerned about the Soviet threat, he decided to make a movie about the importance of America’s nuclear deterrent. Stewart visited SAC headquarters in 1952 to discuss the idea with General Curtis LeMay. The two had met in England, while serving in the Eighth Air Force. LeMay gave the project his blessing, worked closely with the screenwriter Beirne Lay, Jr., and allowed the film to be shot at SAC air bases.

Strategic Air Command was released in 1955. It tells the story of a major league infielder, Dutch Holland, whose baseball career is interrupted when the Air Force returns him to active duty. For most of the film, Holland, played by Jimmy Stewart, is torn between his desire to enjoy civilian life and his duty to protect the United States from a Soviet attack. Strategic Air Command focuses on the hardships endured by SAC crews, the dangers of their job, the sacrifices that overseas assignments imposed on their families. Even the bubbly, upbeat cheer of the actress June Allyson, playing Stewart’s wife, is briefly deflated by the challenges of being married to a SAC officer. Shot in Technicolor and wide-screen VistaVision, featuring spectacular aerial photography and a rousing score, the film offers an unabashed celebration of American airpower. “She’s the most beautiful thing I’ve ever seen in my life,” Stewart says, at his first glimpse of a new B-47 bomber.

More compelling than the film’s plot, the onscreen chemistry between Allyson and Stewart, or the footage of SAC bombers midflight was the performance of actor Frank Lovejoy as General Ennis C. Hawkes. Gruff, unsentimental, fond of cigars, unwilling to tolerate mistakes, and ready at a moment’s notice to unleash a massive retaliation, the character was a flattering, barely fictionalized portrait of Curtis LeMay. It was another demonstration of SAC’s skill at public relations. LeMay had already become a national celebrity, a living symbol of American might. Life magazine described him as the “Toughest Cop of the Western World” and repeated an anecdote about his boundless self-confidence. Warned that if he didn’t put out his cigar, the bomber he was sitting in might explode, LeMay replied: “It wouldn’t dare.”

The premiere of Strategic Air Command was held in New York’s Times Square, with searchlights piercing the sky and more than three thousand guests, including Air Force generals, politicians, businessmen, Hollywood starlets, and Arthur Godfrey in the lobby of the Paramount Theatre, broadcasting the event live on television. Godfrey was a popular radio and television personality, as well as a good friend of LeMay’s, who frequently promoted SAC during his shows. Strategic Air Command was one of the highest-grossing films of 1955. It fit the national mood. And a few years later Jimmy Stewart, as a member of the Air Force Reserve, was appointed deputy director of operations at SAC, one of the top jobs at the command.

Behind the public facade of invincibility, questions were secretly being raised at the Pentagon about whether SAC could survive a Soviet attack. LeMay had spent years building air bases overseas — in Greenland, Great Britain, Spain, Morocco, Saudi Arabia, and Japan — where his planes would begin and end their bombing missions against the Soviet Union. But a study by the RAND analyst Albert Wohlstetter suggested that a surprise attack on those bases could knock SAC out of the war with a single blow, leaving the United States defenseless. LeMay felt confident that sort of thing would never happen, that his reconnaissance planes, flying daily missions along the borders of the Soviet Union, would detect any unusual activity. Nevertheless, he accelerated SAC’s plans to base most of its aircraft in the United States and to refuel them en route to Soviet targets. And LeMay continued to demand perfection from his officers. “Training in SAC was harder than war,” one of them recalled. “It might have been a relief to go to war.”

The town of Rhinelander, Wisconsin, became one of SAC’s favorite targets, and it was secretly radar bombed hundreds of times, thanks to the snow-covered terrain resembling that of the Soviet Union. By 1955, the SAC battle plan called for 180 bombers, most of them departing from the United States, to strike the Soviet Union within twelve hours of receiving an emergency war order from the president. But constant training and the radar bombing of Wisconsin could not guarantee how aircrews would perform in battle with real weapons. During tests at the Bikini atoll in May 1956, the Air Force got its first opportunity to drop a hydrogen bomb from a plane. The 3.8-megaton weapon was carried by one of SAC’s new, long-range B-52 bombers, with the island of Namu as its target. The B-52 safely escaped the blast — but the bombardier had aimed at the wrong island, and the H-bomb missed Namu by four miles.

Withdrawing most of SAC’s planes from overseas bases did not, however, eliminate the threat of a surprise attack. The continental United States — code-named the “zone of the interior” (ZI) — was also considered highly vulnerable to Soviet bombers. During Operation Tailwind, 94 SAC bombers tested the air defense system of the ZI by approaching from Canada, flying at night, and using electronic countermeasures to simulate a Soviet raid. Only 7 of the planes were spotted by radar and “shot down.” The failure to intercept the other 87 planes raised the possibility of a devastating attack on the United States. Now that the Soviets had hydrogen bombs and jet bombers, the Joint Chiefs of Staff recommended a large investment in America’s air defense and early-warning system. General LeMay strongly disagreed with that proposal, arguing that in the nuclear age it made little sense to waste money “playing defense.” If the Soviets launched an attack with 200 bombers and American forces somehow managed to shoot down 90 percent of those planes, the United States would still be hit by at least 20 H-bombs, if not more.

Instead of air defense, LeMay wanted every available dollar to be spent on more bombs and more bombers for the Strategic Air Command — so that Soviet planes could be destroyed before they ever left the ground. His stance gained support in Congress after the Soviet Union demonstrated its new, long-range jet bomber, the Bison, at Moscow’s “Aviation Day” in 1955. Ten Bisons flew past the reviewing stand, turned around, flew past it again in a new formation — and tricked American observers into thinking that the Soviet Air Force had more than 100 of the planes. The CIA predicted that within a few years the Soviets would be able to attack the United States with 700 bombers. Democrats in the Senate, led by presidential hopeful Stuart Symington, claimed that the Soviets would soon have more long-range bombers than the United States, raised fears of a “bomber gap,” and accused the Eisenhower administration of being weak on defense. “It is clear that the United States and its allies,” Symington warned, “may have lost control of the air.” Defying Eisenhower, Congress voted to appropriate an extra $900 million for new B-52s. The Soviet Union’s bluff had an unintentional effect: it widened the bomber gap, much to the benefit of the United States. By the end of the decade, the Soviet Union had about 150 long-range bombers — and the Strategic Air Command had almost 2,000.

DESPITE SERIOUS DOUBTS THAT the United States could ever be protected against a nuclear attack, work began on an air defense and early-warning system. At the very least, the Joint Chiefs concluded, such a system would “provide a reasonable degree of protection for the essential elements of the war-making capacity” — SAC bases, naval bases, command centers, and nuclear weapon storage sites in the ZI. The Army erected batteries of Nike antiaircraft missiles to defend military installations and American cities. The Navy obtained radar-bearing “picket ships” and built “Texas towers” to search for Soviet bombers approaching over the ocean. The picket ships lingered about five hundred miles off the coast of the United States; the Texas towers were moored to the seafloor, like oil platforms, closer to shore. The Air Force assembled squadrons of jet fighter-interceptors, like the F-89 Scorpion, and developed its own antiaircraft missile, the BOMARC — infuriating the Army, which had traditionally controlled the nation’s antiaircraft weapons.

More important, the Air Force started to build a Distant Early Warning (DEW) Line of radar stations two hundred miles north of the Arctic Circle. Stretching from the Aleutian Islands off Alaska, across Canada, to Greenland, the DEW Line was supposed to scan the polar route from the Soviet Union and provide at least two hours’ warning of an attack. It was later extended west to Midway Island in the Pacific and east to Mormond Hill in Scotland, a distance of about twelve thousand miles. Its construction required the transport of almost half a million tons of building material into the Arctic, where thousands of workers labored in temperatures as low as –70 degrees Fahrenheit. A sense of urgency pervaded the effort; the United States seemed completely unprotected against Soviet planes carrying hydrogen bombs. Begun in February 1955, construction of the DEW Line’s fifty-seven Arctic radar stations — some of them featuring radio antennae forty stories high, airstrips more than a mile long, and housing for the civilian and Air Force personnel who manned the facilities around the clock — was largely completed in about two and a half years.

Through an agreement with the Canadian government, the North American Air Defense Command (NORAD) was organized in 1957, with its headquarters in Colorado Springs, Colorado. NORAD’s mission was to provide early warning of an attack and mount a defense against it. If Soviet bombers were detected approaching North American airspace, fighter-interceptors would be sent to shoot them down as far as possible from the United States. Antiaircraft missiles would be fired at enemy planes that managed to get past the interceptors — first BOMARC missiles, then Nike. Coordinating the many elements of the system during an attack would be an extraordinarily complex task. Signals would be arriving from picket ships, Texas towers, DEW Line sites, airborne radars. Hundreds of Soviet bombers might have to be spotted and followed, their positions sent to antiaircraft batteries and fighter bases separated by thousands of miles. During the Second World War, Army radar operators had tracked enemy planes and used shared information about their flight paths verbally. That sort of human interaction would be impossible if large numbers of high-speed bombers approached the United States from different directions. The Air Force proposed a radical solution: automate the system and transfer most of its command-and-control functions to machines.

“The computerization of society,” the technology writer Frank Rose later observed, was essentially a “side effect of the computerization of war.” America’s first large-scale electronic digital computer, ENIAC, had been built during the 1940s to help the Army determine the trajectory of artillery and antiaircraft shells. The war ended before ENIAC was completed, and its first official use was to help Los Alamos with early calculations for the design of a thermonuclear weapon. Los Alamos later relied on the more advanced MANIAC computer and its successor, MANIAC II, for work on the hydrogen bomb. Driven by the needs of weapon designers and other military planners, the U.S. Department of Defense was soon responsible for most of the world’s investment in electronic computing.

At the Massachusetts Institute of Technology (MIT), researchers concluded that the Whirlwind computer, originally built for the Navy as a flight simulator, could be used to automate air defense and early-warning tasks. Unlike computers that took days or weeks to perform calculations, the Whirlwind had been designed to operate in real time. After extensive testing by the Air Force, an updated version of the Whirlwind was chosen to serve as the heart of the Semi-Automatic Ground Environment (SAGE) — a centralized command-and-control system that linked early-warning radars directly to antiaircraft missiles and fighter-interceptors, that not only processed information in real time but also transmitted it, that replaced manpower with technology on a scale reminiscent of pulp science fiction. It was the first computer network.

Built during roughly the same years as the DEW Line, SAGE consisted of twenty-four “direction centers” and three “combat centers” scattered throughout the United States. The direction centers were enormous four-story, windowless blockhouses that housed a pair of AN/FSQ-7 computers, the first mainframes produced by IBM. They were the largest, fastest, and most expensive computers in the world. Each of them contained about 25,000 vacuum tubes and covered about half an acre of floor space.

Analog signals from early-warning radar sites were converted into digital bits and sent via AT&T’s telephone lines to SAGE direction centers, where the huge computers decided whether an aircraft was friend or foe. If it appeared to be an enemy bomber, the computers automatically sent details about its flight path to the nearest missile batteries and fighter planes. Those details were also sent to NORAD headquarters. Human beings would decide whether or not to shoot down the plane. But that decision would be based on information gathered, sorted, and analyzed by machines. In many respects SAGE created the template for the modern computer industry, introducing technologies that would later become commonplace: analog to digital conversion, data transmission over telephone lines, video monitors, graphic displays, magnetic core memory, duplexing, multiprocessing, large-scale software programming, and the light gun, a handheld early version of the mouse. The attempt to create a defense against Soviet bombers helped to launch a technological revolution.

Although dubious about the usefulness of SAGE, General LeMay thought that SAC’s command-and-control system needed to be improved, as well. He wanted to know where all his planes were, at all times. And he wanted to speak with all his base commanders at once, if war seemed imminent. It took years to develop those capabilities.

When SAC’s Strategic Operational Control System (SOCS) was first unveiled in 1950, its Teletype messages didn’t travel from one base to another with lightning speed. During one early test of the system, they were received almost five hours after being sent. And it could take as long as half an hour for the American Telephone and Telegraph Company to make the SOCS circuits operable. That sort of time lag would make it hard to respond promptly to a Soviet attack. Transmission rates gradually improved, and the system enabled LeMay to pick up a special red telephone at SAC headquarters in Omaha, dial a number, gain control of all the circuits, and make an announcement through loudspeakers at every SAC base in the United States. The introduction of single-sideband radio later allowed him to establish voice communications with SAC’s overseas base commanders — and with every one of its bomber pilots midair. The amount of information constantly streaming into SAC headquarters, from airplanes and air bases throughout the world, led to the creation of an automated command-and-control system that used the same IBM mainframes developed for SAGE. The system was supposed to keep track of SAC’s bombers, in real time, as they flew missions. But until the early 1960s, the information displayed at SAC headquarters stubbornly remained anywhere from an hour and a half to six hours behind the planes.

All of these advances in command and control could prove irrelevant, however, if SAC’s commander didn’t survive a Soviet first strike. General LeMay’s attitude toward civil defense was much the same as his view of air defense. “I don’t think I would put that much money into holes in the ground to crawl into,” he once said. “I would rather spend more of it on offensive weapons systems to deter war in the first place.” Nevertheless, the plans for SAC’s new headquarters building included an enormous command bunker. It extended three levels underground and could house about eight hundred people for a couple of weeks. One of its most distinctive features was a wall about twenty feet high, stretching for almost fifty yards, that was covered by charts, graphs, and a map of the world. The map showed the flight paths of SAC bombers. At first, airmen standing on ladders moved the planes by hand; the information was later projected onto movie screens. A long curtain could be opened and closed by remote control, hiding or revealing different portions of the screens. It gave the underground command center a hushed, theatrical feel, with rows of airmen sitting at computer terminals beneath the world map and high-ranking officers observing it from a second-story, glass-enclosed balcony.

While ordinary families were encouraged to dig fallout shelters in their backyards, America’s military and civilian leadership was provided with elaborate, top secret accommodations. Below the East Wing at the White House, a small bomb shelter had been constructed for President Roosevelt during the Second World War, in case the Nazis attacked Washington, D.C. That shelter was expanded by the Truman administration into an underground complex with twenty rooms. The new bunker could survive the airburst of a 20-kiloton atomic bomb. But the threat of Soviet hydrogen bombs made it seem necessary to move America’s commander in chief someplace even deeper underground. At Raven Rock Mountain in southern Pennsylvania, about eighty miles from the White House and six miles from Camp David, an enormous bunker was dug out of solid granite. Known as Site R, it sat about half a mile inside Raven Rock and another half a mile below the mountain’s peak. It had power stations, underground water reservoirs, a small chapel, clusters of three-story buildings set within vast caverns, and enough beds to accommodate two thousand high-ranking officials from the Pentagon, the State Department, and the National Security Council. Although the bunker was huge, so was the competition for space in it; for years the Air Force and the other armed services disagreed about who should be allowed to stay there.

The president could also find shelter at Mount Weather, a similar facility in the Blue Ridge Mountains, near the town of Berryville, Virginia. Nicknamed “High Point,” the bunker was supposed to ensure the “continuity of government.” It would house Supreme Court justices and members of the Cabinet, as well as hundreds of officials from civilian agencies. In addition to making preparations for martial law, Eisenhower had secretly given nine prominent citizens the legal authority to run much of American society after a nuclear war. Secretary of Agriculture Ezra Taft Benson had agreed to serve as administrator of the Emergency Food Agency; Harold Boeschenstein, the president of the Owens Corning Fiberglas Company, would lead the Emergency Production Agency; Frank Stanton, the president of CBS, would head the Emergency Communications Agency; and Theodore F. Koop, a vice president at CBS, would direct the Emergency Censorship Agency. High Point had its own television studio, from which the latest updates on the war could be broadcast nationwide. Patriotic messages from Arthur Godfrey and Edward R. Murrow had already been prerecorded to boost the morale of the American people after a nuclear attack.

Beneath the Greenbrier Hotel in White Sulphur Springs, West Virginia, a bunker was built for members of the Senate, the House of Representatives, and hundreds of their staff members. Known as Project Greek Island, it had blast doors that weighed twenty-five tons, separate assembly halls in which the House and Senate could meet, decontamination showers, and a garbage incinerator that could also serve as a crematorium. A bunker was later constructed for the Federal Reserve at Mount Pony, in Culpeper, Virginia, where billions of dollars in currency were stored, shrink-wrapped in plastic, to help revive the postwar economy. NATO put its emergency command-and-control center inside the Kindsbach Cave, an underground complex in West Germany with sixty-seven rooms. The cave had previously served as a Nazi military headquarters for the western front.

The British government had planned to rely on a series of deep underground shelters built in London during the Second World War. But the Strath report suggested the need for an alternate seat of government far from the capital. In the Wiltshire countryside, about a hundred miles west of London, a secret abandoned aircraft engine factory hidden inside a limestone mine was turned into a Cold War bunker larger than any in the United States. Known at various times by the code names SUBTERFUGE, BURLINGTON, and TURNSTYLE, it was large enough to provide more than one million square feet of office space and house almost eight thousand people. Although the original plans were scaled down, the completed bunker had miles of underground roads, accommodations for the prime minister and hundreds of other officials, a BBC studio, a vault where the Bank of England’s gold reserves could be stored, and a pub called the Rose & Crown.

DURING THE CLOSING MONTHS of the Truman administration, the Joint Chiefs of Staff had once again asked for control of America’s nuclear weapons. And once again, their request had been denied. But the threat of Soviet bombers and the logistical demands of the new look strengthened the arguments for military custody. By keeping the weapons at half a dozen large storage sites, the Atomic Energy Commission maintained centralized, civilian control of the stockpile. The arrangement minimized the risk that an atomic bomb could be stolen or misplaced. Those AEC sites, however, had become an inviting target for the Soviet Union — and a surprise attack on them could wipe out America’s nuclear arsenal. The Joint Chiefs argued that nuclear weapons should be stored at military bases and that time-consuming procedures to authorize their use should be scrapped. Civilian custody was portrayed as a grave threat to readiness and national security. A democratic principle that seemed admirable in theory could prove disastrous in an emergency.

According to the AEC’s rules, if the Strategic Air Command wanted to obtain the nuclear cores of atomic bombs, the president of the United States would have to sign a directive. Local field offices of the AEC and the Department of Defense would have to be notified about that directive. Representatives of those field offices would have to contact the AEC storage sites. Once the proper code words were exchanged, keys would have to be retrieved, storerooms unlocked, nuclear cores carried outside in their metal containers. At best, SAC would get the cores in about twelve minutes. But the process could take a lot longer. Local officials might have to be tracked down on vacation or awakened in the middle of the night. They might have to be persuaded that this was the real thing, not a test.

In June 1953, President Eisenhower approved the shipment of nuclear cores to American naval vessels and overseas bases where the other components of atomic bombs were already stored — and where foreign governments had no authority to dictate how the bombs might be used. Cores were removed from the AEC stockpile, placed under military control, and shipped to sites that met those criteria: American naval vessels and the island of Guam. The following year the Joint Chiefs of Staff asked for permission to store bomb components and nuclear cores at SAC bases. Dispersing the weapons to multiple locations, the Pentagon argued, would make the stockpile much less vulnerable to attack. The AEC didn’t object to handing over more nuclear cores. The chairman of the commission, Lewis Strauss, agreed with most of LeMay’s strategic views. And the new general manager of the AEC, General Kenneth Nichols, had not only argued for years that the military should control America’s atomic bombs, he’d pushed hard for dropping them on Chinese troops during the Korean War.

President Eisenhower allowed the Army, the Navy, and the Air Force to start moving nuclear cores to their own storage sites, both in the United States and overseas. But his faith in military custody had its limits. Eisenhower insisted that the AEC retain control of the cores for all of the nation’s hydrogen bombs, even during an emergency. “No active capsule will be inserted in any high yield weapon,” the new rules stated, “except with the expressed approval of the AEC custodian and in the custodian’s presence.” Civilian employees of the Atomic Energy Commission were posted on aircraft carriers, ammunition ships, and air bases where H-bombs were stored. These AEC custodians were supposed to keep the cores securely locked away and hold on to the keys, until the president ordered them to do otherwise. But the Joint Chiefs considered this arrangement inconvenient, largely symbolic, and an insult to the military. Secretary of Defense Charles Wilson agreed, and in 1956 the AEC custodians were withdrawn from ships and air bases. Instead, President Eisenhower allowed the captains of those Navy ships and the commanders of those Air Force bases to serve as “Designated Atomic Energy Commission Military Representatives.” And they were given the keys to the nuclear storerooms.

Legally, the hydrogen bombs were still in civilian custody. But in reality, after nearly a decade of unrelenting effort, the military had gained control of America’s nuclear weapons. The Navy carried them on ships in the Atlantic, the Pacific, and the Mediterranean. The Strategic Air Command stored them at air bases in the ZI and overseas — at Homestead in Florida and Ellsworth in South Dakota, at Carswell in Texas and Biggs in South Carolina, at Plattsburgh in New York and Castle in California; at Whiteman in Missouri, Schilling in Kansas, and Pease in New Hampshire; at Fairford, Lakenheath, Greenham Common, Brize Norton, and Mildenhall in Great Britain; at Nouasseur, Ben Guerir and Sidi Slimane in French Morocco; at Torrejón and Morón and Zaragoza in Spain; at Kadena in Okinawa; and at least nineteen other locations. Atomic bombs and hydrogen bombs had been liberated from civilian oversight and scattered throughout the world, ready to be assembled by military personnel.

