Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety

Decapitation

On January 23, 1961, a B-52 bomber took off from Seymour Johnson Air Force Base in Goldsboro, North Carolina, for an airborne alert. The flight plan was a long, circular route along the East Coast. At the end of the first loop, the B-52 met its tanker a couple of minutes early and refueled. At the end of the second loop, after more than ten hours in the air, the bomber refueled again. It was almost midnight. Amid the darkness, the boom operator of the tanker noticed fuel leaking from the B-52’s right wing. Spray from the leak soon formed a wide plume, and within two minutes about forty thousand gallons of jet fuel had poured from the wing. The command post at Seymour Johnson told the pilot, Major Walter S. Tulloch, to dump the rest of the fuel in the ocean and prepare for an emergency landing. But fuel wouldn’t drain from the tank inside the left wing, creating a weight imbalance. At half past midnight, with the flaps down and the landing gear extended, the B-52 went into an uncontrolled spin.

Major Tulloch heard a loud explosion and ordered his crew to bail out, as the plane started to break apart at an altitude of ten thousand feet. Four of the men ejected safely, including Tulloch. First Lieutenant Adam C. Mattocks managed to jump through the escape hatch, while the bomber was upside down, and survived. Major Eugene Shelton ejected but suffered a fatal head injury. The radar navigator, Major Eugene H. Richards, and Technical Sergeant Francis R. Barnish died in the crash.

The B-52 was carrying two Mark 39 hydrogen bombs, each with a yield of 4 megatons. As the aircraft spun downward, centrifugal forces pulled a lanyard in the cockpit. The lanyard was attached to the bomb release mechanism. When the lanyard was pulled, the locking pins were removed from one of the bombs. The Mark 39 fell from the plane. The arming wires were yanked out, and the bomb responded as though it had been deliberately released by the crew above a target. The pulse generator activated the low-voltage thermal batteries. The drogue parachute opened, and then the main chute. The barometric switches closed. The timer ran out, activating the high-voltage thermal batteries. The bomb hit the ground, and the piezoelectric crystals inside the nose crushed. They sent a firing signal. But the weapon didn’t detonate.

Every safety mechanism had failed, except one: the ready/safe switch in the cockpit. The switch was in the SAFE position when the bomb dropped. Had the switch been set to GROUND or AIR, the X-unit would’ve charged, the detonators would’ve triggered, and a thermonuclear weapon would have exploded in a field near Faro, North Carolina. When Air Force personnel found the Mark 39 later that morning, the bomb was harmlessly stuck in the ground, nose first, its parachute draped in the branches of a tree.

The other Mark 39 plummeted straight down and landed in a meadow just off Big Daddy’s Road, near the Nahunta Swamp. Its parachutes had failed to open. The high explosives did not detonate, and the primary was largely undamaged. But the dense uranium secondary of the bomb penetrated more than seventy feet into the soggy ground. A recovery team never found it, despite weeks of digging.

The Air Force assured the public that the two weapons had been unarmed and that there was never any risk of a nuclear explosion. Those statements were misleading. The T-249 control box and ready/safe switch, installed in every one of SAC’s bombers, had already raised concerns at Sandia. The switch required a low-voltage signal of brief duration to operate — and that kind of signal could easily be provided by a stray wire or a short circuit, as a B-52 full of electronic equipment disintegrated midair.

A year after the North Carolina accident, a SAC ground crew removed four Mark 28 bombs from a B-47 bomber and noticed that all of the weapons were armed. But the seal on the ready/safe switch in the cockpit was intact, and the knob hadn’t been turned to GROUND or AIR. The bombs had not been armed by the crew. A seven-month investigation by Sandia found that a tiny metal nut had come off a screw inside the plane and lodged against an unused radar-heating circuit. The nut had created a new electrical pathway, allowing current to reach an arming line — and bypass the ready/safe switch. A similar glitch on the B-52 that crashed near Goldsboro would have caused a 4-megaton thermonuclear explosion. “It would have been bad news — in spades,” Parker F. Jones, a safety engineer at Sandia, wrote in a memo about the accident. “One simple, dynamo-technology, low-voltage switch stood between the United States and a major catastrophe!”

With strong northerly winds, the groundburst of that 4-megaton bomb in Goldsboro would have deposited lethal fallout over Washington, D.C., Baltimore, Philadelphia, and New York City. And the timing would have been unfortunate: the new president of the United States, John F. Kennedy, had delivered his inaugural address only three days earlier, promising renewal and change, vowing to “pay any price, bear any burden, meet any hardship, support any friend, oppose any foe, to assure the survival and the success of liberty.” The spirit of youthful optimism sweeping the United States would have been dimmed by the detonation of a hydrogen bomb in North Carolina and an evacuation of the nation’s capital.