For safety reasons, the nuclear cores and the bomb components were stored separately. On naval vessels they were kept in different rooms. At SAC bases they were kept in different bunkers, shielded by earthen berms and walls ten feet thick. The storage bunkers, known as “igloos,” were located near runways, by order of the Joint Chiefs, “to provide rapid availability for use” and reduce “the possibility of capture.”

In addition to gaining custody of nuclear weapons, the military also assumed a much larger role in their design. The AEC’s authority had been diminished by a revision of the Atomic Energy Act in 1954 and by an agreement signed the previous year with the Department of Defense. A civilian agency that had once enjoyed complete control over the stockpile became, in effect, a supplier of nuclear weapons for the military. The Army, Navy, and Air Force were now customers whose demands had to be met. The AEC labs at Livermore and Los Alamos aggressively competed for weapon contracts, giving the armed services even greater influence over the design process. The rivalry between the two labs became so intense that at times their dislike for each other seemed to exceed their animosity toward the Soviet Union. When Livermore’s first three designs for hydrogen bombs proved to be duds, it was an expensive setback to America’s weapons program, but a source of much amusement at Los Alamos.

AS THE NUMBER OF storage sites multiplied, so did the need for weapons that were easy to assemble and maintain. Ordinary enlisted men would now be handling hydrogen bombs. The weapons in the stockpile during the mid-1950s were much simpler than the first generation of atomic bombs, and yet they still required a good deal of maintenance. Their batteries were large and bulky and could hold a charge for only about a month. When a battery died, the bomb had to be taken apart. After the battery was recharged, the bomb had to be reassembled, and its electrical system had to be checked. One of the final steps was a test to make sure that all the detonators had been properly connected. If the detonators didn’t work, the bomb would be a dud — but if they were somehow triggered by the maintenance procedure, the bomb could go off. On at least three different occasions during the 1950s, the bridgewire detonators of nuclear weapons were set off by mistake during tests of their electrical systems. These accidents occurred during training exercises, and none resulted in the loss of life. But they revealed a worrisome design flaw. An error during routine maintenance or hurried preparations for war could detonate an atomic bomb.

Bob Peurifoy led a team at Sandia that was trying to create a “wooden bomb” — a nuclear weapon that wouldn’t require frequent maintenance or testing, that could sit on a shelf for years, completely inert, like a plank of wood, and then be pulled from storage, ready to go. Peurifoy had heard about a new kind of battery that didn’t need to be recharged. “Thermal batteries” had been invented by a Nazi rocket scientist, Georg Otto Erb, for use in the V-2 missiles that terrorized Great Britain during the Second World War. Erb revealed how the batteries worked during an interrogation by American intelligence officers after the war. Instead of employing liquid electrolytes, a thermal battery contained solid ones that didn’t generate any electricity until they reached a high internal temperature and melted. Peurifoy thought that thermal batteries would be an ideal power source for a nuclear weapon. They were small, rugged, and lightweight. They had a shelf life of at least twenty-five years, if not longer. And they could produce large amounts of current quickly, after being ignited by an electric pulse. The main drawback of a thermal battery, for most civilian applications, was that it couldn’t be reused or recharged. But Peurifoy didn’t consider that to be much of a problem, since the batteries in a nuclear weapon needed to work only once.

At about the same time that thermal batteries were being added to America’s atomic and hydrogen bombs, another important design change was being developed at Los Alamos. A weapon “boosted” by tritium and deuterium gas would use much less fissile material to produce a large explosion. Right before the moment of detonation, these hydrogen gases would be released into the weapon’s core. When the core imploded, the gases would fuse, release neutrons, multiply the number of fissions, and greatly increase the yield. And because the fissile core would be hollow and thin, a lesser amount of explosives would be needed to implode it. As a result, boosted weapons could be light and small. The first widely deployed hydrogen bomb, the Mark 17, was about twenty-five feet long and weighed roughly forty thousand pounds. The Mark 17 was so big and heavy that the Air Force’s largest bomber could carry only one of them. The Strategic Air Command hoped to replace it eventually with the Mark 28, a boosted weapon. The Mark 28 was eight to twelve feet long, depending on its configuration, and weighed just two thousand pounds. It was small enough and light enough to be delivered by a fighter plane — and a single B-52 could carry at least four of them.

The military advantages of boosted weapons were obvious. But the revolutionary new design raised a number of safety concerns. The nuclear core of a boosted weapon wouldn’t be stored separately. It would be sealed inside the weapon, like the pit within a plum. Boosted, “sealed-pit” weapons would be stored fully assembled, their cores already surrounded by high explosives, their thermal batteries ready to ignite. In many respects, they’d be wooden bombs. And that is what could make them, potentially, so dangerous during an accident.

The first sealed-pit weapon scheduled to enter the stockpile was the Genie, a rocket designed for air defense. Conventional antiaircraft weapons seemed inadequate for destroying hundreds of Soviet bombers during a thermonuclear attack. Failing to shoot down a single plane could mean losing an American city. The Air Force believed that detonating atomic warheads in the skies above the United States and Canada would offer the best hope of success — and that view was endorsed in March 1955 by James R. Killian, the president of MIT, who headed a top secret panel on the threat of surprise attack. At the height of American fears about a bomber gap, atomic antiaircraft weapons promised to counter the Soviet Union’s numerical advantage in long-range bombers, much the same way tactical nuclear weapons were supposed to compensate for the Red Army’s greater troop strength in Europe. The Genie would be carried by Air Force fighter-interceptors. It had a small, 1.5-kiloton warhead and a solid-fueled rocket engine. Unlike conventional air defense weapons, it didn’t need a direct hit to eliminate a target. And it could prove equally useful against a single Soviet bomber or a large formation of them.

Once the enemy was spotted, the fire-control system of the American fighter plane would calculate the distance to the attacker and set the timer of the Genie’s warhead. The fighter pilot would launch the Genie, its rocket motor would burn for about two seconds, and the weapon would shoot toward the target at about three times the speed of sound. The Genie’s nuclear warhead would detonate when the timer ran out. The ensuing fireball would destroy any aircraft within about one hundred yards, and the blast wave would cause severe damage at an even greater distance. But the burst of radiation released by the explosion would pose the most deadly threat to Soviet aircrews. The Genie could miss its target badly and still prove effective. It had a “lethal envelope” with a radius of about a mile, and the “probability of kill” (PK) within that envelope was likely to be 92 percent. The Soviet aircrew’s death from radiation might take as long as five minutes — a delay that made it even more important to fire the Genie as far as possible from urban areas. Detonated at a high altitude, the weapon produced little fallout and didn’t lift any debris from the ground to form a mushroom cloud. After the bright white flash, a circular cloud drifted from the point of detonation, forming an immense smoke ring in the sky.

The Air Force wanted the Genie to be deployed by January 1, 1957. But first the Atomic Energy Commission had to determine whether the weapon was safe. Thousands of Genies would be stored at American airfields. Moreover, thousands of Nike missiles, as well as hundreds of BOMARCS, armed with small nuclear warheads, would soon be deployed in and around dozens of American cities. All of these weapons had been designed to explode in the skies above North America; their detonation on the ground would be catastrophic. “The Department of Defense has a most urgent need for information pertaining to the safety of nuclear weapons,” an AEC official wrote in a top secret memo, as the Genie’s deployment date approached. In the decade or so since the first atomic bomb was dropped, the subject of nuclear weapon safety had received little attention. The bombs had always been stored and transported without their nuclear cores. What would a fuel fire, a high-speed collision, or shrapnel from a nearby explosion do to a sealed-pit weapon? The AEC hurriedly began a series of tests to find out.

Project 56 was the code name for an AEC safety investigation of sealed-pit weapons secretly conducted in a remote valley at the Nevada Test Site. Computers still lacked the processing power to simulate the behavior of a nuclear weapon during an accident, and so actual devices had to be used. Under normal conditions, a sealed-pit weapon would fully detonate when all the explosive lenses surrounding its core went off at once, causing a symmetrical implosion. The AEC’s greatest concern was that an imperfect, asymmetrical implosion — caused, for example, by a bullet setting off some of the high explosives — could produce a nuclear yield.

The Project 56 tests focused on what would happen if one of the explosive lenses were set off at a single point. It was thought almost impossible for more than one bullet or more than one piece of shrapnel to strike a weapon at different points, simultaneously, during an accident. The velocity of these high explosives was so fast that a lens would go off within microseconds of being struck, allowing no time for something else to hit. If the weapon’s high explosives went off at a single point, the nuclear core might simply blow to pieces, without producing any yield. That’s what the scientists of Project 56 hoped to observe: weapons that were “one-point safe.” But the core might also implode just enough to cause a nuclear detonation.

Between November 1955 and January 1956, the nuclear components of four weapon designs underwent safety tests in the Nevada desert. Each device was placed inside a small wooden building — and then a single detonator was set off. Three of the designs passed the test; a one-point detonation didn’t produce any yield. The fourth design failed the test, surprising everyone with a substantial detonation. The Genie’s warhead was among those pronounced one-point safe. But Project 56 revealed that a nuclear detonation wasn’t the only danger that a weapon accident might pose. The core of the Genie contained plutonium — and when it blew apart, plutonium dust spread through the air.

The risks of plutonium exposure were becoming more apparent in the mid-1950s. Although the alpha particles emitted by plutonium are too weak to penetrate human skin, they can destroy lung tissue when plutonium dust is inhaled. Anyone within a few hundred feet of a weapon accident spreading plutonium can inhale a swiftly lethal dose. Cancers of the lung, liver, lymph nodes, and bone can be caused by the inhalation of minute amounts. And the fallout from such an accident may contaminate a large area for a long time. Plutonium has a half-life of about twenty-four thousand years. It remains hazardous throughout that period, and plutonium dust is hard to clean up. “The problem of decontaminating the site of [an] accident may be insurmountable,” a classified Los Alamos report noted a month after the Genie’s one-point safety test, “and it may have to be ‘written off’ permanently.”

The AEC debated whether to remove plutonium from the Genie’s core and use highly enriched uranium instead. In one respect, uranium-235 seemed to be safer. It has a half-life of about seven hundred million years — but emits radiation at a much lower rate than plutonium, greatly reducing the inhalation hazard. And yet a Genie with a uranium core had its own risks. Norris Bradbury, the director of Los Alamos, warned the AEC that such a core was “probably not safe against one-point detonation.” Given the choice between an accident that might cause a nuclear explosion and one that might send a cloud of plutonium over an American city, the Air Force preferred the latter. Handmade, emergency capability Genies were rushed into production, with cores that contained plutonium.

Once Soviet bombers were within range, air defense weapons like the Genie had to be fired immediately. Any delay in authorizing their use could allow some planes to reach their targets. Toward the end of 1955, the Joint Chiefs of Staff sought permission to use atomic air defense weapons — without having to ask the president. They argued that if such authority was “predelegated,” the military could respond instantly to an attack. Secretary of Defense Wilson backed the Joint Chiefs, arguing that it was “critical” for the Air Force to have some sort of advance authorization.

Harry Truman had insisted, repeatedly, that the president of the United States should be the only person allowed to order the use of a nuclear weapon. But the nature of the Soviet threat had changed, and President Eisenhower had more faith in the discipline of the American military. In April 1956, Eisenhower signed a predelegation order that authorized the use of atomic weapons for air defense within the United States and along its borders. The order took effect the following December, after rules of engagement were approved by the secretary of defense. Those rules allowed American planes to fire Genies at any Soviet aircraft that appeared “hostile.” Air Force commanders were granted wide latitude to decide when these nuclear weapons could be used. But the Joint Chiefs demanded “strict command control [sic] of forces engaged in air defense.” The Genies had to be kept locked away in storage igloos, never to be flown over the United States, until the nation was under attack.

For years the Department of Defense had refused to discuss where America’s nuclear weapons were deployed. “We will neither confirm nor deny” was the standard response whenever a journalist asked if atomic or hydrogen bombs were kept at a specific location. The policy was justified by the need for military secrecy — and yet the desire to avoid controversy and maintain good public relations was just as important. When atomic bombs were first transferred to SAC bases in French Morocco, the French government wasn’t told about the weapons. But the deployment of Genies at air bases throughout the United States was announced in an Air Force press release. According to a secret Pentagon memo, publicity that stressed the safety and effectiveness of the new weapon “should have a positive effect on national morale.” And information about the Genie’s lethal radius might be discouraging for Soviet aircrews.

“The possibility of any nuclear explosion occurring as a result of an accident involving either impact or fire is virtually nonexistent,” Secretary of Defense Wilson assured the public. His press release about the Genie didn’t mention the risk of plutonium contamination. It did note, however, that someone standing on the ground directly beneath the high-altitude detonation of a Genie would be exposed to less radiation than “a hundredth of a dose received in a standard (medical) X-ray.” To prove the point, a Genie was set off 18,000 feet above the heads of five Air Force officers and a photographer at the Nevada test site. The officers wore summer uniforms and no protective gear. A photograph, taken at the moment of detonation, shows that two of the men instinctively ducked, two shielded their eyes, and one stared upward, looking straight at the blast. “It glowed for an instant like a newborn sun,” Time magazine reported, “then faded into a rosy, doughnut-shaped cloud.”

IN JANUARY 1957 THE SECRETARY of the Air Force, Donald A. Quarles, visited Sandia to attend briefings on the latest sealed-pit weapons. Quarles left the meetings worried about the safety of the Genie, and he was unusually qualified to pass judgment. He’d served for two years as assistant secretary of defense for research and development, helping to select new weapon systems, guiding the Pentagon’s investment in new technologies, and contemplating the future of warfare. He’d also spent a year as president of Sandia, immersed in the minutiae of atomic bombs. Small, wiry, brilliant, and intense, a high school graduate at the age of fifteen who later studied math and physics at Yale, Quarles felt the weight of his job, his place at the very epicenter of the arms race. He rarely took vacations and could often be found at his Pentagon office, late into the night, six or seven days a week. Only a handful of people understood, as well as Quarles did, how America’s nuclear weapons worked — and how the military planned to use them.

Within weeks of the briefings for Quarles at Sandia, the Armed Forces Special Weapons Project created a safety board to scrutinize the design of every sealed-pit weapon in development. The Air Force soon commissioned wide-ranging studies of whether a nuclear weapon could be detonated by accident. And in July 1957, Quarles asked the Atomic Energy Commission to conduct the nation’s first comprehensive inquiry into the possibilities for increasing the safety of nuclear weapons. The AEC agreed to do it, and a team of Sandia engineers was given the lead role.

One of the inquiry’s first tasks was to compile a list of the accidents that had already occurred with nuclear weapons. The list would be useful for predicting not only what might happen to the new sealed-pit designs in the field but also the frequency of mishaps. The Department of Defense didn’t always notify the AEC about nuclear weapon accidents — and a thorough accounting of them proved difficult to obtain. The Air Force eventually submitted a list of eighty-seven accidents and incidents that had occurred between 1950 and the end of 1957. Sandia found an additional seven that the Air Force had somehow neglected to include. Neither the Army nor the Navy submitted a list; they’d failed to keep track of their nuclear accidents. More than one third of those on the Air Force list involved “war reserve” atomic or hydrogen bombs — weapons that could be used in battle. The rest involved training weapons. And all of the accidents shed light on the many unforeseeable ways that things could go wrong.

An accident might be caused by a mechanical problem. On February 13, 1950, a B-36 bomber took off from Eielson Air Force Base, about thirty miles south of Fairbanks, Alaska. The crew was on a training mission, learning how to operate from a forward base near the Arctic. The weather at Eielson was windy and snowy, and the ground temperature had risen in the previous few hours. It was about –27 degrees Fahrenheit. Captain Harold L. Barry and sixteen crew members had been fully briefed on the mission: fly to Montana, turn around, go to Southern California, turn again, head north to San Francisco, simulate the release of a Mark 4 atomic bomb above the city, and then land at a SAC base in Fort Worth, Texas. The mission would take about twenty hours.

In the middle of the night, as the B-36 reached an altitude of fifteen thousand feet, it started to lose power. Ice had accumulated on the engines, as well as on the wings and propellers. The crew couldn’t see the ice — visibility was poor, due to the darkness, cloud cover, and frost on the windows. But they could hear chunks of ice hitting the plane. It sounded like a hailstorm.

Ice clogged the carburetors, three of the six engines caught fire, and the bomber rapidly lost altitude. Captain Barry managed to guide the plane over the ocean not far from Princess Royal Island, in British Columbia, Canada. He ordered a copilot to open the bomb bay doors and dump the Mark 4. The doors were stuck and wouldn’t open. The copilot tried again, the doors opened, and the Mark 4 fell from the plane. Its high explosives detonated three thousand feet above the water, and a bright flash lit the night sky. The bomb did not contain a nuclear core.

Navigating solely by radar, Captain Barry steered the plane back toward land and ordered the crew to bail out. One of the copilots, Captain Theodore Schreier, mistakenly put on a life jacket over his parachute. He was never seen again. The first four men to jump from the plane also vanished, perhaps carried by the wind into the ocean. Captain Barry, the last to go, parachuted safely onto a frozen lake, hiked for miles through deep snow to the coast, and survived, along with the rest of his crew. The abandoned B-36 somehow flew another two hundred miles before crashing on Vancouver Island.

An accident could occur during the loading, unloading, or movement of weapons. On at least four occasions, the bridgewire detonators of Mark 6 atomic bombs fired when the weapons were improperly removed from aircraft. They were training weapons, and nobody got hurt. But with the new sealed-pit weapons, that sort of mistake would cause a full-scale nuclear detonation. At least half a dozen times, the carts used to carry Mark 6 bombs broke away from the vehicles towing them. During one incident, the cart rolled into a ditch; had it rolled in another direction, a classified report noted, “a live Mk6 weapon” would have “plunged over a steep embankment.” Dropping a nuclear weapon was never a good idea. Impact tests revealed that when the Genie was armed, it didn’t need a firing signal to detonate. The Genie could produce a nuclear explosion just by hitting the ground.

An accident could be made worse by the response. In the early days of the Korean War, amid fears that Japan and Taiwan might be attacked, a B-29 bomber prepared to take off from Fairfield-Suisun Air Force Base in California. It was ten o’clock at night. The mission was considered urgent, its cargo top secret — one of the nine Mark 4 atomic bombs being transferred to Guam, at President Truman’s request. The cores would be airlifted separately. Brigadier General Robert F. Travis sat in the cockpit as a high-level escort for the weapon. Travis had displayed great courage during the Second World War, leading thirty-five bombing missions for the Eighth Air Force. As the B-29 gained speed, one of its engines failed near the end of the runway. The bomber lifted off the ground, and then a second engine failed.

The pilot, Captain Eugene Steffes, tried to retract the landing gear and reduce drag, but the wheels were stuck, and the plane was heading straight toward a hill. He put the B-29 into a steep 180-degree turn, hoping to land at the base. The plane began to stall, with a trailer park directly in its path. Steffes banked to the left, narrowly missing the mobile homes. The B-29 hit the ground, slid through a field, caught on fire, and broke into pieces. When it came to a stop, the crew struggled to get out, but the escape hatches were jammed.

Sergeant Paul Ramoneda, a twenty-eight-year-old baker with the Ninth Food Service Squadron, was one of the first to reach the bomber. He helped to pull Steffes from the cockpit. General Travis was found nearby, unconscious on the ground. Ambulances, fire trucks, and police cars soon arrived at the field, along with hundreds of enlisted men and civilians, many of them awakened by the crash, now eager to help out or just curious to see what was going on. The squadron commander, Ray Holsey, told everyone to get away from the plane and ordered the firefighters to let it burn. Flares and .50 caliber ammunition had begun to go off in the wreckage, and Holsey was afraid that the five thousand pounds of high explosives in the atomic bomb would soon detonate. The crowd and the firefighters ignored him. Holsey, the highest-ranking officer on the scene, ran away as fast as he could.

Sergeant Ramoneda wrapped his baker’s apron around his head for protection from the flames and returned to the burning plane, searching for more survivors. Moments later, the high explosives in the Mark 4 detonated. The blast could be heard thirty miles away. It killed Ramoneda and five firefighters, wounded almost two hundred people, destroyed all of the base’s fire trucks, set nearby buildings on fire, and scattered burning fuel and pieces of molten fuselage across an area of about two square miles. Captain Steffes and seven others on the plane escaped with minor injuries. Twelve crew members and passengers died, including General Travis, in whose honor the base was soon renamed. The Air Force told the press that the B-29 had been on “a long training mission,” without mentioning that an atomic bomb had caused the explosion.

An accident could involve more than one weapon. On July 27, 1956, an American B-47 bomber took off from Lakenheath Air Base in Suffolk, England. It was, in fact, on a routine training flight. The plane did not carry a nuclear weapon. Captain Russell Bowling and his crew were scheduled to perform an aerial refueling, a series of touch-and-go landings, and a test of the B-47’s radar system. The first three touch-and-go landings at Lakenheath went smoothly. The plane veered off the runway during the fourth and slammed into a storage igloo containing Mark 6 atomic bombs. A SAC officer described the accident to LeMay in a classified telegram:

The cores were stored in a different igloo. If the B-47 had struck that igloo instead, tearing it open and igniting it, a cloud of plutonium could have floated across the English countryside.

THE ENGINEERS AT SANDIA knew that nuclear weapons could never be made perfectly safe. Oskar Morgenstern — an eminent Princeton economist, military strategist, and Pentagon adviser — noted the futility of seeking that goal. “Some day there will be an accidental explosion of a nuclear weapon,” Morgenstern wrote. “The human mind cannot construct something that is infallible… the laws of probability virtually guarantee such an accident.” Every nation that possessed nuclear weapons had to confront the inherent risk. “Maintaining a nuclear capability in some state of readiness is fundamentally a matter of playing percentages,” a Sandia report acknowledged. In order to reduce the danger, weapon designers and military officials wrestled with two difficult but interconnected questions: What was the “acceptable” probability of an accidental nuclear explosion? And what were the technical means to keep the odds as low as possible?

The Army’s Office of Special Weapons Developments had addressed the first question in a 1955 report, “Acceptable Military Risks from Accidental Detonation of Atomic Weapons.” It looked at the frequency of natural disasters in the United States during the previous fifty years, quantified their harmful effects according to property damage and loss of life — and then argued that accidental nuclear explosions should be permitted on American soil at the same rate as similarly devastating earthquakes, floods, and tornadoes. According to that formula, the Army suggested that the acceptable probability of a hydrogen bomb detonating within the United States should be 1 in 100,000 during the course of a year. The acceptable risk of an atomic bomb going off was set at 1 in 125.

After Secretary of the Air Force Quarles expressed concern about the safety of sealed-pit weapons, the Armed Forces Special Weapons Project began its own research on acceptable probabilities. The Army had assumed that the American people would regard a nuclear accident no differently from an act of God. An AFSWP study questioned the assumption, warning that the “psychological impact of a nuclear detonation might well be disastrous” and that “there will likely be a tendency to blame the ‘irresponsible’ military and scientists.” Moreover, the study pointed out that the safety of nuclear weapons already in the American stockpile had been measured solely by the risk of a technical malfunction. Human error had been excluded as a possible cause of accidents; it was thought too complex to quantify. The AFSWP study criticized that omission: “The unpredictable behavior of human beings is a grave problem when dealing with nuclear weapons.”

In 1957 the Armed Forces Special Weapons Project offered a new set of acceptable probabilities. For example, it proposed that the odds of a hydrogen bomb exploding accidentally — from all causes, while in storage, during the entire life of the weapon — should be one in ten million. And the lifespan of a typical weapon was assumed to be ten years. At first glance, those odds made the possibility of a nuclear disaster seem remote. But if the United States kept ten thousand hydrogen bombs in storage for ten years, the odds of an accidental detonation became much higher — one in a thousand. And if those weapons were removed from storage and loaded onto airplanes, the AFSWP study proposed some acceptable probabilities that the American public, had it been informed, might not have found so acceptable. The odds of a hydrogen bomb detonating by accident, every decade, would be one in five. And during that same period, the odds of an atomic bomb detonating by accident in the United States would be about 100 percent.

All of those probabilities, acceptable or unacceptable, were merely design goals. They were based on educated guesses, not hard evidence, especially when human behavior was involved. The one-point safety of a nuclear weapon seemed like a more straightforward issue. It would be determined by phenomena that were quantifiable: the velocity of high explosives, the mass and geometry of a nuclear core, the number of fissions that could occur during an asymmetrical implosion. But even those things were haunted by mathematical uncertainty. The one-point safety tests at Nevada Test Site had provided encouraging results, and yet the behavior of a nuclear weapon in an “abnormal environment” — like that of a fuel fire ignited by a plane crash — was still poorly understood. During a fire, the high explosives of a weapon might burn; they might detonate; or they might burn and then detonate. And different weapons might respond differently to the same fire, based on the type, weight, and configuration of their high explosives. For firefighting purposes, each weapon was assigned a “time factor” — the amount of time you had, once a weapon was engulfed in flames, either to put out the fire or to get at least a thousand feet away from it. The time factor for the Genie was three minutes.

Even if a weapon could be made fully one-point safe, it might still detonate by accident. A glitch in the electrical system could potentially arm a bomb and trigger all its detonators. Carl Carlson, a young physicist at Sandia, came to believe that the design of a nuclear weapon’s electrical system was the “real key” to preventing accidental detonations. The heat of a fire might start the thermal batteries, release high-voltage electricity into the X-unit, and then set off the bomb. To eliminate that risk, heat-sensitive fuses were added to every sealed-pit weapon. At a temperature of 300 degrees Fahrenheit, the fuses would blow, melting the connections between the batteries and the arming system. It was a straightforward, time-honored way to interrupt an electrical circuit, and it promised to ensure that a high temperature wouldn’t trigger the detonators. But Carlson was still worried that in other situations a firing signal could still be sent to a nuclear weapon by accident or by mistake.

A strong believer in systems analysis and the use of multiple disciplines to solve complex questions, Carlson thought that adding heat-sensitive fuses to nuclear weapons wasn’t enough. The real safety problem was more easily stated than solved: bombs were dumb. They responded to simple electrical inputs, and they had no means of knowing whether a signal had been sent deliberately. In the cockpit of a SAC bomber, the T-249 control box made it easy to arm a weapon. First you flicked a toggle switch to ON, allowing power to flow from the aircraft to the bomb. Then you turned a knob from the SAFE position either to GROUND or to AIR, setting the height at which the bomb would detonate. That was all it took — and if somebody forgot to return the knob to SAFE, the bomb would remain armed, even after the power switch was turned off. Writing on behalf of Sandia and the other weapon labs, Carlson warned that an overly simplistic electrical system increased the risk of a full-scale detonation during an accident: “a weapon which requires only the receipt of intelligence from the delivery system for arming will accept and respond to such intelligence whether the signals are intentional or not.”

The need for a nuclear weapon to be safe and the need for it to be reliable were often in conflict. A safety mechanism that made a bomb less likely to explode during an accident could also, during wartime, render it more likely to be a dud. The contradiction between these two design goals was succinctly expressed by the words “always/never.” Ideally, a nuclear weapon would always detonate when it was supposed to — and never detonate when it wasn’t supposed to. The Strategic Air Command wanted bombs that were safe and reliable. But most of all, it wanted bombs that worked. A willingness to take personal risks was deeply embedded in SAC’s institutional culture. Bomber crews risked their lives every time they flew a peacetime mission, and the emergency war plan missions for which they trained would be extremely dangerous. The crews would have to elude Soviet fighter planes and antiaircraft missiles en route to their targets, survive the blast effects and radiation after dropping their bombs, and then somehow find a friendly air base that hadn’t been destroyed. They would not be pleased, amid the chaos of thermonuclear warfare, to learn that the bombs they dropped didn’t detonate because of a safety device.

Civilian weapon designers, on the other hand, were bound to have a different perspective — to think about the peacetime risk of an accident and err on the side of never. Secretary of the Air Force Quarles understood the arguments on both sides. He worried constantly about the Soviet threat. And he had pushed the Atomic Energy Commission to find methods of achieving “a higher degree of nuclear safing.” But if compromises had to be made between always and never, he made clear which side would have to bend. “Such safing,” Quarles instructed, “should, of course, cause minimum interference with readiness and reliability.”

The Optimum Mix

“A super long-distance intercontinental multistage ballistic rocket was launched a few days ago,” the Soviet Union announced during the last week of August 1957. The news didn’t come as a surprise to Pentagon officials, who’d secretly monitored the test flight with help from a radar station in Iran. But the announcement six weeks later that the Soviets had placed the first manmade satellite into orbit caught the United States off guard — and created a sense of panic among the American people. Sputnik 1 was a metallic sphere, about the size of a beach ball, that could do little more than circle the earth and transmit a radio signal of “beep-beep.” Nevertheless, it gave the Soviet Union a huge propaganda victory. It created the impression that “the first socialist society” had surpassed the United States in missile technology and scientific expertise. The successful launch of Sputnik 2, on November 3, 1957, seemed even more ominous. The new satellite weighed about half a ton; rocket engines with enough thrust to lift that sort of payload could be used to deliver a nuclear warhead. Sputnik 2 also carried the first animal to orbit the earth, a small dog named Laika — evidence that the Soviet Union was planning to put a man in space. Although the Soviets boasted that Laika lived for a week in orbit, wearing a little space suit, housed in a pressurized compartment with an ample supply of food and water, she actually died within a few hours of liftoff.

Democrats in Congress whipped up fears of Soviet missiles and attacked the Eisenhower administration for allowing the United States to fall behind. The Democratic Advisory Council said that President Eisenhower had “weakened the free world” and “starved the national defense.” Henry “Scoop” Jackson, a Democratic senator from Washington, called Sputnik “a devastating blow to U.S. prestige.” Lyndon Baines Johnson, the Senate majority leader, scheduled hearings to investigate what had gone wrong with America’s defense policies. Johnson’s staff director, George Reedy, urged him “to plunge heavily” into the missile controversy, suggesting that it could “blast the Republicans out of the water, unify the Democratic Party, and elect you President.” Another Democratic senator, John F. Kennedy, later accused Eisenhower of putting “fiscal security ahead of national security” and made the existence of a “missile gap” one of the central issues in his presidential campaign.

The Democratic effort to create anxiety about a missile gap was facilitated by Nikita Khrushchev, first secretary of the Communist Party of the Soviet Union. In a series of public comments over the next few years, Khrushchev belittled the American military and bragged about his nation’s technological achievements:

Khrushchev had condemned Stalin’s crimes in 1956, released political prisoners, gained a reputation as a reformer, and proposed a ban on nuclear weapons in central Europe. But he’d also ordered Soviet troops to invade Hungary and overthrow its government. More than twenty thousand Hungarian citizens were killed by the Red Army, and hundreds more were later executed. The thought of Khrushchev in command of so many long-range missiles seemed chilling.

President Eisenhower tried to calm the hysteria about Soviet missiles and address the criticism that his administration had become passive, timid, and out of touch. He felt confident that large increases in defense spending were unnecessary — and that the Strategic Air Command had more than enough nuclear weapons to deter the Soviet Union. He was particularly irritated by a secret report submitted to him during the first week of November. A high-level committee led by H. Rowan Gaither, a former president of the Ford Foundation, called for tens of billions of dollars to be spent on new missile programs and a nationwide system of fallout shelters. Eisenhower thought that the Gaither committee had an exaggerated view of the Soviet threat. In a televised speech on November 7, 1957, Eisenhower stressed that there was no reason to panic: the military strength of the free world was much greater than that of the Communists. “It misses the whole point to say that we must now increase our expenditures on all kinds of military hardware and defense,” he said, with frustration.

The speech had little effect. On the morning of November 25, Lyndon Johnson opened the Senate hearings by asserting that “we have slipped dangerously behind the Soviet Union in some very important fields,” and an influential newspaper columnist described the Gaither report as “just about the grimmest warning” in American history. While working in the Oval Office that day, Eisenhower had a stroke and suddenly found himself unable to speak. A week and a half later, a Vanguard rocket carrying America’s first manmade satellite was launched at Cape Canaveral, Florida, before hundreds of reporters and a live television audience. The Vanguard rose about four feet into the air, hesitated, fell back to the launchpad, and exploded.

The Pentagon had good reason to be concerned about the Soviet Union’s long-range missiles, regardless of the actual number. A Soviet bomber would approach the United States at about five hundred miles per hour — and the warhead of a Soviet missile would come at about sixteen thousand miles per hour. With luck, a bomber might be shot down. But no technology yet existed to destroy a nuclear warhead, midflight. And a missile attack would give the United States little time to prepare its response. Soviet bombers would take eight or nine hours to reach the most important American targets; Soviet missiles could hit them in thirty minutes or less. Early warning of a ballistic missile attack would be necessary to protect the nation’s leadership and ensure that SAC’s retaliatory force could get off the ground. That sort of warning, however, might never come. The DEW Line radars had been designed to track enemy aircraft, not missiles, and the Pentagon had no means of detecting ICBMs once they’d been launched.

After Sputnik, the Air Force gained swift approval to construct the Ballistic Missile Early Warning System (BMEWS), three huge radars that would spot Soviet missiles heading toward the United States. One of the radars would be built at Thule Air Base, Greenland; another at Clear Air Force Base, Alaska; and the third in the North Yorkshire Moors, England. Until the BMEWS was completed, however, the first sign of a Soviet missile attack would probably be mushroom clouds rising above SAC bases and American cities. Work immediately began on a bomb alarm system that would instantly let the president know when cities and air bases were being destroyed. Hundreds of small, innocuous-looking metal canisters were placed atop buildings and telegraph poles throughout the United States. Optical sensors inside the canisters, according to a classified account of the system, would detect the characteristic flash of a nuclear explosion, “locate precise blast locations, and indicate the intensity and pattern of the attack.” At SAC headquarters, green lights dotting a map of the United States would turn red to display each nuclear detonation. The amount of warning time that the Bomb Alarm System could provide was far from ideal, especially if the Soviets managed to synchronize their missile launches, so that all the warheads landed at once — but it seemed better than nothing.

General LeMay had been concerned for years about the threat that missiles could pose to the Strategic Air Command. In 1956, SAC had begun to test a plan that would keep some of its bombers constantly on alert and get them airborne half an hour after being warned of an attack. The logistics of such a “ground alert” were daunting. Crews would need to sleep near the runways and run for their planes the moment that a Klaxon sounded. Bombers would be parked fully loaded with nuclear weapons and fuel; the planes were said to be “cocked,” like the hammer of a pistol. Tankers for aerial refueling would be loaded as well and prepared for takeoff. By the fall of 1957, ground alerts had become routine at SAC bases in the United States, Great Britain, and Morocco. And the Strategic Air Command hoped that, within a year, at least one third of its bombers would always be parked beside runways, ready to get off the ground within fifteen minutes.

The successful launch of the two Sputniks created the possibility that, during a missile attack, SAC might not have fifteen minutes to launch the ground alert planes. LeMay had recently been promoted to serve as the vice chief of staff at the Air Force, and his replacement at SAC, General Thomas S. Power, pushed hard for approval of an even bolder tactic: the “airborne alert.” Power was widely considered, among fellow officers at SAC, to be a mean son of a bitch. Born in New York City and raised in Great Neck, Long Island, he’d dropped out of high school, worked in construction, returned to high school at the age of twenty, earned a degree, and joined the Army Air Corps in 1928. He later flew the lead plane during the firebombing of Tokyo and served as vice commander at SAC. He often played the role of LeMay’s “hatchet man,” firing people, enforcing discipline, and making sure that orders were carried out. The two men shared a strategic outlook but had different management styles. LeMay expressed disapproval with a stony silence or a few carefully chosen words; Power yelled and swore at subordinates. The warmth behind LeMay’s gruff exterior, the intense devotion to the well-being of his men, was harder to find in his successor. Even LeMay admitted that Power was a sadist, “sort of an autocratic bastard” — and yet “he got things done.” Kindness, sensitivity, and a genial disposition were not essential traits for a commander planning to win a nuclear war.

The basic premise of SAC’s airborne alert was hard to refute: planes that were already in the air wouldn’t be destroyed by missiles that hit bases on the ground. Keeping a portion of the bomber fleet airborne at all times would allow the United States to retaliate after a surprise attack. During an airborne alert, American bombers would take off and fly within striking distance of the Soviet Union. If the planes failed to receive a “Go” code, they’d turn around at a prearranged spot, circle for hours, and then return to their bases. The plan erred on the side of safety — a breakdown in communications between SAC headquarters and one of the bombers would end its mission without any bombs being dropped. The mission would “fail safe,” an engineering term for components designed to break without causing harm. The fail-safe measures of an airborne alert could reduce the effectiveness of SAC’s nuclear retaliation, once America was at war: bombers that didn’t receive a Go code would circle and then return home, leaving their targets untouched. But the alternative — an airborne alert in which crews were ordered to fly to the Soviet Union and bomb it, unless they received some sort of “Don’t Go” code from headquarters — could easily start a war by mistake. That sort of mission was bound, at some point, to “fail deadly.”

“DAY AND NIGHT, I HAVE a certain percentage of my command in the air,” General Power told the press, the week after the second Sputnik launch. “These planes are bombed up and they don’t carry bows and arrows.” The message to the Soviet Union was unmistakable: SAC’s ability to retaliate wouldn’t be diminished by intercontinental ballistic missiles. But Power was bluffing. The airborne alert existed only on paper, and the United States didn’t keep bombers in the air, day and night, ready to strike. Carrying nuclear weapons over populated areas was still considered too dangerous. Designers at the weapons labs had been surprised to hear about SAC’s ground alert. Aside from the occasional training exercise, the Atomic Energy Commission had always assumed that hydrogen bombs and atomic bombs would be safely locked away in igloos until the nation was at war. The idea of parking bombers near runways, loaded with nuclear weapons and fuel, had been proposed by LeMay, backed by the Joint Chiefs, and approved by President Eisenhower without input from Los Alamos or Sandia.

An airborne alert would be much riskier. The safety questions about the new sealed-pit weapons hadn’t been resolved. And if older weapons were used during an airborne alert, their nuclear cores would have to be placed, before takeoff, into an “in-flight insertion” mechanism. It held the core about a foot outside the sphere of explosives, while the plane was en route to the target — and then pushed the core all the way inside the sphere, using a motor-driven screw, when the bomb was about to be dropped. The contraption made the weapon safer to transport, but not much. Once the core was placed into this mechanism, according to a Sandia report, “nuclear safety is not ‘absolute,’ it is nonexistent.” The odds of a nuclear detonation during a crash or a fire would be about one in seven.

Weapon safety became an ongoing point of contention between the Strategic Air Command and the Atomic Energy Commission. General Power not only wanted to start an airborne alert as soon as possible, he also wanted SAC’s ground-alert bombers to take off and land with fully assembled weapons during drills. When the AEC suggested that dummy weapons could be used instead, the Air Force came up with a series of arguments for why that would be “operationally unsuitable.” During an emergency, having dummy weapons onboard would “degrade the reaction time to an unacceptable degree,” SAC’s director of operations argued. They’d hurt “crew morale and motivation,” and they were hard to obtain. The typical air base had only seven dummy weapons, SAC claimed, a scarcity that made it necessary to train with real ones. Although the Atomic Energy Commission no longer retained physical possession of the hydrogen bombs stored at SAC bases, it still had legal custody. The AEC refused to allow any fully assembled bombs to be flown on SAC bombers. That prohibition applied to sealed-pit weapons and to older weapons with their cores attached. Crews were permitted, however, to train with fully assembled bombs and to load them onto planes — so long as the planes never left the ground.

SAC’s arguments on behalf of an airborne alert were strengthened by the apparent shortcomings in the American missile program. A week before the launch of Sputnik 1, an Atlas long-range missile had failed spectacularly in the sky above Cape Canaveral, Florida. It was the second Atlas failure of the year. Near the end of the Second World War, the United States and the Soviet Union had fiercely competed to recruit Nazi rocket scientists. Although the three leading figures in Germany’s V-2 program — Wernher von Braun, Arthur Rudolph, and Walter Dornberger — were secretly brought to the United States and protected from war crimes trials, for almost a decade after the war the Air Force showed little enthusiasm for long-range missiles. The V-2 had proven to be wildly inaccurate, more effective at inspiring terror in London than hitting specific targets. An intercontinental ballistic missile with the same accuracy as the V-2, fired at the Soviet Union from an American launchpad, was likely to miss its target by about one hundred miles. Curtis LeMay thought bombers were more reliable than missiles, more versatile and precise. He wanted SAC to develop nuclear-powered bombers, capable of remaining airborne for weeks. But as thermonuclear weapons became small enough and light enough to be mounted atop a missile, accuracy became less of an issue. An H-bomb could miss a target by a wide margin and still destroy it. Even LeMay admitted that an accurate intercontinental ballistic missile would be “the ultimate weapon.”

During the fall of 1957, the United States had six different strategic missiles in development, with rival bureaucracies fighting not only for money but also for a prominent role in the emergency war plan. On behalf of the Army, Wernher von Braun’s team was developing an intermediate-range missile, the Jupiter, that could travel 1,500 miles and hit Soviet targets from bases in Europe. The Air Force was working on an almost identical intermediate-range missile, the Thor, as well as three long-range missiles — Atlas, Titan, and Minuteman. The Navy was pursuing its own intermediate-range missile, the Polaris, having decided not to deploy the Army’s Jupiter in submarines. The interservice rivalry over missiles was exacerbated by the competition among the defense contractors hoping to build them. The General Dynamics Corporation lobbied aggressively for Atlas; the Martin Company, for Titan; Boeing, for Minuteman; Douglas Aircraft, for Thor; Chrysler, for Jupiter; and Lockheed, for Polaris. President Eisenhower planned to fund two or three of these missile programs and cancel the rest, based on their merits and the nation’s strategic needs. Amid Democratic accusations of a missile gap, Eisenhower agreed to fund all six.