The Goldsboro accident, far from being an isolated or improbable event, was a portent of the nuclear threats that the Kennedy administration would have to confront. Robert S. McNamara, the new secretary of defense, learned about the accident during his third day on the job. The story scared the hell out of him. McNamara knew remarkably little about nuclear weapons. The previous month, when Kennedy had asked him to head the Department of Defense, McNamara was the president of the Ford Motor Company. He was a young, supremely self-confident businessman devoted to systems analysis and efficiency. At the Harvard Business School, he’d taught accounting. Aside from a three-year stint in the Army Air Forces — where he’d served in the Office of Statistical Control and helped General LeMay calculate optimal fuel use for the bombing of Japan — McNamara had no military experience. And he’d spent little time thinking about military strategy or procurement. Determined to shake things up at the Pentagon, McNamara found himself, instead, feeling profoundly shaken during his first week on the job.

The B-52 crash in North Carolina wasn’t the only accident that involved fully assembled, sealed-pit weapons — and McNamara soon learned about others. A B-47 carrying a Mark 39 bomb had caught fire while taking off at Dyess Air Force Base, near Abilene, Texas. At an altitude of about two hundred feet, the pilot realized the plane was on fire, banked to avoid a populated area, and ordered the crew to bail out. Three of the four crew members got out in time. The plane entered a vertical dive, hit the ground, and vanished in a fireball. The high explosives of the hydrogen bomb detonated but didn’t produce a nuclear yield. A few weeks later a B-47 carrying a Mark 39 bomb caught fire on the runway at Chennault Air Force Base in Lake Charles, Louisiana. The crew escaped, and the weapon didn’t explode. It melted into radioactive slag.

In the skies above Hardinsburg, Kentucky, a B-52 carrying two hydrogen bombs collided with a tanker while attempting to refuel. The crew of the B-52 heard a “crunching sound,” all the lights went out, the cabin rapidly decompressed, and the plane began to disintegrate. Four of the crew ejected safely. The other four were killed, as were all four members of the tanker’s crew. The wreckage of the two planes covered an area of roughly twenty-seven square miles. The hydrogen bombs were torn open by the crash. The nuclear cores of their primaries were discovered, intact, resting on piles of broken high explosives.

At an air defense site in Jackson Township, New Jersey, a helium tank ruptured near a BOMARC missile, starting a fire. A pair of explosions soon followed inside the concrete shelter that housed the missile. Fifty-five other BOMARCs lay in similar shelters, beneath corrugated steel roofs, nearby. When emergency personnel arrived, the fire was out of control. They put fire hoses in the entrances to the burning shelter and fled the area. An Air Force security officer called the state police and mistakenly reported that a nuclear weapon had exploded at the site — spreading panic throughout central New Jersey and prompting civil defense authorities to go on full alert in New York City, seventy miles to the north. Fallout from the BOMARC’s 10-kiloton warhead, it was feared, could reach Trenton, the state capital, Princeton, Newark — and, possibly, Manhattan. Firefighters returned to the missile site about an hour and a half after the initial explosions and put out the fire. The warhead had fallen out of the nose cone. The high explosives had burned, instead of detonating, and the nuclear core had melted onto the floor. The shelter contained most of the radioactivity. But water from the fire hoses had swept plutonium residue under the doors, down the street, and into a drainage ditch.

The accidents in North Carolina and Texas worried Robert McNamara the most. In one crash, the failure of a single mechanical switch could have led to a full-scale, thermonuclear explosion; in the other, the detonation of the Mark 39’s high explosives was the sort of one-point safety test that you never want to conduct in the real world. The Mark 39 had passed the test — this time. It wasn’t something that McNamara wanted to see repeated. The lapses in weapon safety seemed to be part of a much larger problem: a sense of disarray and mismanagement at the Pentagon, extending from the budget process to the planning for nuclear war. In his view, the Department of Defense had been saddled with the previous administration’s intellectual “bankruptcy in both strategic policy and in the force structure.” McNamara was determined to bring order, rational management, and common sense to the workings of the Pentagon, as quickly as possible.