The Sputnik launches also complicated America’s relationship with its NATO allies. The Soviet Union appeared to have gained a technological advantage, and the United States no longer seemed invincible. NATO ministers began to wonder if an American president really would defend Berlin or Paris, when that could mean warheads landing in New York City within an hour. Khrushchev’s boasts about long-range missiles were accompanied by a Soviet “peace campaign” that called for nuclear disarmament and an end to nuclear weapon tests. For years, the World Peace Council, backed by the Soviet Union and Communist China, had been promoting efforts to “Ban the Bomb.” The slogan had a strong resonance in Great Britain, Germany, the Netherlands, and France, countries that felt trapped in the middle of an arms race between the superpowers, that had already endured two world wars and now rebelled against preparations for a third. While public opinion in Western Europe increasingly turned against nuclear weapons, the leadership of NATO sought an even greater reliance on them. The French, in particular, had long argued that the United States should cede control of its nuclear weapons based in Europe. Giving the weapons to NATO would allow the alliance to use them quickly in an emergency — and prevent an American president from withholding them, regardless of any last-minute doubts. It would demonstrate that the fate of Europe and the United States were inextricably linked.

In December 1957, President Eisenhower traveled to a NATO summit in Paris, only weeks after his stroke, and announced that the United States would provide its European allies with access to nuclear weapons. He offered to create a separate nuclear stockpile for NATO and build intermediate-range missile sites in NATO countries. The offer stopped short of actually handing over missiles and bombs. The Atomic Energy Act prohibited the transfer of nuclear weapons to a foreign power; custody of the NATO stockpile would have to remain with the United States. The Eisenhower administration tried to strike a balance between physical control and legal custody, between sharing the weapons with allies in a meaningful way and obeying the will of Congress. As plans emerged to put intermediate-range missiles in Great Britain, Italy and Turkey, to store atom bombs and hydrogen bombs and atomic artillery shells at NATO bases throughout Europe, the tricky issue of command and control was resolved with a technical solution. The launch controls of the missiles and the locks on the weapon igloos would require at least two keys — and an American officer would keep one of them.

THE MARK 36 was a second-generation hydrogen bomb. It weighed about half as much as the early thermonuclears — but ten times more than the new, sealed-pit bombs that would soon be mass-produced for SAC. It was a transitional weapon, mixing old technologies with new, featuring thermal batteries, a removable core, and a contact fuze for use against underground targets. The nose of the bomb contained piezoelectric crystals, and when the nose hit the ground, the crystals deformed, sending a signal to the X-unit, firing the detonators, and digging a very deep hole. The bomb had a yield of about 10 megatons. It was one of America’s most powerful weapons.

A B-47 bomber was taxiing down the runway at a SAC base in Sidi Slimane, Morocco, on January 31, 1958. The plane was on ground alert, practicing runway maneuvers, cocked but forbidden to take off. It carried a single Mark 36 bomb. To make the drill feel as realistic as possible, a nuclear core had been placed in the bomb’s in-flight insertion mechanism. When the B-47 reached a speed of about twenty miles an hour, one of the rear tires blew out. A fire started in the wheel well and quickly spread to the fuselage. The crew escaped without injury, but the plane split in two, completely engulfed in flames. Firefighters sprayed the burning wreckage for ten minutes — long past the time factor of the Mark 36 — then withdrew. The flames reached the bomb, and the commanding general at Sidi Slimane ordered that the base be evacuated immediately. Cars full of airmen and their families sped into the Moroccan desert, fearing a nuclear disaster.

The fire lasted for two and a half hours. The high explosives in the Mark 36 burned but didn’t detonate. According to an accident report, the hydrogen bomb and parts of the B-47 bomber melted into “a slab of slag material weighing approximately eight thousand pounds, approximately six to eight feet wide and twelve to fifteen feet in length with a thickness of ten to twelve inches.” A jackhammer was used to break the slag into smaller pieces. The “particularly ‘hot’ pieces” were sealed in cans, and the rest of the radioactive slag was buried next to the runway. Sidi Slimane lacked the proper equipment to measure levels of contamination, and a number of airmen got plutonium dust on their shoes, spreading it not just to their car but also to another air base.

The Air Force planned to issue a press release about the accident, stressing that the aircraft fire hadn’t led to “explosion of the weapon, radiation, or other unexpected results.” The State Department thought that was a bad idea; details about the accident hadn’t reached Europe or the United States. “The less said about the Moroccan incident the better,” one State Department official argued at a meeting on how much information to disclose. A public statement might be distorted by Soviet propaganda and create needless anxiety in Europe. The Department of Defense agreed to keep the accident secret, although the king of Morocco was informed. When an American diplomat based in Paris asked for information about what had happened at Sidi Slimane, the State Department told him that the base commander had decided to stage a “practice evacuation.”

Two weeks after an accident that could have detonated a hydrogen bomb in Morocco, the Department of Defense and the Atomic Energy Commission issued a joint statement on weapon safety. “In reply to inquiries about hazards which may be involved in the movement of nuclear weapons,” they said, “it can be stated with assurance that the possibility of an accidental nuclear explosion… is so remote as to be negligible.”

Less than a month later, Walter Gregg and his son, Walter Junior, were in the toolshed outside their home in Mars Bluff, South Carolina, when a Mark 6 atomic bomb landed in the yard. Mrs. Gregg was inside the house, sewing, and her daughters, Helen and Frances, aged six and nine, were playing outdoors with a nine-year-old cousin. The Mark 6 had a variable yield of anywhere from 8 to 160 kilotons, depending on the type of nuclear core that was used. The bomb that landed in the yard didn’t contain a core. But the high explosives went off when the weapon hit the ground, digging a crater about fifty feet wide and thirty-five feet deep. The blast wave and flying debris knocked the doors off the Gregg house, blew out the windows, collapsed the roof, riddled the walls with holes, destroyed the new Chevrolet parked in the driveway, killed half a dozen chickens, and sent the family to the hospital with minor injuries.

The atom bomb had been dropped by a B-47 en route from Hunter Air Force Base near Savannah, Georgia, to Bruntingthorpe Air Base in Leicestershire, England. The locking pin had been removed from the bomb before takeoff, a standard operating procedure at SAC. Nuclear weapons were always unlocked from their bomb racks during takeoff and landing — in case the weapons had to be jettisoned during an emergency. But for the rest of the flight they were locked to the racks. Bombs were locked and unlocked remotely on the B-47, using a small lever in the cockpit. The lever was attached by a lanyard to the locking pin on the bomb. As the B-47 above South Carolina climbed to an altitude of about fifteen thousand feet, a light on the instrument panel said that the pin hadn’t reengaged. The lever didn’t seem to be working. The pilot told the navigator, Captain Bruce Kulka, to enter the bomb bay and insert the locking pin by hand.

Kulka couldn’t have been thrilled with the idea. The bomb bay wasn’t pressurized, the door leading to it was too small for him to enter wearing a parachute, and he didn’t know where the locking pin was located, let alone how to reinsert it. Kulka spent about ten minutes in the bomb bay, looking for the pin, without success. It must be somewhere above the bomb, he thought. The Mark 6 was a large weapon, about eleven feet long and five feet in diameter, and as Kulka tried to peek above it, he inadvertently grabbed the manual bomb release for support. The Mark 6 suddenly dropped onto the bomb bay doors, and Kulka fell on top of it. A moment later, the eight-thousand-pound bomb broke through the doors. Kulka slid off it, got hold of something in the open bomb bay, and held on tight. Amid the gust and roar of the wind, about three miles above the small farms and cotton fields of Mars Bluff, he managed to pull himself back into the plane. Neither the pilot nor the copilot realized the bomb was gone until it hit the ground and exploded.

The accident at Mars Bluff was impossible to hide from the press. Although Walter Gregg and his family had no idea what destroyed their home, the pilot of the B-47, unable to communicate with Hunter Air Force Base, told controllers at a nearby civilian airport that the plane had just lost a “device.” News of the explosion quickly spread. The state police formed checkpoints to keep people away from the Gregg property, and an Air Force decontamination team arrived to search for remnants of the Mark 6. Unlike the accident at Sidi Slimane, this one couldn’t have produced a nuclear yield — and yet it gained worldwide attention and inspired a good deal of fear. “Are We Safe from Our Own Atomic Bombs?” the New York Times asked. “Is Carolina on Your Mind?” echoed London’s Daily Mail. The Soviet Union claimed that a nuclear detonation had been prevented by “sheer luck” and that South Carolina had been contaminated by radioactive fallout.

The Strategic Air Command tried to counter the Soviet propaganda with the truth: there’d never been a risk of nuclear detonation, nor of harmful radioactivity. But SAC also misled reporters. During a segment entitled “‘Dead’ A-Bomb Hits U.S. Town,” Ed Herlihy, the narrator of a popular American newsreel, repeated the official line, telling nervous movie audiences that this was “the first accident of its kind in history.” In fact, a hydrogen bomb had been mistakenly released over Albuquerque the previous year. Knocked off balance by air turbulence while standing in the bomb bay of a B-36, the plane’s navigator had steadied himself by grabbing the nearest handle — the manual bomb release. The weapon broke through the bomb doors, and the navigator held onto the handle for dear life. The H-bomb landed in an unpopulated area, about one third of a mile from Sandia. The high explosives detonated but did not produce a nuclear yield. The weapon lacked a core.

The Air Force grounded all its bombers after the accident at Mars Bluff and announced a new policy: the locking pins wouldn’t be removed from nuclear weapons during peacetime flights. But the announcement failed to dampen a growing antinuclear movement in Great Britain. General Power had inflamed public opinion by telling a British journalist, who’d asked whether American aircraft routinely flew with nuclear weapons above England, “Well, we did not build these bombers to carry crushed rose petals.” Members of the opposition Labour Party criticized Prime Minister Harold Macmillan for allowing such flights and demanded an end to them. Macmillan was in a difficult position. For security reasons, SAC wouldn’t allow him to reveal that the bombs lacked cores — and wouldn’t even let him know when American planes were carrying nuclear weapons in British airspace.

Within weeks of the accident at Mars Bluff, a newly formed organization, the Campaign for Nuclear Disarmament (CND), led thousands of people on a protest march from London’s Trafalgar Square to the British nuclear weapon factory at Aldermaston. The CND rejected the whole concept of nuclear deterrence and argued that nuclear weapons were “morally wrong.” In preparation for the four-day march, the artist Gerald Holtom designed a symbol for the antinuclear movement. “I drew myself,” Holtom recalled, “the representative of an individual in despair, with palms outstretched outwards and downwards in the manner of Goya’s peasant before the firing squad.” He placed a circle around the self-portrait, an elongated stick figure, and created an image later known as the peace sign.

The Soviet Union worked hard to focus attention on the dangers of SAC’s airborne alert and the possibility of an accidental nuclear war. “Imagine that one of the airmen may, even without any evil intent but through nervous mental derangement or an incorrectly understood order, drop his deadly load on the territory of some country,” Khrushchev said during a speech. “Then according to the logic of war, an immediate counterblow will follow.” Arkady A. Sobolev, the Soviet representative to the United Nations, made a similar argument before the Security Council, warning that the “world has yet to see a foolproof system” and that “flights of American bombers bring a grave danger of atomic war.” The Soviet concerns may have been sincere. But they also promoted the idea that American bombers were the greatest threat to world peace — not the hundreds of Soviet medium-range missiles aimed at the capitals of Western Europe. Bertrand Russell, among others, had changed his view about whom to blame. Having once called for the United States to launch a preventive war on the Soviet Union with atomic bombs, Russell now argued that the American air bases in England should be shut down and that Great Britain should unilaterally get rid of its nuclear weapons.

The mental instability of SAC officers became a recurrent theme in Soviet propaganda. According to a Pentagon report obtained by an East German newspaper and discussed at length on Radio Moscow, 67.3 percent of the flight personnel in the United States Air Force were psychoneurotic. The report was a Communist forgery. But its bureaucratic tone, its account of widespread alcoholism, sexual perversion, opium addiction, and marijuana use at SAC, seemed convincing to many Europeans worried about American nuclear strategy. And the notion that a madman could deliberately start a world war became plausible, not long after the forgery appeared, when an American mechanic stole a B-45 bomber from Alconbury Air Force Base in England and took it for a joyride. The mechanic, who’d never received flight training, crashed the jet not long after takeoff and died.

A former Royal Air Force officer, Peter George, captured the new zeitgeist about nuclear weapons, the widespread fear of an accidental war, in a novel published amid the debate over SAC’s airborne alert. Pulp fiction like One of Our H Bombs Is Missing had already addressed some of these themes. But more than 250,000 copies of George’s novel Red Alert were sold in the United States, and it subsequently inspired a classic Hollywood film. Writing under the pseudonym “Peter Bryant,” George described how a deranged American general could single-handedly launch a nuclear attack. The madman’s views were similar to those expressed by Bertrand Russell a decade earlier: the United States must destroy the Soviet Union before it can destroy the West. “A few will suffer,” the general believes, “but millions will live.”

Once the scheme is uncovered, the general’s air base is assaulted by the U.S. Army. The president of the United States tries without success to recall SAC’s bombers, and the Soviets question whether the impending attack really was a mistake. As an act of good faith, SAC discloses the flight paths of its B-52s so that they can be shot down. After negotiations between the leaders of the two nations and revelations about “the ultimate deterrent” — doomsday weapons capable of eliminating life on earth, to be triggered if the Soviets are facing defeat — all but one of the SAC bombers are shot down or recalled. And so a deal is struck: if the plane destroys a Soviet city, the president will select an American city for the Soviets to destroy in retaliation. The president chooses Atlantic City, New Jersey. The lone B-52 drops its hydrogen bomb over the Soviet Union — but the weapon misfires and misses its target. Although Atlantic City is saved and doomsday averted, Red Alert marked an important cultural shift. The Strategic Air Command would increasingly be portrayed as a refuge for lunatics and warmongers, not as the kind of place where you’d find Jimmy Stewart.

General Power was unfazed by protest marches in Great Britain, apocalyptic fears, criticism in the press, freak accidents, strong opposition at the AEC, President Eisenhower’s reluctance, and even doubts about the idea expressed by LeMay. Power wanted an airborne alert. The decision to authorize one would be made by Eisenhower. The phrase “fail safe” had been removed from Air Force descriptions of the plan. The word “fail” had the wrong connotations, and the new term didn’t sound so negative: “positive control.” With strong backing from members of Congress, SAC proposed a test of the airborne alert. B-52s would take off from bases throughout America, carrying sealed-pit weapons. At a White House briefing in July 1958, Eisenhower was told that “the probability of any nuclear detonation during a crash is essentially zero.” The following month, he gave tentative approval for the test. But the new chairman of the AEC, John A. McCone, wanted to limit its scale. McCone thought that the bombers should be permitted to use only Loring Air Force Base in Maine — so that an accident or the jettison of a weapon would be likely to occur over the Atlantic Ocean, not the United States. During the first week of October, President Eisenhower authorized SAC to take off and land at Loring, with fully assembled hydrogen bombs. The flights secretly began, and SAC’s airborne alert was no longer a bluff.

FRED IKLÉ COMPLETED HIS RAND REPORT, “On the Risk of an Accidental or Unauthorized Nuclear Detonation,” two weeks after Eisenhower’s decision. Iklé’s top secret clearance had gained him access to the latest safety studies by Sandia, the Armed Forces Special Weapons Project, and the Air Force Special Weapons Center. He’d read accident reports, met with bomb designers at Sandia, immersed himself in the technical literature on nuclear weapons. He’d discussed the logistical details of SAC’s airborne alert, not only with the officers who would command them but also with the RAND analysts who’d come up with the idea in 1956. Iklé’s report was the first thorough, wide-ranging, independent analysis of nuclear weapon safety in the United States — and it did not confirm the optimistic assurances that President Eisenhower had just been given.

“We cannot derive much confidence from the fact that no unauthorized detonation has occurred to date,” Iklé warned: “the past safety record means nothing for the future.” The design of nuclear weapons had a learning curve, and he feared that some knowledge might come at a high price. Technical flaws and malfunctions could be “eliminated readily once they are discovered… but it takes a great deal of ingenuity and intuition to prevent them beforehand.” The risk wasn’t negligible, as the Department of Defense and the Air Force claimed. The risk was impossible to determine, and accidents were likely to become more frequent in the future. During Air Force training exercises in 1957, an atomic bomb or a hydrogen bomb had been inadvertently jettisoned once every 320 flights. And B-52 bombers seemed to crash at a rate of about once every twenty thousand flying hours. According to Iklé’s calculations, that meant SAC’s airborne alert would lead to roughly twelve crashes with nuclear weapons and seven bomb jettisons every year. “The paramount task,” he argued, “is to learn enough from minor incidents to prevent a catastrophic disaster.”

Even more worrisome than the technical challenges were the risks of human error and sabotage. Iklé noted that the Air Force’s shortage of trained weapon handlers “sometimes makes it necessary to entrust unspecialized personnel with complex tasks on nuclear weapons.” A single mistake — or more likely, a series of mistakes — could cause a nuclear detonation. Safety measures like checklists, seals that must be broken before knobs can be turned, and constant training might reduce the odds of human error. But Iklé thought that none of those things could protect against a threat that seemed like the stuff of pulp fiction: deliberate, unauthorized attempts to detonate a nuclear weapon. The technical safeguards currently in use could be circumvented by “someone who knew the workings of the fuzing and firing mechanism.” On at least one occasion, a drunken enlisted man had overpowered a guard at a nuclear storage site and attempted to gain access to the bombs. “It can hardly be denied that there is a risk of unauthorized acts,” Iklé wrote — and figuring out how to stop them remained “one of the most baffling problems of nuclear weapon safety.”

With help from the psychiatrist Gerald J. Aronson, Iklé outlined some of the motivations that could prompt someone to disobey orders and set off a nuclear weapon. The risk wasn’t hypothetical. About twenty thousand Air Force personnel worked with nuclear weapons, and in order to do so, they had to obtain a secret or a top secret clearance. But they didn’t have to undergo any psychiatric screening. In fact, “a history of transient psychotic disorders” no longer disqualified a recruit from joining the Air Force. A few hundred Air Force officers and enlisted men were annually removed from duty because of their psychotic disorders — and perhaps ten or twenty who worked with nuclear weapons could be expected to have a severe mental breakdown every year.

In an appendix to the report, Aronson offered “a catalogue of derangement” that seemed relevant to nuclear safety. The most dangerous disorders involved paranoia. Aronson provided a case history of the type of officer who needed to be kept away from atomic bombs:

In another case history, Aronson described an Air Force captain who developed full-blown paranoid schizophrenia at the age of thirty-three. His behavior became “grandiose, inappropriate, and demanding.” He considered himself the real commander of his unit and gave orders to a superior officer. At the height of these delusions, the captain nevertheless managed to log “eight hours on the B-25 [bomber] with unimpaired proficiency.”

Aronson thought that an unauthorized nuclear detonation would have a unique appeal to people suffering from a variety of paranoid delusions — those who were seeking fame, who believed themselves “invested with a special mission that sets them apart from society,” who wanted to save the world and thought that “the authorities… covertly wish destruction of the enemy but are uncomfortably constrained by outmoded convention.” In addition to the mentally ill, officers and enlisted men with poor impulse control might be drawn to nuclear weapons. The same need for immediate gratification that pyromaniacs often exhibited, “the desire to see the tangible result of their own power as it brings about a visual holocaust,” might find expression in detonating an atomic bomb. A number of case histories in the report illustrated the unpredictable, often infantile nature of impulse-driven behavior:

Even relatively harmless motives — such as the urge to defy authority, the desire to show off, and “the kind of curiosity which does not quite believe the consequences of one’s own acts” — could cause a nuclear detonation.

The unauthorized destruction of a city or a military base would be disastrous, and Iklé addressed the question of whether such an event could precipitate something even worse. Nikita Khrushchev had recently claimed that “an accidental atomic bomb explosion may well trigger another world war.” The scenario seemed far-fetched but couldn’t be entirely dismissed. Amid the chaos following an explosion, it might not be clear that the blast had been caused by a technical malfunction, human error, a madman, or saboteurs. The country where the detonation occurred might think that a surprise attack had begun and retaliate. Its adversary, fearing that sort of retaliation, might try to strike first.

Iklé believed that, at the moment, the risk of accidental war was small. He thought the leadership of both the United States and the Soviet Union would carefully investigate the cause of a single detonation before launching an all-out attack. And he felt confident that America could withstand the loss of a major city without much long-term social or economic upheaval. But an unauthorized detonation in the United States or Western Europe could have “unfortunate political consequences.” It could fuel support for disarmament and neutrality, increase opposition to American bases overseas, weaken the NATO alliance, and facilitate “a peaceful expansion of the Soviet sphere of influence.” Indeed, the military and political benefits to the Soviet Union would be so great that it might be tempted to sabotage an American weapon.

“The U.S. defense posture could be substantially strengthened by nuclear weapon safeguards that would give a nearly absolute guarantee against unauthorized detonations,” Iklé concluded. He urged that more research be conducted on nuclear weapon safety, that new safety mechanisms be added to warheads and bombs, that Air Force personnel be screened more thoroughly for psychiatric problems. And he offered one solution to the problem of unauthorized use that seemed obvious, yet hadn’t been tried: put combination locks on nuclear weapons. That way they could be detonated only by someone who knew the right code. None of these measures, however, could make weapons perfectly safe, and the United States had to be prepared for accidental or unauthorized detonations.

In a subsequent RAND report, Iklé offered suggestions on how to minimize the harm of an accidental nuclear explosion:

An official “board of inquiry” should be established, headed by military experts and prominent politicians, as an “important device for temporizing.” Ideally, the board would take a few months to reach any conclusions:

If an American bomber launched an unauthorized attack on the Soviet Union, Iklé argued that the United States should “avoid public self-implication and delay the release of any details about the accident.” Then it should begin secret diplomatic negotiations with the Soviets. Amid the tensions of the Cold War, thanks to a military strategy that made the United States and its NATO allies completely dependent on nuclear weapons, Iklé’s thinking reached a perverse but logical conclusion. After the accidental detonation of an atomic bomb, the president might have a strong incentive to tell the Soviet Union the truth — and lie to the American people.

FRED IKLÉ’S REPORTS ON nuclear weapon safety were circulated at the highest levels of the Air Force and the Department of Defense. But his work remained unknown to most weapon designers and midlevel officers. In 1958, Bob Peurifoy was a section supervisor at Sandia, working on the electrical system of the W-49 warhead. Development of the W-49 was considered urgent; lightweight and thermonuclear, the warhead would be mounted atop Atlas, Thor, and Jupiter ballistic missiles. During the rush to bring it into production, Peurifoy was surprised to read some of the language in a preliminary safety study of the W-49. “This warhead, like all other warheads investigated, can be sabotaged, i.e., detonated full-scale,” the Air Force study mentioned, in passing. “Any person with knowledge of the warhead electrical circuits, a handful of equipment, a little time, and the intent, can detonate the warhead.” Peurifoy hadn’t spent much time thinking about nuclear weapon safety; his job at Sandia was making sure that bombs would explode. But the ease with which someone could intentionally set off a W-49 seemed incredible to him. It was unacceptable. And so was the Air Force’s willingness to rely on physical security — armed guards, perimeter fences, etc. — as the only means of preventing an unauthorized detonation.

Peurifoy decided that the warhead should have an internal mechanism to prevent sabotage or human error from detonating it. Plans were already being made to incorporate a trajectory-sensing switch into the new Mark 28 bomb, and Peurifoy thought that the W-49 should contain one, too. The switch responded to changes in gravitational force. It contained an accelerometer — a small weight atop a spring, enclosed in a cylinder. As g-forces increased, the weight pushed against the spring, like a passenger pushed back against the seat of an accelerating car. When the spring fully compressed, an electrical circuit closed, allowing the weapon to be detonated. In the Mark 28 bomb, the switch would be triggered by the sudden jerk of the parachutes opening. Peurifoy wanted to use the strong g-forces of the warhead’s descent to close the circuit. A trajectory-sensing switch would prevent the weapon from going off while airmen handled or serviced it, since the necessary g-forces wouldn’t be present on the ground. A skilled technician could circumvent the switch, but its placement deep within the warhead would make an act of sabotage trickier and more time consuming.

The Army didn’t like Peurifoy’s idea. A switch that operated as the W-49 warhead fell to earth, the Army contended, might somehow make the weapon less reliable. The Army also didn’t like what Sandia engineers called the switch: a “handling safety device” or a “goof-proofer.” Both terms implied that Army personnel were capable of making mistakes. Peurifoy thought that sort of thinking was sheer stupidity. But the Army ran the Jupiter missile program and had the final say on its fuzing and firing system. Under enormous pressure to complete the design of the warhead’s electrical system, Peurifoy said “to hell with it” and simply reversed the direction of the tiny springs. Now the switch would respond to the g-forces of the missile soaring upward — not those of the warhead coming down — and the Army couldn’t complain that its control of the fuzing and firing system was being challenged. To avoid any hurt feelings, Sandia renamed the switch, calling it an “environmental sensing device.”

At Los Alamos, the issue of one-point safety gained renewed attention as SAC began to fly planes with fully assembled weapons. A young physicist, Robert K. Osborne, began to worry that a number of the bombs carried during airborne alerts might not be one-point safe. Among those raising the greatest concern was the Mark 28, a hydrogen bomb with a yield of about 1 megaton. Any problem with the Mark 28 would be a big problem. The Air Force had chosen it not only to become the most widely deployed bomb in the Strategic Air Command, but also to serve as a “tactical” weapon for NATO fighter planes. In December 1957 the Fission Weapon Committee at Los Alamos had struggled to define what “one-point safe” should mean, as a design goal. If the high explosives of a weapon detonated at a single point, some fission was bound to occur in the core before it blew apart — and so “zero yield” was considered unattainable.

A naval officer at the Armed Forces Special Weapons Project suggested that the yield of a nuclear weapon accident should never exceed the explosive force produced by four pounds of TNT. The four-pound limit was based on what might happen during an accident at sea. If a nuclear detonation with a yield larger than four pounds occurred in the weapon storage area of an aircraft carrier, it could incapacitate the crew of the engine room and disable the ship. Los Alamos proposed that the odds of a yield greater than four pounds should be one in one hundred thousand. The Department of Defense asked for an even stricter definition of one-point safety: odds of one in a million.

The likelihood of a Mark 28 producing a large detonation during a plane crash or a fire, Osborne now thought, was uncomfortably high. The one-point safety tests conducted in Nevada had assumed that the most vulnerable place on a weapon was the spot where a detonator connected to a high-explosive lens. That’s why the tests involved setting off a single lens with a single detonator. But Osborne realized that nuclear weapons had an even more vulnerable spot: a corner where three lenses intersected on the surface of the high-explosive sphere. If a bullet or a piece of shrapnel hit one of those corners, it could set off three lenses simultaneously. And that might cause a nuclear detonation a lot larger than four pounds of TNT.

A new round of full-scale tests on the Mark 28 would be the best way to confirm or disprove Osborne’s theory. But those tests would be hard to perform. Ignoring strong opposition from the Joint Chiefs of Staff, President Eisenhower had recently declared a moratorium on American nuclear testing. He was tired of the arms race and seeking a way out of it. He increasingly distrusted the Pentagon’s claims. “Testing is essential for weapons development,” General Charles H. Bonesteel had argued, succinctly expressing the military’s view, “and rapid weapons development is essential for keeping ahead of the Russians.” But Eisenhower doubted that the United States was at risk of falling behind. The Air Force and the CIA had asserted that the Soviet Union would have five hundred long-range ballistic missiles by 1961, outnumbering the United States by more than seven to one. Eisenhower thought those numbers were grossly inflated; top secret flights over the Soviet Union by U-2 spy planes had failed to detect anywhere near that number of missiles.

Despite the Democratic attacks on his administration and dire warnings of a missile gap, President Eisenhower thought it was more important to preserve the secrecy of America’s intelligence methods than to refute his critics. The nuclear test ban was voluntary, but he hoped to make it permanent. In the words of one adviser, Eisenhower had become “entirely preoccupied by the horror of nuclear war.” The harsh criticism of his policies — not just by Democrats but also by defense contractors — led Eisenhower to believe in the existence of a “military-industrial complex,” a set of powerful interest groups that threatened American democracy and sought new weapons regardless of the actual need.

The Air Force was in a bind. The hydrogen bomb scheduled to become its workhorse, deployed at air bases throughout the United States and Europe, might be prone to detonate during a plane crash. And full-scale tests of the weapon would violate the nuclear moratorium that Eisenhower had just promised to the world. While the Air Force and the Atomic Energy Commission debated what to do, the Mark 28 was grounded.

Norris Bradbury, the director of Los Alamos, recommended that a series of tests be secretly conducted. The tests would be called “hydronuclear experiments.” Mark 28 cores containing small amounts of fissile material would be subjected to one-point detonations — and more fissile material would be added with each new firing, until a nuclear yield occurred. The largest yield that might be produced would be roughly equivalent to that of one pound of TNT. None of these “experiments” would be done without the president’s approval. Eisenhower was committed to a test ban, disarmament, and world peace — but he also understood the importance of the Mark 28. He authorized the detonations, accepting the argument that they were “not a nuclear weapon test” because the potential yields would be so low. At a remote site in Los Alamos, without the knowledge of most scientists at the laboratory, cores were detonated in tunnels fifty to one hundred feet beneath the ground. The tests confirmed Osborne’s suspicions. The Mark 28 wasn’t one-point safe. A new core, with a smaller amount of plutonium, replaced the old one. And the bomb was allowed to fly again.

FOUR YEARS AFTER ANNOUNCING the policy of massive retaliation, Secretary of State John Foster Dulles was having doubts. “Are we becoming prisoners of our strategic concept,” he asked at a meeting of Eisenhower’s military advisers, “and caught in a vicious circle?” A defense policy that relied almost entirely on nuclear weapons had made sense in the early days of the Cold War. The alternatives had seemed worse: maintain a vast and expensive Army or cede Western Europe to the Communists. But the Soviet Union now possessed hydrogen bombs and long-range missiles — and the American threat of responding to every act of Soviet aggression, large or small, with an all-out nuclear attack no longer seemed plausible. It could force the president to make a “bitter choice” during a minor conflict and risk the survival of the United States. Dulles urged the Joint Chiefs of Staff to come up with a new strategic doctrine, one that would give the president a variety of military options and allow the United States to fight small-scale, limited wars.

General Maxwell D. Taylor, the Army’s chief of staff, wholeheartedly agreed with Dulles. For years Taylor had urged Eisenhower to spend more money on conventional forces and adopt a strategy of “flexible response.” The Army hated the idea of serving merely as a trip wire in Europe; it still wanted to bring the battle back to the battlefield. The need for a more flexible policy was backed by RAND analysts and by a young Harvard professor, Henry A. Kissinger, whose book Nuclear Weapons and Foreign Policy had become an unlikely bestseller in 1957. Kissinger thought that a nuclear war with the Soviet Union didn’t have to end in mutual annihilation. Rules of engagement could be tacitly established between the superpowers. The rules would forbid the use of hydrogen bombs, encourage a reliance on tactical nuclear weapons, and declare cities more than five hundred miles from the battlefield immune from attack. Unlike massive retaliation, a strategy of “graduated deterrence” would allow the leadership on both sides to “pause for calculation,” pull back from the abyss, and reach a negotiated settlement. Kissinger believed that in a limited war — fought with a decentralized command structure that let local commanders decide how and when to use their nuclear weapons — the United States was bound to triumph, thanks to the superior “daring and leadership” of its officers.

The Navy had also begun to question the thinking behind massive retaliation. It was about to introduce a new weapon system, the Polaris submarine, that might revolutionize how nuclear wars would be fought. The sixteen missiles carried by each Polaris were too inaccurate to be aimed at military targets, such as airfields. But their 1-megaton warheads were ideal for destroying “soft” targets, like cities. The Polaris would serve best as a retaliatory, second-strike weapon — leading the Navy to challenge the whole notion of striking the Soviet Union first.

Admiral Arleigh Burke, the chief of naval operations, became an outspoken proponent of “finite deterrence.” Instead of maintaining thousands of strategic weapons on Air Force bombers and land-based missiles to destroy every Soviet military target — a seemingly impossible task — Burke suggested that the United States needed hundreds, not thousands, of nuclear warheads. They could be carried by the Navy’s Polaris submarines, hidden beneath the seas, invulnerable to a surprise attack. And they would be aimed at the Soviet Union’s major cities, in order to deter an attack. Placing the nation’s nuclear arsenal on submarines would eliminate the need for split-second decision making during a crisis. It would give the president time to think, permit the United States to apply force incrementally, and reduce the threat of all-out nuclear war. Burke argued that a strategy of massive retaliation no longer made sense: “Nobody wins a suicide pact.” A decade earlier the Navy had criticized the Air Force for targeting Soviet cities, calling the policy “ruthless and barbaric.” Now the Navy claimed that was the only sane and ethical way to ensure world peace.

As the debate over nuclear strategy grew more heated within the Eisenhower administration and in the press, General Curtis LeMay showed absolutely no interest in limited war, graduated deterrence, finite deterrence — or anything short of total victory. The United States should never enter a war, LeMay felt, unless it intended to win. And a counterforce policy that targeted the Soviet Union’s nuclear assets was far more likely to prevent a war than a strategy that threatened its cities. Unlike “the public mind” that feared a nuclear holocaust, he argued, “the professional military mind” in both nations worried more about preserving the ability to fight, about losing airfields, missile bases, command centers. SAC claimed that a counterforce strategy was also “the most humane method of waging war… since there was no necessity to bomb cities.” But that argument was somewhat disingenuous. In order to hit military targets, LeMay acknowledged, “weapons must be delivered with either very high accuracy or very high yield, or both.” Because the accuracy of a bomb was less predictable than its yield, he favored the use of powerful weapons. They could miss a target and still destroy it, or destroy multiple targets at once. They would also, unavoidably, kill millions of civilians. LeMay wanted SAC to deploy a hydrogen bomb with a yield of 60 megatons, a bomb more than four thousand times more powerful than the one that destroyed Hiroshima.

BY THE LATE 1950s, the absence of a clear targeting policy and the size of America’s stockpile had created serious command-and-control problems. The Army, the Navy, and the Air Force all planned to attack the Soviet Union with nuclear weapons but had done little to coordinate their efforts. Until 1957 the Strategic Air Command refused to share its target list with the other armed services. When the services finally met to compare war plans, hundreds of “time over target” conflicts were discovered — cases in which, for example, the Air Force and the Navy unwittingly planned to bomb the same target at the same time. These conflicts promised to cause unnecessary “overkill” and threaten the lives of American aircrews. The Joint Chiefs of Staff soon recognized that the chaos of war would be bad enough, without competing nuclear war plans to make it worse. They decided that the United States had to develop “atomic coordination machinery” — an administrative system to control what targets would be attacked, who would attack them, which weapons would be used, and how those attacks would be timed. The decision prompted the Army, Navy, and Air Force to battle even more fiercely over who would control that system.

The Air Force wanted a single atomic war plan, run by a centralized command. SAC would head that command — and take over the Navy’s Polaris submarines. The Navy was outraged by that idea and joined the other services in offering a counterproposal: the Navy, the Air Force, and NATO should retain separate war plans but coordinate them more efficiently. The issues at stake were fundamental, and basic questions needed to be addressed — should the command structure be centralized or decentralized, should the attack be all out or incremental, should the strategy be counterforce or city busting? The president of the United States, once again, had to decide the best way not only to fight the Soviet Union but also to settle a dispute over nuclear weapons at the Pentagon.

During a meeting at the White House in 1956, President Eisenhower had listened patiently to General Taylor’s arguments on behalf of a flexible response. Eisenhower wasn’t persuaded that a war could be won without hydrogen bombs. “It was fatuous to think that the U.S. and the U.S.S.R. would be locked into a life and death struggle,” he told Taylor, “without using such weapons.” Eisenhower thought both sides would use them at once. Four years later, his views remained largely unchanged. If NATO forces were attacked, he said during another White House discussion of limited war, “an all-out strike on the Soviet Union” would be the only “practical” choice. Pausing to negotiate a diplomatic settlement seemed unrealistic; that sort of thing happened only in novels like Red Alert. Confronted with the choice between destroying Soviet military targets or cities, Eisenhower decided that the United States should destroy both. The new targeting philosophy combined elements of Air Force and Navy doctrine. It was called the “optimum mix.”

In August 1960, General Nathan Twining, chairman of the Joint Chiefs of Staff, resolved the dispute over how a nuclear war would be planned and controlled. A Joint Strategic Target Planning Staff would be formed. Most of the officers would be drawn from the Air Force, although the other services would be represented. The targeting staff would be based at SAC headquarters in Omaha and led by SAC’s commander. The Navy could keep its Polaris submarines, but the aiming points of their missiles would be chosen in Omaha. Twining ordered that a Single Integrated Operational Plan (SIOP) be completed by the end of the year. The SIOP would serve as America’s nuclear war plan. The SIOP would spell out precisely when, how, and by whom every enemy target would be struck. And the SIOP would be inflexible. Twining had instructed that “atomic operations must be pre-planned for automatic execution to the maximum extent possible.”

The Navy was furious about the new arrangement. Admiral Burke thought it represented a power grab by the Air Force and later accused the Strategic Air Command of using “exactly the same techniques… the methods of control” favored by the Communists. And he warned that once the SIOP was adopted, it would be hard to change. “The systems will be laid,” Burke told William B. Franke, the secretary of the Navy:

President Eisenhower was unfazed by Burke’s critique of the SIOP, its underlying strategy, and its command-and-control machinery. “This whole thing has to be on a completely integrated basis,” Eisenhower said. “The initial strike must be simultaneous.”

The strategic planning staff gathered in Omaha to write the first SIOP, under tremendous pressure to complete it within four months. Their process would be as rational, impersonal, and automated as possible. The first step was to create a National Strategic Target List. They began by poring through the Air Force’s Bombing Encyclopedia, a compendium of more than eighty thousand potential targets located throughout the world. The book gave a brief description of each target, its longitude and latitude and elevation, its category — such as military or industrial, airfield or oil refinery — and its “B.E. number,” a unique, eight-digit identifier. From that lengthy inventory, twelve thousand candidates in the Soviet Union, the Eastern bloc, and China were selected. A “target weighing system” was adopted to measure their relative importance. Every target was assigned a certain number of points; those with the most points were deemed the most essential to destroy; and the National Strategic Target List, as a whole, was given a total value of five million points. All of this data, the B.E. numbers, the target locations, and the numerical points were fed into SAC’s latest IBM computer. What emerged was a series of “desired ground zeros,” containing multiple targets, at which America’s nuclear weapons would be aimed.

Once the target list was complete and the ground zeros identified, the planners calculated the most efficient way to destroy them. A wide assortment of variables had to be taken into account, including: the accuracy and reliability of different weapon systems, the effectiveness of Soviet air defenses, the impact of darkness or poor weather, and the rate at which low-flying aircraft were likely to crash due to unknown causes, known as the “clobber factor.” The Joint Chiefs specified that the odds of a target being destroyed had to be at least 75 percent, and for some targets, the rate of damage assurance was put even higher. Achieving that level of assurance required cross-targeting — aiming more than one nuclear weapon at a single ground zero. After the numbers were crunched, the SIOP often demanded that a target be hit by multiple weapons, arriving from different directions, at different times. One high-value target in the Soviet Union would be hit by a Jupiter missile, a Titan missile, an Atlas missile, and hydrogen bombs dropped by three B-52s, simply to guarantee its destruction.

The SIOP would unfold in phases. The “alert force” would be launched within the first hour, the “full force” in waves over the course of twenty-eight hours. And then the SIOP ended. The Strategic Air Command was responsible for striking most of the ground zeros. “Tactics programmed for the SIOP are in two principal categories,” the head of the Joint Chiefs later explained, “the penetration phase and the delivery phase.” SAC would attack the Soviet Union “front-to-rear,” hitting air defenses along the border first, then penetrating more deeply into the nation’s interior and destroying targets along the way, a tactic called “bomb as you go.”

Great Britain’s strategic weapons were controlled by the SIOP, as well. The Royal Air Force showed little interest in SAC’s ideas about counterforce. The British philosophy of strategic bombing had changed little since the Second World War, and the RAF’s Bomber Command wanted to use its nuclear weapons solely for city busting. The SIOP respected the British preference, asking Bomber Command to destroy three air bases, six air defense targets, and forty-eight cities.

George Kistiakowsky, the president’s science adviser, visited SAC headquarters in November 1960 to get a sense of how work was proceeding on the SIOP. Kistiakowsky was hardly a peacenik. He’d fled the Soviet Union as a young man, designed the high-explosive lenses for the Trinity device, and later shared the Air Force’s concerns about a missile gap. But he was shocked by the destructiveness of the SIOP. The damage levels caused by the alert force alone would be so great that any additional nuclear strikes seemed like “unnecessary and undesirable overkill.” Kistiakowsky thought that the full force would deliver enough “megatons to kill 4 and 5 times over somebody who is already dead” and that SAC should be allowed to take “just one whack — not ten whacks” at each Soviet target. Nevertheless, he told Eisenhower, “I believe that the presently developed SIOP is the best that could be expected under the circumstances and that it should be put into effect.”

At the beginning of the effort to devise a new war plan, Eisenhower had expressed opposition to any strategy that required “a 100 percent pulverization of the Soviet Union.” He could still remember when the Pentagon said the Soviets had no more than seventy targets worth destroying. “There was obviously a limit,” he told his national security staff, “a human limit — to the devastation which human beings could endure.” On December 2, 1960, Eisenhower approved the SIOP, without requesting any changes.