DURING THE 1960 CAMPAIGN, John F. Kennedy had repeatedly attacked President Eisenhower for allowing the Soviet Union to surpass the United States in military power. “The Communists will have a dangerous lead in intercontinental missiles through 1963,” the platform of the Democratic Party declared, and “the Republican administration has no plans to catch up.” Kennedy argued that Eisenhower’s strategy of massive retaliation had left the United States in a helpless position, unable to prevent the Soviets from subverting and overthrowing governments friendly to the West. An overreliance on nuclear weapons had made American promises to defend the free world seem hollow. “We have been driving ourselves into a corner where the only choice is all or nothing at all, world devastation or submission,” Kennedy warned.

General Maxwell Taylor’s book, The Uncertain Trumpet, and its call for a nuclear strategy of flexible response had greatly impressed Kennedy. He agreed with Taylor’s central thesis: in a crisis, the president should have a wide range of military options. Kennedy wanted the ability to fight limited wars, conventional wars — and a nuclear war with the Soviets that could be stopped short of mutual annihilation. “Controlled response” and “controlled escalation” and “pauses for negotiation” became buzzwords in the Kennedy administration. If the American military had the means to prevail in a variety of different ways, with or without nuclear weapons, the United States could resist Soviet influence throughout the world. “The record of the Romans made clear,” Kennedy later told his national security staff, “that their success was dependent on their will and ability to fight successfully at the edges of their empire.”

Despite the harsh, personal attacks during the presidential campaign, Eisenhower helped the new administration with its reappraisal of nuclear strategy. His science adviser’s memo on the shortcomings of the Single Integrated Operational Plan was forwarded to McNamara and Kennedy. The memo supported many of the arguments against the SIOP made by General Taylor and leading officers in the Navy. The chief of naval operations, Admiral Arleigh Burke, warned that such a large, undiscriminating attack on the Soviet Union would deposit lethal fallout not only on American allies like South Korea and Japan but also on the U.S. Navy’s Pacific fleet. A reappraisal of the nation’s entire military stance now seemed urgent, and President Kennedy asked McNamara to lead it — to raise fundamental questions about how weapons were procured, what purpose they served, and whether they were even necessary.

Although a year older than the president, McNamara, at forty-four, was the youngest person, thus far, to head the Department of Defense. And he recruited a group of cocky and iconoclastic young men to join the administration, academics from Harvard and MIT, RAND analysts, economists, Rhodes scholars. Henry Rowen, a graduate of Harvard and Oxford who soon played a large role in nuclear planning, was thirty-six. Harold Brown, chosen to guide Pentagon research on new weapon systems and technology, was thirty-three. Alain Enthoven, an economist who rigorously applied cost-benefit analysis to the defense budget, was thirty. Later depicted as “whiz kids,” “defense intellectuals,” “the best and the brightest,” McNamara’s team was determined to transform America’s nuclear strategy and defense spending.

Three days after the Goldsboro accident, McNamara met with members of the Pentagon’s Weapons Systems Evaluation Group (WSEG). It had recently completed a study, WSEG Report No. 50, that described the Soviet forces the United States would most likely face by the mid-1960s and compared the merits of different tactics to oppose them. Eisenhower’s secretary of defense, Thomas B. Gates, had seen the report a few months earlier and thought McNamara should know about it. McNamara’s briefing on WSEG Report No. 50, scheduled to last a few hours, wound up occupying a full day. The authors of the report had measured the economic efficiency of various American weapon systems — explaining, for example, that the annual operating costs of keeping a B-52 bomber on ground alert was about nine times larger than the annual maintenance costs of a Minuteman missile. That was just the sort of data that Robert McNamara craved. But the authors of WSEG R-50 had also reached a conclusion that nobody in the Kennedy administration wanted to hear: America’s command-and-control system was so complex, outdated, and unreliable that a “controlled” or “flexible” response to a Soviet attack would be impossible. In fact, the president of the United States might not be able to make any response; he would probably be killed during the first moments of a nuclear war.

By launching a surprise attack on five targets — the White House, the Pentagon, Camp David, Site R, and High Point — the Soviet Union had a good chance of wiping out the civilian leadership of the United States. None of the bunkers at those locations would survive the blast from a multimegaton weapon. And two of the emergency command posts, Site R and High Point, weren’t regularly staffed with high-ranking officers. By hitting nine additional targets, the Soviet Union could eliminate America’s military leadership. The destruction of America’s command-and-control system could be achieved, with a 90 percent chance of success, through the use of only thirty-five Soviet missiles. Four would be aimed at the White House and five at Camp David, to ensure that the president was killed. “Under surprise attack conditions, there can be little confidence,” the report concluded, “that the Presidential decision would be made and military execution orders be received by the combat elements of the strategic nuclear forces before the high command is disrupted.”