The SIOP would take effect the following April. It featured 3,729 targets, grouped into more than 1,000 ground zeros, that would be struck by 3,423 nuclear weapons. The targets were located in the Soviet Union, China, North Korea, and Eastern Europe. About 80 percent were military targets, and the rest were civilian. Of the “urban-industrial complexes” scheduled for destruction, 295 were in the Soviet Union and 78 in China. The SIOP’s damage and casualty estimates were conservative. They were based solely on blast effects. They excluded the harm that might be caused by thermal radiation, fires, or fallout, which were difficult to calculate with precision. Within three days of the initial attack, the full force of the SIOP would kill about 54 percent of the Soviet Union’s population and about 16 percent of China’s population — roughly 220 million people. Millions more would subsequently die from burns, radiation poisoning, exposure. The SIOP was designed for a national emergency, when the survival of the United States was at stake, and the decision to launch the SIOP would carry an almost unbearable weight. Once the SIOP was set in motion, it could not be altered, slowed, or stopped.

The SIOP soon became one of the most closely guarded secrets in the United States. But the procedures for authorizing a nuclear strike were kept even more secret. For years the Joint Chiefs had asked not only for custody of America’s nuclear weapons but also for the authority to use them. In December 1956 the military had gained permission to use nuclear weapons in air defense. In February 1959 the military had gained custody of all the thermonuclear weapons stored at Army, Navy, and Air Force facilities. The Atomic Energy Commission retained custody of only those kept at its own storage sites. And in December 1959 the military had finally won the kind of control that it had sought since the end of the Second World War. Eisenhower agreed to let high-ranking commanders decide whether to use nuclear weapons, during an emergency, when the president couldn’t be reached. He had wrestled with the decision, well aware that such advance authorization could allow someone to do “something foolish down the chain of command” and start an all-out nuclear war. But the alternative would be to let American and NATO forces be overrun and destroyed, if communications with Washington were disrupted.

At first, Eisenhower told the Joint Chiefs that he was “very fearful of having written papers on this matter.” Later, he agreed to sign a predelegation order, insisting that its existence never be revealed. “It is in the U.S. interest to maintain the atmosphere that all authority [to use nuclear weapons] stays with the U.S. President without delegation,” he stressed. Eisenhower’s order was kept secret from Congress, the American people, and NATO allies. It made sense, as a military tactic. But it also introduced an element of uncertainty to the decision-making process. The SIOP was centralized, inflexible, and mechanistic. The predelegation order was exactly the opposite. It would rely on individual judgments, made in the heat of battle, thousands of miles from the White House. Under certain circumstances, a U.S. commander under attack with conventional weapons would be allowed to respond with nuclear weapons. Eisenhower knew all too well that delegating presidential authority could mean losing control of whether, how, and why a nuclear war would be fought. He understood the contradictions at the heart of America’s command-and-control system — but couldn’t find a way to resolve them during his last few weeks in office.

Breaking In

Colonel John T. Moser and his wife had just finished dinner, and they were getting ready to leave the house for a concert, when the phone rang.

There’s a problem at Launch Complex 374-7, the controller said. It could be a fire.

Moser told his wife to go without him, put on his uniform, got in his car, and headed to the command post. They lived on the base, and the drive didn’t take long. On the way, Moser radioed ahead, telling the controller to assemble the Missile Potential Hazard Team. It was six forty in the evening, about ten minutes after a mysterious white cloud had appeared in the silo.

The command post of the 308th Strategic Missile Wing resembled an executive boardroom, with a long conference table in the middle, communications equipment, and a chalkboard. It could accommodate twenty-five or thirty people. Moser was the wing commander, and when he arrived at the post, it was still largely empty, and the status of the missile, unclear. The sprays were on, dumping water into the silo. Stage 1 fuel pressure was falling, while the oxidizer pressure was rising. Flashing red lights in the control center at 4–7 warned there was a fuel leak, an oxidizer leak, a fire in the silo — three things that couldn’t be happening at once. Adding to the confusion, Captain Mazzaro and Lieutenant Childers, the crew commander and deputy commander at the site, had both called the command post, using separate lines, one mentioning a fuel leak, the other a fire. Now Mazzaro was on the speakerphone, reporting the missile’s tank pressures. His crew was going through checklists, trying to make sense of it all.

Moser was a great believer in checklists. After graduating from Franklin & Marshall College in 1955, he’d joined the Strategic Air Command. Two years later he became the navigator of a KC-97 Stratotanker, an aircraft that refueled B-47 bombers midair. The Stratotanker was a propeller plane, and the B-47 a jet, prone to stalling at low speeds. The two had to rendezvous at a precise location, with the bomber flying behind and slightly below the tanker. At an altitude of eighteen thousand feet, they would connect via a hollow steel boom and fly in unison for twenty minutes, entering a shallow dive so that the tanker could keep up with the bomber. Aerial refueling was a delicate, often dangerous procedure. The crew of the Stratotanker had to coordinate every step carefully, not just with the crew of the B-47 but also with one another. Spontaneous or improvised maneuvers would not be appreciated. Moser later flew as a navigator on KC-135 tankers that refueled B-52s during airborne alerts. The success of these missions depended on checklists. Every move had to be standardized and predictable, as two large jets flew about forty feet apart, linked by a boom, one plane carrying thermonuclear weapons, the other unloading a thousand gallons of jet fuel a minute, day or night, through air turbulence and rough weather.

Colonel Moser asked Mazzaro if the PTS team had done anything in the silo that could have caused the problem. Mazzaro got off the line and returned with an explanation: Airman Powell had dropped a socket into the silo, and the socket had pierced a hole in the stage 1 fuel tank. Mazzaro put the airman on the phone and made him describe what had happened, an unusual decision that violated the chain of command. Hearing the details silenced everyone in the room. Moser realized this was a serious accident that called for an urgent response. He activated the Missile Potential Hazard Net, a conference call that would connect him with SAC headquarters in Omaha, the Ogden Air Logistics Center in Utah, and the headquarters of the Eighth Air Force in Louisiana. But the communications equipment wasn’t working properly, and for the next forty minutes the controller in Little Rock tried to set up the call.

Members of the hazard team were now filling the command post, officers and enlisted men who’d spent years working with the Titan II and its propellants. The missile wing’s chief of safety sat at the conference table, along with the head of its technical engineering branch, a bioenvironmental engineer, an electrical engineer, and the K crew. The “K” stood for “on-call,” and the four-man crew — a commander, a deputy commander, a missile facilities technician, and a missile systems analyst — served as back-up to the launch crew at 4–7. The K crew could help interpret the data coming from the site, pore through the Dash-1 and other operating manuals, offer a second opinion. The skills of everyone in the room focused on the question of how to save the missile. SAC didn’t have a checklist for the problem they now faced, and so they would have to write one.

Moser needed all the technical assistance he could get. He was new to the job, having been in Little Rock for about three months. During that brief time, he’d come to be regarded as smart, fair, and open minded — as someone who was willing to listen. For a SAC wing commander, he was well liked. But Moser didn’t know very much about Titan II missiles. He’d previously served as deputy director of missile maintenance at SAC headquarters and as the commander of missile maintenance at Whiteman Air Force Base in Missouri. Those assignments, however, had required an extensive knowledge of Minuteman missiles — a completely different weapon system. The Minuteman used solid fuel, not liquid propellants. It was smaller than a Titan II, with a less powerful warhead. And each Minuteman complex had ten missiles, not one, with silos dispersed as far as seventeen miles from the launch control center. A Minuteman crew could go months without visiting a silo. The Titan II was the only ballistic missile in the American arsenal that relied on liquid fuel and a combat crew living down the hall. It was a rare, exotic “bird.” Of the more than one thousand long-range missiles that SAC controlled, only fifty-four were Titan IIs.

Moser didn’t pretend to be an expert on the Titan II and, from his first day in Little Rock, had shown an eagerness to learn. Three or four mornings a week, he attended predeparture briefings for the launch crews and the PTS teams. He vowed to spend time at every launch complex, before the end of the year. But some of the complexes were a long way from Little Rock, and he still hadn’t visited them all.

WHEN COLONEL JAMES L. MORRIS arrived at the command post, around 7 P.M., he already knew what had happened at the silo. Morris was the deputy commander for maintenance, and about half an hour earlier, he’d overheard Captain Mazzaro on the radio, sounding excited about something. Morris told job control to call 4–7 and ask Charles Heineman, the head of PTS Team A, what was going on there. Heineman said that Powell had dropped a socket into the silo and poked a hole in the missile. He said that Powell saw a lot of fuel vapor, but no fire. Morris absorbed the news, told job control to track down Jeff Kennedy, and ordered the dispatcher not to contact the launch complex again.

Within an hour of the accident, the pressure in the stage 1 fuel tank had dropped by about 80 percent. A vacuum was forming inside it, as fuel poured out. If the pressure continued to drop, the tank might collapse. After Jeff Kennedy joined Morris in the command post, Colonel Moser briefed them on the situation and instructed them to head to 4–7 by helicopter. Morris would serve as the on-site commander, and Kennedy would help him find out what was happening, whether there was a fire, and what needed to be done. Before leaving Little Rock, Kennedy asked job control to call the launch complex and tell them to get a RFHCO suit ready for him. We’ve been ordered not to call the complex, the dispatcher said, bring your own. Kennedy didn’t have time to gather the necessary gear — a helmet, a fresh air pack, a RFHCO suit the right size — and left the base without it.

The hazard team had come up with a plan: PTS technicians would reenter the silo, vent the stage 1 fuel tank, equalize the pressure, and prevent the missile from collapsing. Time was of the essence, and the reentry had to be done as soon as possible. The PTS men topside had RFHCOs and air packs and a full set of equipment in their trucks. Ideally, they’d go into the complex. But nobody knew where they were. After leaving the complex, they’d probably driven beyond the range of the radios in their helmets. And their trucks didn’t have radios that could contact the base. If they wanted to speak with the command post, they’d have to drive to Damascus and use a pay phone, or call from a nearby house.

The PTS crew that had taken refuge in the control center would have to do the job, wearing the RFHCOs left behind in the blast lock. Because their socket was now lying somewhere at the bottom of the silo, they’d have to remove the pressure cap on the stage 1 fuel tank with pliers. And if that didn’t work, they might have to push open the tank’s poppet valve with a broom handle.

Before Colonel Moser could approve the plan and set it in motion, SAC headquarters joined the discussion via speakerphone. It was about quarter to eight, the Missile Potential Hazard Net was finally up and running, and Lieutenant General Lloyd Leavitt, the vice commander in chief of the Strategic Air Command, was on the line. Leavitt made it clear that, from now on, nothing would be done in the launch control center, the silo, or anywhere else on the complex without his approval. And he would not authorize any specific action until a consensus had been reached that it was the right thing to do.

Leavitt was in his early fifties, short, compact, and self-confident. He’d been a member of the first class to enter West Point after the Second World War. While the heroism of that war was celebrated in popular books and films, his classmates were soon risking their lives in a conflict that was largely ignored by the public. Leavitt became a fighter pilot and flew one hundred combat missions during the Korean War. He routinely encountered enemy planes and antiaircraft fire. During one mission, his F-84 was hit by flak and suffered an electrical failure; Leavitt had to fly 250 miles without flight instruments or a radio, before landing safely at an American base. During another, his plane spun out of control amid a snowstorm; Leavitt had to bail out at eight thousand feet and felt lucky to be found by South Korean troops, not Communist guerrillas. He later flew 152 combat missions in Vietnam. The two conflicts, as well as training flights, took the lives of many good friends. Of the 119 West Pointers who graduated from flight school with Leavitt, 7 were killed in Korea, 2 in Vietnam, and 13 in airplane accidents. The odds of being killed on the job, for his classmates, was about one in six.

Some of Leavitt’s most dangerous missions occurred during peacetime. From 1957 to 1960, he flew U-2 spy planes. The U-2 was designed to fly long distances and take photographs at an altitude of seventy thousand feet, without being detected or shot down. In order to do so, the plane had to be kept as light as possible. And the small size of the pilot’s survival kit imposed certain restrictions. Before leaving on a mission to photograph Soviet airfields and radar sites in Siberia, Leavitt was given a choice: bring a life raft or a warm parka. He wasn’t allowed to bring both. Leavitt chose the parka, figuring that if he had to bail out over the Bering Sea, he’d freeze to death — with or without the raft. U-2 pilots flew alone, in a tiny cockpit, wearing cumbersome pressure suits and maintaining complete radio silence, for as long as nine hours. The plane was difficult to fly. It was fragile and stalled easily. Strong g-forces could break it apart midair. To save weight, it had only two sets of landing gear, one in the front and the other in the back. “Landing the U-2,” Leavitt wrote in his memoir, “was like landing a bicycle at 100 mph.” Of the thirty-eight U-2 pilots with whom he trained, eight died flying the plane.

The Missile Potential Hazard Net was rarely activated, and the commander of SAC usually led it. But General Richard H. Ellis was out of town — and so Leavitt, the second in command, took his place. Leavitt got on the net from the balcony of SAC’s underground command post, overlooking the world map. Although he’d flown B-52s for a year, worked at the Pentagon, commanded an Air Force training center, and served on the staff of a NATO general, Leavitt still had the manner of an old-fashioned fighter pilot: cocky, decisive, self-reliant. He did not, however, have firsthand experience working with Titan II missiles. Nor did Colonel Russell Kennedy, the director of missile maintenance at SAC headquarters, who joined Leavitt on the balcony. They would have to rely on the advice and the expertise of others.

THE PRESENCE OF A WHITE hazy cloud on the other side of blast door 8 was ominous. Regardless of whether it was fuel vapor or smoke, it shouldn’t have been there when Gregory Lester opened the door, hoping to grab the RFHCOs. That meant blast door 9, leading to the cableway and the silo, had somehow been breached. That meant blast door 8 was all that stood between the men in the launch control center and a cloud of toxic, perhaps explosive fumes. The plan to reenter the silo was scrapped. Captain Mazzaro had already asked for permission to evacuate. Now he asked for it again, and Heineman, speaking on behalf of his PTS crew, wholeheartedly backed the request.

At the Little Rock command post, the hazard team debated what to do next. For the moment, their options were limited. The PTS team topside was still missing. Colonel Morris and Jeff Kennedy were en route in the helicopter but hadn’t brought along air packs and RFHCOs. Rodney Holder, the missile systems analyst technician at 4–7, was getting ready to power down the missile, so that a stray electrical spark wouldn’t ignite fuel vapor in the silo. Once the main circuit breakers were shut off, the men in the control center could do little more than stare at the changing tank pressures on the PTPMU.

The K crew worried about the safety of their counterparts at 4–7. Captain Jackie Wells, a member of the K crew, thought that if the missile collapsed, the fuel vapor that had leaked into the blast lock might ignite and rupture blast door 8. Even if the door held, debris from a large explosion might trap everyone in the control center. The blast doors and the escape hatch were supposed to ensure the crew’s survival, even after a nuclear detonation. But a Titan II complex had not yet faced that sort of test, and Wells thought the risks of leaving people in the control center outweighed any potential benefit.

The K crew advised Colonel Moser to order an evacuation. Sergeant Michael Hanson — the chief of PTS Team B, who was in the command post, preparing to lead a convoy to the site — agreed. He didn’t think the control center would survive a blast. And he wanted his buddies to get out of there, right away.

Captain Charles E. Clark, the wing’s chief technical engineer, said that the crew should stay right where they were. He had faith in the blast doors. And he warned Colonel Moser that if the crew left, the command post would have no way of knowing the tank pressures inside the missile and no means of operating the equipment within the complex. Clark argued that the crew should remain in the control center, monitor the status of the missile — and open the massive silo door above it. Opening the door would dilute the fuel vapor with air, making the vapor less flammable. The temperature in the silo would drop, and as the oxidizer tanks cooled, they’d become less likely to burst. Opening the door wouldn’t pose much of a threat to Damascus. Unlike the oxidizer, the fuel would dissipate rapidly in the atmosphere. It wouldn’t travel for miles, sickening people and killing cattle. First Lieutenant Michael J. Rusden, the bioenvironmental engineer, had calculated that with the winds prevailing at the moment, a toxic corridor would extend only four hundred to six hundred feet beyond the silo.

After consulting with SAC headquarters, Colonel Moser ordered everyone to evacuate the control center. And he asked SAC if the crew should open the silo door before they left.

That door was not to be opened under any circumstances, General Leavitt said. The idea wasn’t even worth discussing. Leavitt wanted the fuel vapors fully contained in the silo. He did not want a cloud of Aerozine-50 floating over nearby houses and farms. More important, he didn’t want to risk losing control of a thermonuclear weapon. Leavitt felt absolutely certain that if the missile blew up, the warhead wouldn’t detonate. He’d been around nuclear weapons for almost thirty years. In 1952 he’d been secretly trained to deliver atomic bombs from a fighter plane, in case they were needed during the Korean War. He had complete faith in the safety mechanisms of the W-53 warhead atop the Titan II. But nobody could predict how far the warhead would travel, if the missile exploded with the silo door open. Leavitt didn’t want a thermonuclear weapon landing in a backyard somewhere between Little Rock and St. Louis. Maintaining control of the warhead was far more important, he thought, than any other consideration.

The K crew waited tensely to hear if the men had made it out of the control center. Before abandoning the complex, the launch crew had left the phone off the hook — and when the intruder alarm suddenly went off at 4–7, the sound could be heard over the phone in the command post. That meant someone topside had opened the door to the escape hatch. More time passed without any word, and then Sergeant Brocksmith was on the radio, saying that he had everyone in his pickup truck.

Sergeant Hanson left the command post and went to the PTS shop, where Sandaker and the other volunteers were gathering their equipment. The Disaster Response Force left the base at about nine o’clock, but PTS Team B needed more time to get ready. Once they arrived at 4–7, Hanson thought the plan would go something like this: two men would put on RFHCOs, enter the complex through the access portal, open the blast doors, walk down the long cableway to the silo, and try to vent the missile. Perhaps they’d also turn on the purge fan to clear vapors from the silo.

Unsure of what equipment was available at 4–7, Hanson decided that PTS Team B had to bring everything it needed. They had to gather the gear, load it into five trucks, stop at two other missile complexes, and pick up items that the shop didn’t have. Although PTS Team B wanted to get to 4–7 as quickly as possible, logistical problems delayed them, including an unexpected stop for water. Hanson’s truck was the only one with a radio. Whenever he needed to communicate with the others, the entire convoy would have to pull over to the side of the road, and someone would get out of the truck to explain their next move.

The Little Rock command post continued to have communications difficulties, as well. Once the control center was evacuated, the radio in Sergeant Brocksmith’s truck became the only way to speak with people at the missile site. Unfortunately, the radio transmissions from his truck weren’t scrambled or secure. Anyone who knew the right frequency could listen to them, and the sound quality was less than ideal. Major Joseph A. Kinderman — the head of the wing’s security police, who manned the radio at the command post — found that conversations were sometimes garbled and difficult to understand.

At about half past nine, Major Kinderman reported the latest set of tank pressures, and a sergeant added them to the chalkboard. For a moment, everyone focused on the pressure in the stage 1 fuel tank. During the hour since the last reading, it had fallen from -0.7 to -2 psi. Those numbers were disturbing, they suggested the tank was on the verge of collapse — and then a member of the K crew wondered, how the hell does anyone know what the tank pressures are? The control center had been evacuated at about half past eight. Kinderman asked Colonel Morris where those numbers came from.

Morris had provided the numbers, but didn’t answer the question. He was sitting in Brocksmith’s security police truck, parked at the end of the access road, off Highway 65.

Kinderman waited for a reply, and then Captain Mazzaro got on the radio and said that Kennedy had reentered the control center, without permission, violating the two-man rule.

Members of the K crew couldn’t believe what Kennedy had just done. Colonel Moser was more upset than angry, and he wasn’t thrilled about telling SAC headquarters. But the information that Kennedy obtained was extremely useful. Moser shared the numbers with everyone on the net and described Kennedy’s unauthorized behavior. General Leavitt seemed unperturbed. Although one of SAC’s cardinal rules had just been broken, Leavitt appreciated the importance of having the latest tank pressures — and the personal risk that Kennedy had taken to get them.

Colonel Morris was told not to allow any further actions at the launch complex without the approval of SAC headquarters. And while the PTS convoy drove to 4–7, the discussion on the net turned to whether the power at the complex should be completely shut off. The crew had turned off everything they could before leaving, but the water pumps on level 8 of the silo were still running, as were a series of fans, motors, and relays connected to the air-conditioning and ventilation systems. General Leavitt worried that a spark from one of these motors or the slightest bit of electrical arcing could ignite the fuel vapor in the silo. The command post called the Petit Jean Electric Company, the local utility in Damascus, and asked it to send over workers who could climb the poles and disconnect the jacks from power lines leading to the complex.

The majority of the hazard team in Little Rock wanted to leave the power on. If the power were cut, the phone in the control center would go dead, and they wouldn’t be able to monitor the vapor detector left behind there. The sound of the detector going off would signal that fuel vapor had seeped past blast door 8. Anyone who reentered the complex to save the missile would find the job more difficult, without power. You wouldn’t be able to check tank pressures, turn on the purge fan, or do anything in the silo, aside from removing the pressure cap by hand and venting the stage 1 fuel tank.

The workers from Petit Jean were told to stand by, and for the time being, the power stayed on. An executive from Martin Marietta, the manufacturer of the Titan II, had joined the net, giving estimates of the tank pressures at which the stage 1 fuel tank was likely to collapse and the oxidizer tank to burst. The situation felt grim. Nevertheless, members of the hazard net debated how PTS Team B should proceed, step by step, upon their arrival at 4–7. First, everyone had to reach a consensus on the proper course of action — and then they had to write a checklist for it. The audio quality of the conference call was mediocre, and with so many people involved in the discussion, at half a dozen locations, it was often hard to figure out who was saying what.

One of the most authoritative voices had a strong Texan accent. It belonged to Colonel Ben Scallorn, the deputy chief of staff for missiles at Eighth Air Force headquarters in Louisiana. Moser had served under Scallorn at Whiteman Air Force Base and phoned him right after hearing about the accident in Damascus, wanting to get his opinion, privately, of how bad it sounded. Scallorn didn’t sugar the pill; he thought it sounded really bad. He knew the Titan II as well as just about anyone else at SAC. He’d worked long hours in silos wearing a RFHCO and seen firsthand how dangerous the missile could be. During the discussions on the Missile Potential Hazard Net, he was blunt about what needed to be done at 4–7, regardless of whether anyone would listen.

WHEN BEN SCALLORN FIRST REPORTED to Little Rock Air Force Base in 1962, the Titan II silos there were still being dug. The missile maintenance department consisted of three people: a first lieutenant who ran it, a sergeant who served as his clerk, and a secretary. The 308th Strategic Missile Wing had not yet been activated, and the Air Force was eager to get the Titan IIs into the ground. Scallorn was glad to be in Little Rock, preparing to study missile maintenance. His previous assignment in the Air Force had been “recreational services.” For years he’d managed softball fields, swimming pools, movie theaters, and service clubs at SAC bases everywhere from Mississippi to Morocco. He was thirty-three, with a wife and three small boys. Helping to deploy America’s largest ballistic missile, at the dawn of the missile age, promised to be a more rewarding career path. He was sent to Sheppard Air Force Base in Wichita Falls, Texas, to learn how the Titan II worked — and six weeks later returned to Little Rock as chief of maintenance training at the 308th.

Scallorn visited the launch complexes around Little Rock as they were being constructed. Each one was a massive endeavor, requiring about 4.5 million pounds of steel and about 30 million pounds of concrete. Elaborate water, power, and hydraulic systems had to be laid underground. The silo door was too heavy to be transported by road; it arrived in eight pieces for assembly at the site. In order to bring missiles on alert as quickly as possible, the Air Force relied on a management practice known as “concurrency”: work began on the Titan II complexes long before a Titan II missile had flown. Both would be completed at roughly the same time.

The Air Force also used concurrency to speed the deployment of other ballistic missiles. Led by the Army Corps of Engineers, tens of thousands of workers dug hundreds of silos to hide missiles beneath the landscape of rural America. It was one of the largest construction projects ever undertaken by the Department of Defense. In addition to Arkansas, underground launch complexes were placed in Arizona, California, Colorado, Idaho, Kansas, Missouri, Nebraska, New Mexico, New York, Oklahoma, South Dakota, Texas, Washington, and Wyoming. Between Malmstrom Air Force Base in Montana and Minot Air Force Base in North Dakota, missile silos were dispersed across an area extending for thirty-two thousand square miles.

About an hour north of Santa Barbara, along a stretch of the central California coast with forty miles of pristine beaches and rocky cliffs, the Air Force built a missile research center and the first operational missile site. Later known as Vandenberg Air Force Base, it provided a clear shot to target sites at Eniwetok and Kwajalein in the Marshall Islands. Like the missile complexes in America’s heartland, Vandenberg was rushed to completion. Within a few years of its opening in 1957, the base had launchpads, silos, underground control centers, storage facilities, administrative buildings, and a population of about ten thousand.

Although concurrency sped the introduction of new weapons, it also created problems. A small design change in a missile could require costly changes in silo equipment that had already been installed. The prototype of a new airplane could be flight-tested repeatedly to discover its flaws — but a missile could be flown only once. And missiles were expensive, limiting the number of flight tests and the opportunity to learn what could go wrong. A successful launch depended on an intricate mix of human and technological factors. Design errors were often easier to correct than to anticipate. As a result, the reliability of America’s early missiles left much to be desired. “Like any machine,” General LeMay noted, with understatement, “they don’t always work.”

The first intercontinental missile deployed by the United States, the Snark, had wings, a jet engine, and a range of about six thousand miles. It was a great-looking missile, sleek and futuristic, painted a fiery red. But the Snark soon became legendary for landing nowhere near its target. On long-distance flights, it missed by an average of twenty miles or more. During one test launch from Cape Canaveral, Florida, a Snark that was supposed to fly no farther than Puerto Rico just kept on going, despite repeated attempts by range safety officers to make it self-destruct. When the slow-moving missile passed Puerto Rico, fighter planes were scrambled to shoot it down, but they couldn’t find it. The Snark eventually ran out of fuel and crashed somewhere in the Amazonian rain forests of Brazil. Air Force tests later suggested that during wartime, only one out of three Snarks would leave the ground and only one out of ten would hit its target. Nevertheless, dozens of Snarks were put on alert at Presque Isle Air Force Base in Maine. The missile carried a 4-megaton warhead.

Again and again, the symbolism of a missile seemed more important than its military usefulness. The Army’s Redstone missile was rushed into the field not long after the Soviet Union launched Sputnik. Designed by Wernher von Braun and his team of German rocket scientists at the Redstone Arsenal in Huntsville, Alabama, the missile was a larger, more advanced version of the Nazi V-2. The Redstone often carried a 4-megaton warhead but couldn’t fly more than 175 miles. The combination of a short range and a powerful thermonuclear weapon was unfortunate. Launched from NATO bases in West Germany, Redstone missiles would destroy a fair amount of West Germany.

The intermediate-range missiles that President Eisenhower offered to NATO were also problematic. The Thor missiles sent to Great Britain were stored aboveground, lying horizontally. They had to be erected and then fueled before liftoff. It would take at least fifteen minutes to launch any of the missiles in a Thor squadron and even longer to get them all off the ground. The missiles’ lack of physical protection, lengthy countdown procedures, and close proximity to the Eastern bloc guaranteed that they’d be among the first things destroyed by a Soviet attack. The four-minute warning provided by Great Britain’s radar system wouldn’t offer much help to the RAF officers in charge of a Thor squadron that might need as much as two days to complete its mission. They might not have time to launch any Thors. The missiles would, however, be useful for a surprise attack against the Soviet Union — a fact that gave the Soviets an even greater incentive to strike first and destroy them. Instead of deterring an attack on Great Britain, the Thors seemed to invite one.

The military value of the Jupiter missiles offered to Italy and Turkey was equally dubious. Jupiters were also slow to launch, stored aboveground, and exposed to attack. Unlike the Thors, they stood upright, encircled by launch equipment hidden beneath metal panels. When the panels opened outward before liftoff, a Jupiter looked like the pistil of a huge, white, sinister flower. Sixty feet high, topped by a 1.4-megaton warhead, and deployed in the countryside, the missiles were especially vulnerable to lightning strikes.

In the days and months following Sputnik, the Atlas missile loomed as America’s great hope, its first ICBM, designed to hit Soviet targets from bases in the United States. But producing a missile that could reliably reach the Soviet Union took much longer than expected. An Air Force missile expert later described its propellant system as a “fire waiting to happen.” Liquid oxygen (LOX), the missile’s oxidizer, was dangerously unstable. About twenty thousand gallons of LOX had to be stored in tanks outside the Atlas, at a temperature of -297 degrees Fahrenheit — and then pumped into the missile during the countdown. The margin for error was slim. During a series of dramatic, well-publicized mishaps at Vandenberg, Atlas missiles exploded on the launchpad, veered wildly off course, or never left the ground. Nevertheless, the first Atlas went on alert in 1959. At a top secret hearing two years later, an Air Force official admitted to Congress that the odds of an Atlas missile hitting a target in the Soviet Union were no better than fifty-fifty. General Thomas Power, the head of SAC, who much preferred bombers, thought the odds were closer to zero.

Developed as a backup to Atlas, the Titan missile incorporated a number of new technologies. It had a second stage that ignited in the upper atmosphere, enabling the launch of a heavier payload. Although it relied on the same propellants as the Atlas, the Titan would be based in an underground silo, gaining some protection from a Soviet attack. The missile would be filled with propellants underground, about fifteen minutes before launch, and then would ride an elevator to the surface before ignition. The elevator was immense, capable of lifting more than half a million pounds. But it didn’t always work. During a test run of the first Titan silo, overlooking the Pacific at Vandenberg, a control valve in the elevator’s hydraulic system broke. The elevator, the Titan, and about 170,000 pounds of liquid oxygen and fuel fell all the way to the bottom of the silo. Nobody was hurt by the explosion, though debris from it landed more than a mile away. The silo was destroyed and never rebuilt.

While Atlas and Titan missiles were being prepared for their launch complexes, the Air Force debated whether to deploy another liquid-fueled, long-range missile: the Titan II. It would be more accurate and reliable, carry a larger warhead, store propellants within its airframe, launch from inside a silo, and lift off in less than a minute. Those were compelling arguments on behalf of the Titan II, and yet critics of the missile asked a good question — did the Air Force really need four different types of ICBM? It had already committed to the development of the Minuteman, a missile that would be small, mass-produced, and inexpensive. The Minuteman’s solid fuel would burn slowly from one end, like a big cigar, and didn’t pose the same risks as liquid propellants.

Donald Quarles was one of the leading skeptics at the Pentagon, eager to cut costs and avoid the unnecessary duplication of weapon systems. No longer secretary of the Air Force, he was the second-highest-ranking official at the Pentagon, rumored to be Eisenhower’s choice to become the next secretary of defense. And then Quarles suddenly died of a heart attack, amid the long hours and great stress of his job. Funding of the Titan II was soon approved, largely due to the size of its warhead. General LeMay didn’t care much for the Atlas, Titan, or Minuteman — missiles whose only strategic use was the annihilation of cities. But the Titan II, with its 9 megatons, was the kind of weapon he liked. It could destroy the deep underground bunkers where the Soviet leadership might hide, even without a direct hit.

One of the many challenges that the designers of the Titan II faced was how to bring the warhead close to its target. The Titan II’s rocket engines burned for only the first five minutes of flight. They provided a good, strong push, enough to lift the warhead above the earth’s atmosphere. But for the remaining half hour or so of flight, it was propelled by gravity and momentum. Ballistic missiles were extraordinarily complex machines, symbols of the space age featuring thousands of moving parts, and yet their guidance systems were based on seventeenth-century physics and Isaac Newton’s laws of motion. The principles that determined the trajectory of a warhead were the same as those that guided a rock thrown at a window. Accuracy depended on the shape of the projectile, the distance to the target, the aim and strength of the toss.

Early versions of the Atlas and Titan missiles had a radio-controlled guidance system. After liftoff, ground stations received data on the flight path and transmitted commands to the missile. The system eventually proved to be quite accurate, landing about 80 percent of the warheads within roughly a mile of their targets. But radio interference, deliberate jamming, and the destruction of the ground stations would send the missiles off course.

The Titan II was the first American long-range missile designed, from the outset, to have an inertial guidance system. It didn’t require any external signals or data to find a target. It was a completely self-contained system that couldn’t be jammed, spoofed, or hacked midflight. The thinking behind it drew upon ancient navigational rules: if you know exactly where you started, how long you’ve been traveling, the direction you’ve been heading, and the speed you’ve been going the whole time, then you can calculate exactly where you are — and how to reach your destination.

“Dead reckoning,” in one form or another, had been used for millennia, especially by captains at sea, and the key to its success was the precision of each measurement. A poor grasp of dead reckoning may have led Christopher Columbus to North America instead of India, a navigational error of about eight thousand miles. On a ship, the essential tools for dead reckoning were a compass, a clock, and a map. On a missile, accelerometers measured speed in three directions. Spinning gyroscopes kept the system aligned with true north, the North Star, as a constant reference point. And a small computer counted the time elapsed since launch, calculated the trajectory, and issued a series of instructions.

The size of the guidance computer had been unimportant in radio-controlled systems, because it was located at the ground station. But size mattered a great deal once the computer was going to be carried by the missile. The Air Force’s demand for self-contained, inertial guidance systems played a leading role in the miniaturization of computers and the development of integrated circuits, the building blocks of the modern electronics industry. By 1962 all of the integrated circuits in the United States were being purchased by the Department of Defense, mainly for use in missile guidance systems. Although the Titan II’s onboard computer didn’t rely on integrated circuits, at only eight pounds, it was still considered a technological marvel, one of the most powerful small computers ever built. It had about 12.5 kilobytes of memory; many smart phones now have more than five million times that amount.

The short-range V-2 had been the first missile to employ an inertial guidance system, and the Nazi scientists who invented it were recruited by the Army’s Redstone Arsenal after the Second World War. They later helped to give the Jupiter missile an impressive Circular Error Probable — the radius of the circle around a target, in which half the missiles aimed at it would land — of less than a mile. But the longer a missile flew, the more precise its inertial guidance system had to be. Small errors would be magnified with each passing minute. The guidance system had to take into account factors like the eastward rotation of the earth. Not only would the target be moving toward the east as the world turned, but so would the point from which the missile was launched. And at different latitudes, the earth rotates at slightly different speeds. All these factors had to be measured precisely. If the missile’s velocity were miscalculated by just 0.05 percent, the warhead could miss its target by about twenty miles.

The accuracy of a Titan II launch would be determined early in the flight. The sequence of events left no room for error. Fifty-nine seconds after the commander and the deputy commander turned their keys, the Titan II would rise from the silo, slowly at first, almost pausing for a moment above the open door, before shooting upward, trailed by flames. About two and a half minutes after liftoff, at an altitude of roughly 47 miles, the thrust chamber pressure switch would sense that most of the oxidizer in the stage 1 tank had been used. It would shut off the main engine, fire the staging nuts, send stage 1 of the missile plummeting to earth, and ignite the stage 2 engine. About three minutes later, at an altitude of roughly 217 miles, the guidance system would detect that the missile had reached the correct velocity. The computer would shut off the stage 2 engine and fire small vernier engines to make any last-minute changes in speed or direction. The vernier engines would fire for about fifteen seconds. And then the computer would blow the nozzles off them and detonate an explosive squib to free the nose cone from stage 2. The nose cone, holding the warhead, would continue to rise into the sky, as the rest of the missile drifted away.

About fourteen minutes later, the nose cone would reach its apogee, its maximum height, about eight hundred miles above the earth. Then it would start to fall, rapidly gaining speed. It would fall for another sixteen minutes. It would reach a velocity of about twenty-three thousand feet per second, faster than a speeding bullet — a lot faster, as much as ten to twenty times faster. And if everything had occurred in the right order, at the right time, precisely, the warhead would detonate within a mile of its target.

In addition to creating an accurate guidance system, missile designers had to make sure that a warhead wouldn’t incinerate as it reentered the atmosphere. The friction created by a falling body of that size, at those speeds, would produce surface temperatures of about 15,000 degrees Fahrenheit, hotter than the melting point of any metal. In early versions of the Atlas missile, the nose cone — also called the “reentry vehicle” (RV) — contained a large block of copper that served as a heat sink. The copper absorbed heat and kept it away from the warhead. But the copper also added a lot of weight to the missile. The Titan II employed a different technique. A thick coating of plastic was added to the nose cone, and during reentry, layers of the plastic ablated — they charred, melted, vaporized, and absorbed some of the heat. The cloud of gases released by ablation became a buffer in front of the nose cone, a form of insulation, reducing its temperature even further.

The nose cone not only protected the warhead from heat, it also contained the weapon’s arming and fuzing system. On the way up, a barometric switch closed when it reached a specific altitude, allowing electricity to flow from the thermal batteries to the warhead. On the way down, an accelerometer ignited the thermal batteries and armed the warhead. If the warhead had been set for an airburst, it exploded at an altitude of fourteen thousand feet when a barometric switch closed. If the warhead had been set for a groundburst — or if, for some reason, the barometric switch malfunctioned — it exploded when the piezoelectric crystals in the nose cone were crushed upon impact with the target. Instead of being vaporized by reentry, the warhead was kept cool and intact long enough to vaporize everything for miles around it.

Three strategic missile wings were formed to deploy the Titan II, each with eighteen missiles, located in Arkansas, Kansas, and Arizona. The Air Force felt confident that the Titan II would be more reliable than its predecessors. At first, perhaps 70 to 75 percent of the missiles were expected to hit their targets, and as crews gained experience, that proportion would rise to 90 percent. Newspapers across the country heralded the arrival of the Titan II, America’s superweapon, “the biggest guns in the western world.” The missile would play a dual, patriotic role in the rivalry with the Soviet Union. It would carry SAC’s deadliest warhead — and also serve, in a slightly modified form, as the launch vehicle to send NASA’s Gemini astronauts into space. At Little Rock Air Force Base, the introduction of the Titan II was greeted with a nervous enthusiasm. The first launch crews had to train with cardboard mock-ups of equipment, and the number of operational launch complexes in Arkansas soon exceeded the number of crews qualified to run them. Vital checklists were still being written and revised as the missiles were placed on alert.

Ben Scallorn became a site maintenance officer for the 308th Strategic Missile Wing, eventually overseeing half a dozen Titan II launch complexes. He liked the new job and didn’t hesitate to wear a RFHCO and work long hours beside his men. Launch Complex 373-4 in Searcy was one of his sites. After the fire killed fifty-three workers there, he was part of the team that pulled the missile from the silo. It was a sobering experience. Thick black soot covered almost everything. But handprints could still be seen on the rungs of ladders, and the bodies of fallen workers had left clear outlines on the floor. Scallorn could make out the shapes of their arms and legs, the positions of their bodies as they died, surrounded by black soot. All that remained of them were these pale, ghostly silhouettes.

JEFF KENNEDY WAS FURIOUS. They were just sitting there in the dark, at the end of the access road, with their thumbs up their asses, doing nothing, while the missile got ready to blow. Colonel Morris said they’d been ordered to wait for further instructions — period. The decisions were being made elsewhere, and nothing, nothing was to be done without the approval of SAC headquarters. Morris hadn’t shared Kennedy’s latest plan with the command post, and nobody had asked to hear it. In fact, none of the PTS guys or launch crew members on the scene had been asked to give an opinion of what should be done.

Kennedy thought that was bullshit. They were there. They were ready to go. They had all the knowledge and experience you needed. What were they waiting for? Every minute they waited to do the job would make the job more dangerous.

At about 10:15, almost four hours after the accident, the Disaster Response Force arrived. But its commander, Colonel William Jones, had no authority at the site — a disaster hadn’t occurred yet. The five vehicles in his convoy pulled off Highway 65 and parked along the access road. Members of his team got out of their trucks, introduced themselves, and distributed Crations and cans of water.

Colonel Morris asked the flight surgeon who’d come with the ambulance, Captain Donald P. Mueller, to do him a favor. Mueller had never worked with the Disaster Response Force before. He was twenty-eight years old and happened to be the doctor on call at the base hospital that night. Morris asked him to speak with Mazzaro, the missile crew commander. Morris was concerned about Mazzaro: he didn’t look well. He seemed anxious and tense. Mueller spent about forty-five minutes with Mazzaro, who admitted to feeling worried about his pregnant wife. Mazzaro wanted someone to call his wife and tell her that he was safe. Mueller assured him that she’d already been contacted — and that Fuller’s wife, who was also pregnant, had been contacted, too. Both women knew their husbands were safe. The news made Mazzaro feel better, and he lay down in the back of the ambulance to rest.

SERGEANT BROCKSMITH WAS HAVING TROUBLE supervising the evacuation of local residents. Colonel Jones and Colonel Morris would periodically sit in his truck and use his radio to speak with the command post. When one of them was on the Security Police Net, Brocksmith’s officers couldn’t communicate with each other. And his officers didn’t have maps of the area. And they didn’t have an evacuation plan or any formal guidance about how an evacuation should proceed. The only map that Brocksmith had in his truck showed the location of nearby Titan II complexes. But it didn’t show where any houses, farms, schools, or even streets were located.

The Missile Potential Hazard Team instructed Brocksmith to post officers in a roughly three-quarters-of-a-mile radius around 4–7. Two Missile Alarm Response Teams were available for the job, and a couple of Mobile Fire Teams (MFTs) had been sent from Little Rock. That gave Brocksmith ten military police officers to secure the area. The MARTs were trained to guard Titan II sites, the MFTs to defend the air base from sabotage and attack, using machine guns, grenade launchers, and M-16 rifles. The MFTs — most of whom had never seen a Titan II complex — left their machine guns and grenade launchers in Little Rock. Brocksmith established roadblocks on Highway 65 and stationed officers on County Roads 836 and 26, a pair of dirt roads that crossed the highway north and south of the missile complex. The officers on County Road 836 were forced to stop short of their assigned position. They’d encountered an old wooden bridge, and they were afraid to drive their truck over it.