Moreover, the command bunkers built during the Eisenhower years lacked the communications equipment that would allow the controlled escalation of a nuclear war or pauses for negotiation with the Soviets — even if the president survived the initial attack. The high-frequency radio system used to communicate with SAC’s bombers and the very-low-frequency system used to contact the Navy’s Polaris submarines relied on a handful of terminals that could easily be destroyed. According to one classified account, the Eisenhower administration had installed “a one-shot command, control, and communication system.” It hadn’t been designed to fight a limited or prolonged nuclear war. The SIOP required only that a Go code be transmitted, and after that, nothing needed to be said — because nothing could be done to change or halt the execution of the war plan. The underground command posts were little more than hideouts, where military and civilian leaders could ride out a nuclear attack and then emerge, perhaps, to rebuild the United States.

America’s early-warning systems were also woefully inadequate. The DEW Line of radar stations stretching across the Arctic, the SAGE direction centers, the mighty IBM computers — built with great urgency, at enormous expense — had been designed to track Soviet bombers. They could not detect Soviet missiles. The Ballistic Missile Early Warning System, created for that task, was just becoming operational. At best, the BMEWS could spot missiles launched from the Soviet Union roughly fifteen minutes before they hit the United States. But if the missiles were launched from Soviet submarines off the coast, the warning time would be zero. The BMEWS couldn’t detect missiles approaching at such a low altitude. And the reliability of the system, McNamara learned, still left much to be desired.

DURING A TOUR OF NORAD headquarters in Colorado Springs, Colorado, a few months earlier, Peter G. Peterson, the executive vice president of the Bell & Howell Company, had been allowed to sit in the commander’s chair. Peterson was visiting the facility with Bell & Howell’s president, Charles H. Percy, and Thomas J. Watson, Jr., the president of IBM. The first BMEWS radar complex, located at Thule Air Base, Greenland, had come online that week, and the numerical threat levels of the new warning system were being explained to the businessmen.

If the number 1 flashed in red above the world map, unidentified objects were traveling toward the United States. If the number 3 flashed, the threat level was high; SAC headquarters and the Joint Chiefs of Staff had to be notified immediately. The maximum threat level was 5 — a computer-generated warning, with a 99.9 percent certainty, that the United States was under attack. As Peterson sat in the commander’s chair, the number above the map began to climb. When it reached 4, NORAD officers ran into the room. When it reached 5, Peterson and the other executives were quickly escorted out and put in a small office. The door was closed, and they were left there believing that a nuclear war had just begun.

The vice commander of NORAD, Air Marshal C. Roy Slemon, a dapper Canadian with a small mustache, managed to track down the head of NORAD, General Laurence S. Kuter, who was in an Air Force plane above South Dakota.

“Chief, this is a hot one,” Slemon said.

The BMEWS indicated that the Soviets had launched an all-out missile attack against North America. The Joint Chiefs of Staff were on the phone, awaiting confirmation. The United States had only minutes to respond.

“Where is Khrushchev?” Slemon asked his officers.

Khrushchev’s in New York today, at the United Nations, NORAD’s chief of intelligence said.

Slemon immediately felt relieved. The Soviet Union was unlikely to launch an attack that would kill the first secretary of its Communist Party. Twenty minutes passed, and no Soviet missiles landed. The three businessmen were let out of the small office, glad to be alive. When news of the false alarm leaked to the press, the Air Force denied that the missile warning had ever been taken seriously. Percy, who later became a Republican senator from Illinois, disputed that account. He recalled a sense of panic at NORAD. A subsequent investigation found the cause of the computer glitch. The BMEWS site at Thule had mistakenly identified the moon, slowly rising over Norway, as dozens of long-range missiles launched from Siberia.

Both of America’s early-warning systems were deeply flawed — and, as a result, the most reliable indicator of a Soviet attack might be the destruction of those systems by nuclear blasts. Bomb Alarm System sensors would be placed at the SAGE direction centers and at Thule. By the time those bomb sensors went off, however, the president might already be dead. Of the fourteen potential successors, as specified by Congress, only the vice president and the secretary of defense would have any familiarity with the SIOP. If all fourteen were in Washington, D.C., during a surprise attack, they would probably be killed or incapacitated.

Amid the confusion, it might be impossible to determine who was America’s commander in chief. Everyone on the presidential succession list had been given a phone number to call, in case of a national emergency. The call would put them in touch with the Joint War Room at the Pentagon. But telephone service was bound to be disrupted by a nuclear attack, the Pentagon might no longer exist — and even if it did, the first person to call the war room might be named president of the United States, regardless of whether he or she was next on the list. WSEG Report No. 50 outlined the problem:

The idea of a “decapitation” attack, aimed at America’s military and civilian leadership, didn’t seem entirely far-fetched. Indeed, it was the most plausible scenario for a Soviet attack on the United States. And it had the best chance of success. “No other target system can at present offer equal potential returns from so few weapons,” the report said.