The military police had no legal jurisdiction on civilian property and couldn’t order anyone to evacuate. As officers knocked on doors in the middle of the night, carrying flashlights and M-16s, they found that most of the houses were empty. Sheriff Anglin or the state police had already been there. The handful of residents who’d refused to leave their homes generally fell into two categories: some were stubborn and defiant, while others, like Sam Hutto, were sneaky. Hutto kept returning to his farm, on back roads, to look after the cows.

The roughly two hundred officers in the security police squadron had been recalled to Little Rock Air Force Base. Sergeant Donald V. Green was serving as a referee at a football game when he heard about the recall. Green quickly went home, changed into his uniform, and reported for duty. He was in his early thirties, born and raised in Old Town, Florida, a small rural community about forty miles west of Gainesville. He lived on the base with his wife and six-year-old son. And he loved being a military police officer, despite how most people viewed the job. Being a cook or a cop, those were the only two jobs at SAC that nobody seemed to want. Too often, he thought, guys who’d flunked out of every technical school in the Air Force would be assigned to the military police. But the camaraderie among the officers was strong, their work interesting and important — even if it was rarely appreciated.

Green was the noncommissioned officer in charge of training at the 308th. He taught MART teams everything they needed to know about the Titan II. The teams escorted warheads to and from launch sites, kept an eye on warheads as they were being mated to missiles, and responded whenever an alarm went off. Officers learned how to deal with antiwar protesters, saboteurs, and all sorts of false alarms. A bird flying past the tipsies could set them off, and then a two-man MART team would have to visit the site and investigate what had tripped them — because the complexes didn’t have security cameras topside. A missile crew had no way of knowing whether the tipsies had been set off by a squirrel or a squad of Soviet commandos. A MART team usually stayed overnight at a launch control center in each sector, using that “home complex” as a base to oversee security at three or four neighboring sites.

Four-seven often served as a home complex, and one of Sergeant Green’s teams had pointed out a major security breach there, just a few weeks before the accident. Green had been amazed by their discovery: you could break into a Titan II complex with just a credit card. Once the officers showed him how to do it, Green requested permission to stage a black hat operation at 4–7 — an unannounced demonstration of how someone could sneak into the launch control center undetected. SAC had a long history of black hatting to test the security at its facilities. Black hat teams would plant phony explosives on bombers, place metal spikes on runways, infiltrate a command post and then hand a letter to the base commander that said, “You’re dead.” General LeMay liked to run these tests and to punish officers who failed them. After Green received the go-ahead to stage a black hat at 4–7, his men secretly practiced the breakin.

On the day of the exercise, Green and two of his officers, Donald G. Mowles, Jr., and Larry Crowder, began the subterfuge by setting off the tipsies at Launch Complex 374-8 — about ten miles from Damascus, in the town of Little Texas. When the alarm sounded there, the MART team stationed at 4–7 got a call and drove off to see what was wrong. Green and his men hurried to Damascus, jumped the perimeter fence at 4–7, carefully avoided the radar beams that set off the tipsies, and entered the access portal. Green picked up the phone and told the missile crew commander that “General Wyatt” — a fictitious, high-ranking officer — needed to see a schematic drawing in one of the technical manuals. When the crew commander hesitated, Green demanded his name and warned him the general would be unhappy with that response. The commander said he’d look for the drawing right away.

Taking advantage of the distraction, Crowder and Mowles jimmied the lock on the outer steel door with an ID card, ran down the stairs, and within seconds jimmied the door at the entrapment area, too. The men ran past the only security camera at the launch complex. But the missile crew wasn’t looking at the television monitor — they were probably searching for that tech drawing — and the entrapment area didn’t have a microphone to capture the sounds of a breakin.

Green ran back to the perimeter fence, climbed over it, got into his truck, drove a safe distance from the launch complex, and parked.

Crowder and Mowles hid outside blast door 6, waiting. When the MART team returned from the false alarm at the other launch site, it was given permission to reenter 4–7. The team was buzzed through the first two doors and walked downstairs to blast door 6 — where it was surprised to hear a voice say, “You’re dead.”

One of Green’s men picked up the phone there and said, “Security team at blast door six.”

The door was opened, as were blast doors 7 and 8. Crowder and Mowles walked into the control center, feeling awfully pleased.

Steel plates were soon welded to the outer doors at Titan II sites so that intruders would need more than a credit card.

THE DRIVE TO DAMASCUS SEEMED to be taking forever, as the PTS convoy picked up equipment at two launch complexes, made three stops, and obeyed the speed limit.

“I’ve got a bad feeling about this,” Senior Airman David Livingston said. “Somebody’s going to die out there tonight.”

The other members of Team B didn’t like hearing Livingston talk that way. He wasn’t a fearful or high-strung type. He was one of the most easygoing, laid-back guys at the base. If anything, Livingston was too laid back. He’d become legendary for his ability to sleep just about anywhere, anytime — and once he was out, it was almost impossible to wake him. Jeff Kennedy would sometimes have to bang on Livingston’s door in the morning and yell at him and literally drag him out of bed. But nobody really minded, because once he was awake and alert, Livingston worked hard. He knew how to fix things. He was constantly tinkering with mechanical objects in his spare time — with citizens band radios, lawn mower engines, transmissions, and the old VW Beetle that he’d bought a few years earlier, right after graduating from high school. He loved to ride motorcycles and could pop a wheelie, lean back in the seat, and cruise.

During the previous summer, Livingston had visited his family in Heath, Ohio, a small town surrounded by cornfields in the central part of the state, where his father drove a truck and his mother worked as a clerk at a nearby Air Force base. He’d ridden his motorcycle there and back for a long weekend, a round trip of about fifteen hundred miles. He lived off base in a double-wide trailer, planned to ask his landlord’s niece to marry him, and couldn’t decide whether to move with her to California or sign on for another four years with SAC. The hardest part about leaving the Air Force, Livingston thought, would be saying good-bye to his loud, rowdy PTS buddies. They felt like family.

Senior Airman Greg Devlin was riding next to Livingston in the truck. At first he thought Livingston was joking about the bad vibes and the premonition of death. But it wasn’t funny. And then Livingston said it again.

“Somebody’s going to die tonight, I can feel it.”

“Don’t even be kidding around with stuff like that,” Devlin said. “Don’t even be talking about that.”

Devlin wasn’t very superstitious. He just didn’t like to dwell on bad things. The job was full of risks, and if something dangerous had to be done, his attitude was: okay, let’s go do it. There was no use talking about it or thinking about it too much. He was the type of person who instinctively ran toward a fire, not from it. And he didn’t like to waste time worrying about it first.

Devlin, like Livingston, had grown up in Ohio, graduated from high school in 1977, and joined the Air Force that year. Devlin had to miss his high school graduation; it was held the day after he reported for duty. During basic training, he was seventeen years old. His father and his uncles had been Marines, but Devlin was drawn to the Air Force. He wanted to become a pilot or an airplane mechanic. The Air Force decided, instead, that he would become a Titan II propellant transfer system technician. At training school, he desperately missed his high school sweetheart, Annette Buchanan. With her mother’s blessing, they soon got married, and Annette joined him in Arkansas. She was sixteen. The newlyweds started out in a small trailer and then made a down payment on their first house, when Devlin turned nineteen. The house was in Jacksonville, not far from Little Rock Air Force Base. His friends didn’t like to throw parties in the dormitories, because they always had to worry about the dorm monitors and the dorm guards. And so almost every weekend, the parties were held at Devlin’s house. A fair amount of alcohol was consumed. And if a party got a little out of hand, Devlin knew how to deal with it. He was friendly, courteous, even tempered — and a Golden Gloves boxer, just like his father, his uncles, and one of his grandfathers had been. Devlin trained at a local gym. He fought as a junior middleweight and had recently scored five straight knockouts. When he asked people to quiet down at a party, they generally did.

AT THE COMMAND POST, a checklist was slowly being prepared. Each step had to be discussed on the Missile Potential Hazard Net and then approved by General Leavitt. Colonel Moser spoke on behalf of his team, after listening to the recommendations of the K crew and everyone else on the net. At about eleven o’clock, a consensus seemed to have emerged, and Moser read the latest plan aloud:

The portable vapor detector — a blue rectangular steel box that weighed about twelve pounds, with a round gauge on top — wasn’t an ideal instrument for the task. It “pegged out” and shut off when the vapor level reached a maximum of 250 ppm. But it was the best they had.

Colonel Scallorn wasn’t happy with part of the plan. He was concerned about the rising heat in the silo, the risk that an oxidizer tank would rupture from the heat, and the huge explosion that would follow. Working outdoors with PTS teams, he’d seen how sensitive the oxidizer could be to small increases in temperature. On a cold, clear day at a launch site in Arkansas, the stainless steel mesh of an oxidizer hose could get warm enough, just from lying in the sun, to blow off a poppet. He thought it would be foolish to enter the silo without knowing the tank pressures inside the missile. It wasn’t worth the risk. It would put these young men in harm’s way. Over the years, he’d found that some people at SAC headquarters treated maintenance crews and PTS guys like they were expendable.

Scallorn suggested, on the net, that the two airmen should enter the launch control center first, check the tank pressures on the PTPMU, and turn on the purge fan to clear fuel vapor from the silo. They could always go into the silo later.

General Leavitt didn’t appreciate the suggestion. “Scallorn, just be quiet and stop telling people what to do,” he snapped. “We’re trying to figure this thing out.”

“Roger, General,” Scallorn replied. “You got that, Moser?”

It was an awkward moment. Nobody liked to hear one of SAC’s leading Titan II experts being told to shut up.

Not long afterward, Charles E. Carnahan, a vice president at Martin Marietta, who’d been quietly listening to the discussion, spoke up.

“Little Rock, this is Martin-Denver,” Carnahan said. “Are you interested in any of our judgments in this matter?”

Of course, Leavitt told him, go ahead.

“If it was us, we would seriously consider not moving into the silo area for some number of hours.”

Carnahan was asked if he meant the silo or the entire launch complex.

“I am talking about the launch complex,” he said. “It is entirely possible that the leak is still leaking. It is our judgment that while the leak continues, the vapor content in the silo and the general area will continue to rise. The potential for a monopropellic explosion increases as the vapor content increases. Once the leak has leaked out, if you have no explosion, it is our judgment that the vapor content in the area will decrease. We are unclear as to the gain that is expected from an early entry, or an entry at this point in time, into the complex area.”

After hours of debating what to do, the Missile Potential Hazard Team now had to ponder the advice of the company that built the missile: do nothing.

A SMALL GROUP OF REPORTERS stood along Highway 65, watching the Air Force trucks roll up. It was about half past eleven, and Sid King was impressed by all the Air Force personnel and equipment that suddenly appeared. Crews from the local television stations in Little Rock pointed their lights and cameras at the vehicles, as military police tried to keep the press off the access road. A cattle guard about thirty feet from the highway served as the line that civilians were prohibited to cross. The questions shouted by reporters were ignored. Sergeant Joseph W. Cotton, the public affairs officer who’d arrived with the Disaster Response Force, had already told the press that there was a fuel leak and it was under control. Cotton refused to say anything more. And he gave reporters the phone number of SAC headquarters in Omaha, in case they had any further questions.

King and his friend Tom Phillips thought about sneaking closer to the launch complex to see what was happening. King knew Ralph and Reba Jo Parish, who owned the farm to the north of the missile site. Although the Parishes had been evacuated, King was sure they wouldn’t mind his entering the property and heading west through their fields toward the silo. King and Phillips quietly discussed the plan, feeling confident they wouldn’t get caught. It was dark out there. But they wondered what would happen if they were caught — and decided, for the time being, to stay put.

PTS Team B unloaded their gear just past the cattle guard, along the road to the launch complex, relying on flashlights to see what they were doing. The television crews had better lights.

Man, those look like space suits, Sid King thought, as the RFHCOs and their helmets were unpacked. He was struck by how young the airmen appeared. He’d expected to see gray-haired scientists and high-ranking Air Force officers coming to fix the missile. These guys were younger than him. They were kids.

Once the RFHCOs were laid out, the air packs filled, and everything ready to go, Sergeant Hanson walked over to Colonel Morris. He told Morris that a couple of people would be sent through the access portal into the silo.

Colonel Morris hadn’t heard anything about a plan to reenter the complex.

“Hey, wait a minute,” Morris said. “We’re not doing anything until I get directions.”

Morris got on the radio to the command post and asked, what’s the plan? He was told to stand by, they were still working on it.

COLONEL MOSER ASKED SAC headquarters if they should follow Martin Marietta’s advice.

“Well, let’s go over what we’ve got here,” General Leavitt said.

About half an hour earlier, Leavitt had called Governor Clinton in Hot Springs. Their conversation was brief and polite. He told Clinton that a team was about to reenter the complex and that the situation was under control. Clinton thanked him for the update and went to bed.

But Leavitt had changed his mind. He decided that they should wait and allow the fuel vapor to dissipate before sending anyone near the missile. And he asked everyone on the net to discuss what had happened at 4–7, from the moment the socket was dropped.

JEFF KENNEDY LAY ON THE GRASS atop a low hill. Silas Spann, a member of PTS Team B, sat beside him. Spann was one of the few African Americans who worked in missile maintenance, and he stood out in this part of rural Arkansas. Whenever he walked into one of the local shops, people looked surprised. Kennedy and Spann could see the launch complex down below. A thick white cloud still floated from the vents. The two men wondered what would happen if the missile exploded. Would the blast doors and the silo door hold, would they fully contain the blast? Both agreed that the doors would. They had faith in those big fucking doors. It was a warm, beautiful night with a slight breeze and plenty of stars in the sky.

DON GREEN WAS AT LITTLE ROCK Air Force Base, guarding the weapons storage area, around midnight, when a new set of officers came on duty. Green was told that he could go home. Before leaving, he stopped by central security control to see if anybody needed help. He bumped into another security officer, Sergeant Jimmy Roberts, who’d come there for the same reason. Roberts worked across the hall from Green, and the two were friends. They both felt like being useful; it was a busy night. A third security officer walked into the office and asked for a map. He was supposed to escort a flatbed truck carrying an all-terrain forklift to Launch Complex 374-7 but didn’t know how to get there. The job sounded pretty urgent: they needed the forklift to haul light-all units onto the complex, so that the PTS team could see what they were doing.

Green and Roberts said they’d be glad to escort the flatbed. They knew the way and could get the forklift out there fast. Instead of going home and getting into bed, they got into a pickup and headed to Damascus.

COLONEL MOSER LEFT the Missile Potential Hazard Net and used the Security Police Net to speak directly with Morris. It was almost one in the morning, and a decision had been made. He told Morris that three airmen should put on RFHCO suits. A checklist had been prepared, and Moser wanted him to copy it down, word for word.

Morris grabbed a piece of paper and a pencil and, while sitting in the front seat of Brocksmith’s truck, copied down the instructions.

It was the same checklist that the command post had prepared two hours earlier, except that the 200 ppm fuel vapor limit had been raised to 250 ppm.

Morris spent fifteen minutes listening carefully and writing down exactly what Moser said. They finished — and then Moser paused, told him to stand by, and signed off.

Morris sat in the truck, waiting. Twenty minutes later, Colonel Moser was on the radio again. There was a slight change of plan: instead of entering the silo, the two airmen in RFHCOs should enter the control center.

Moser stressed that the men should avoid passing through any fuel vapor. He didn’t want anyone to get hurt. And he passed along General Leavitt’s instructions that no electrical switch should be turned on or off without permission from SAC headquarters.

Colonel Morris left the truck, gathered the members of PTS Team B, and read them the final checklist. He went through every step. And he said, we don’t want any heroes out there. We’ll do exactly what’s on the paper, and that’s all, and then we’re all going to come back.

“Colonel, this is unreal,” Jeff Kennedy said. Kennedy could not believe that this was the plan. It was insane. It made absolutely no sense to send men into the launch complex through the access portal, instead of the escape hatch. The access portal was a much more dangerous route. If you went through the escape hatch, the trip to the control center would be quick and direct, and you wouldn’t have to open any blast doors with a goddamn hand pump. If you went through the escape hatch, you’d be protected by the blast doors, not impeded by them. And the escape hatch was on the opposite side of the complex from the missile. The access portal was a lot closer to the missile. Why send anyone in there? Of course you’d have to sample for fuel vapor every step of the way; you’d be in danger every step of the way. To reach the control center, the men would have to pass through the blast lock — and it was full of fuel vapor six hours ago, when PTS Team A opened the door a crack, took a peek, and then had to slam it shut. Why send anyone down the longest, most dangerous, most likely to be contaminated route? Kennedy thought this checklist must have been written by somebody who’d never set foot on a Titan II complex. Of course you can fit a man in RFHCO through the escape hatch, Kennedy argued. He’d just been through the escape hatch, so he ought to know.

Kennedy, this is the plan, Morris said. This is the plan that’s come down, and that’s it. End of discussion.

Sergeant Hanson had selected the three men who’d enter the complex and the three who would wait in RFHCOs, halfway down the access road, as backup. Kennedy wasn’t one of them. Kennedy and Hanson didn’t get along. Hanson wished Kennedy had returned to the base with the rest of PTS Team A. As team chief, Hanson was in charge of this operation. He didn’t think you could fit through the escape hatch in a RFHCO. He liked the checklist, and if Kennedy didn’t, that was too bad.

David Livingston, Greg Devlin, and Rex Hukle, a farm boy from Kansas, climbed into the back of a pickup truck, wearing their RFHCOs. Colonel Morris got into the front seat, along with Hanson and Captain George Short, chief of the field maintenance branch at the 308th. Before the truck drove down the road to the complex, Jeff Kennedy jumped into the back.

Outside the gate, Livingston, Devlin, and Hukle drew straws to see who would be the first to go in. Walking over to the exhaust vent, alone, as fuel vapor poured out of it, seemed like a brave thing to do. All of them were willing, but this felt like the best way to choose.

David Livingston drew the short straw.

Before anyone could enter the launch complex, a hole had to be cut in the chain-link fence. The gate was still locked, nobody had the key, and climbing over the fence in a RFHCO could tear the suit. Morris, Hanson, and Short spent about fifteen minutes making a hole with bolt cutters. They finished at two in the morning. Livingston put on his helmet and his air pack and prepared to go in. Although the pack was designed to hold an hour’s worth of air, the command post had instructed that it should be used for just half an hour. The air packs were considered unreliable — and running out of air amid a thick cloud of fuel vapor could kill you.

Hanson and Morris got into the front seat of the truck. Morris would stay in touch with the command post on the Security Police Net, and Hanson would talk to Livingston on the radio network at the launch complex. The two radio systems were incompatible. If General Leavitt wanted to give Livingston an order, Leavitt would have to tell Moser, who would have to tell Morris, who would have to tell Hanson, who would have to tell Livingston. Although Hanson had brought along a repeater to strengthen the signal, reception on the complex was spotty.

Carrying a flashlight and a vapor detector, Livingston went through the hole in the fence. He saw a cloud of white vapor streaming from the silo’s exhaust vents, like steam from a boiling kettle. He entered the complex, crossed the gravel near the hardstand, and approached one of the vents. Hanson had told him to get the vapor detector as close as possible to the cloud, without getting engulfed in it if the wind shifted. Livingston stuck the probe into the mist, and the needle on the gauge shot all the way to the right.

The portable vapor detector has pegged out, Livingston said.

Hanson told Morris, who informed the command post. The news was shared with everyone on the net.

Colonel Scallorn thought the mission was over — the detector had pegged out.

Sergeant Hanson told Livingston to put his hand over the vent and try to get a sense of the vapor temperature. Hanson had meant to bring a thermometer from the base but had forgotten it.

Scallorn kept expecting someone on the net to call it off and bring this boy back to the truck. He didn’t understand why they were sending anyone into the complex at two in the morning. They’d already waited more than seven hours to do something. It seemed too late now.

Livingston put his hand over the metal grate. He could feel the heat through his glove.

Colonel Morris told the command post that he was bringing Livingston back.

Livingston returned from the complex, took off his helmet, and leaned against the bed of the pickup.

“It’s hot as hell over there,” he said.

At the command post, members of the K crew assumed that the mission was over. The fuel vapor hadn’t dissipated — like Martin Marietta had suggested it would — and the portable vapor detector couldn’t reveal how high the level really was. It was at least 250 ppm, the cutoff mark that everyone had agreed upon. SAC headquarters ordered Devlin and Hukle to enter the launch complex.

The men put on their helmets and air packs and grabbed their equipment. They had a lot more gear than Livingston. Between the two of them, Devlin and Hukle carried a portable vapor detector, flashlights, the hydraulic hand pump, and a tool bag holding screwdrivers, Crescent wrenches, and pliers. They also brought a couple of crowbars.

The outer steel door and the door at the bottom of the entrapment area were locked — and could no longer be jimmied open with a credit card. Devlin and Hukle would have to break into the launch complex with crowbars. Nobody knew how difficult that would be since nobody there had ever done it.

The two young airmen in RFHCO suits, holding their flashlights and crowbars and tools, went through the hole in the fence.