McNamara subsequently discovered that the command-and-control problems were hardly limited to the United States. “We have been concerned with the vulnerability of our defense machine in the U.S.,” a Pentagon task force informed him, “but it is nothing compared with the situation in Europe.” All of NATO’s command bunkers, including the operations center inside the Kindsbach Cave, could easily be destroyed, even by an attack with conventional weapons. Although NATO maintained fighter planes on a ground alert, ready to take off within fifteen minutes, it lacked an early-warning system that could detect Soviet missiles. It also lacked a bomb alarm system. At best, NATO commanders might receive five or ten minutes of warning that a Soviet attack had begun — not enough time to get those planes off the ground. And that warning would most likely never be received, because the NATO communications system was completely unprotected. Its destruction would prevent NATO from transmitting messages not only within Europe but also between Europe and the United States. Once the fighting began, the president could not expect to reach any of NATO’s high-ranking officers or to give them any orders. And they wouldn’t be able to communicate with one another.

The Pentagon task force found that NATO had done little to prepare for the devolution of command in wartime:

The absence of early-warning capabilities, the poor communications, and the lack of any succession plan at NATO posed a grave, immediate risk. “Not only could we initiate a war, through mistakes in Europe,” McNamara was told, “but we could conceivably precipitate Soviet preemptive action because of a loose C & C [command and control] in Europe.” The situation was made even more dangerous by the predelegation authority that Eisenhower had secretly granted to the military. NATO units under attack were permitted to use their nuclear weapons, without awaiting presidential approval. The new national security adviser, McGeorge Bundy, succinctly explained the rules to President Kennedy: “A subordinate commander faced with a substantial Russian military action could start the thermonuclear holocaust on his own initiative if he could not reach you (by failure of the communication at either end of the line).”

Any use of nuclear weapons in Europe, McNamara now believed, would quickly escalate to an all-out war. And the more he learned about America’s nuclear deployments in Europe, the more he worried about such a catastrophe. Three weeks after the Goldsboro accident, Congress’s Joint Committee on Atomic Energy sent Kennedy and McNamara a top secret report, based on a recent tour of NATO bases. It warned that the risk of an accidental or unauthorized nuclear detonation in Europe was unacceptably high — not just in wartime, but also during routine NATO maneuvers. NATO’s command-and-control problems were so bad, the bipartisan committee found, that in many respects the United States no longer had custody of its own nuclear weapons. Within months the NATO stockpile would include atomic bombs, hydrogen bombs, thermonuclear warheads, nuclear artillery shells, nuclear depth charges, nuclear land mines, and the Davy Crockett, a recoilless rifle, carried like a bazooka by an infantryman, that fired small nuclear projectiles. But none of these weapons, except the land mines — formally known as Atomic Demolition Munitions — had any sort of lock to prevent somebody from setting them off without permission. And the three-digit mechanical locks on the land mines, like those often found on gym lockers, were easy to pick. According to one adviser, when Secretary of Defense McNamara heard that hundreds of American nuclear weapons stored in Europe were poorly guarded, vulnerable to theft, and unlocked, “he almost fell out of his chair.”

THE JOINT COMMITTEE on Atomic Energy had been concerned for almost a year that NATO’s custody arrangements were inadequate — and in violation of American law. The Atomic Energy Act of 1946 strictly prohibited the transfer of nuclear weapons, as well as classified information about them, to foreign countries. The act was amended in 1954 so that NATO forces could be trained to use tactical weapons. After the launch of Sputnik, President Eisenhower asked Congress to change the law again and allow the creation of a NATO atomic stockpile. “I have always been of the belief that we should not deny to our allies,” Eisenhower said, “what your potential enemy already has.” His proposal was opposed by many in Congress, who feared that it might be difficult to retain American control of nuclear weapons based in Europe. The Soviet Union strongly opposed the idea, too. Hatreds inspired by the Second World War still lingered — and the Soviets were especially upset by the prospect of German troops armed with nuclear weapons. In order to gain congressional approval, the Eisenhower administration promised that the weapons would remain, at all times, under the supervision of American military personnel. The nuclear cores would be held by the United States until the outbreak of war, and then the cores would be handed over to NATO forces. Secretary of State Christian A. Herter assured the Soviet Union that “an essential element” of the NATO stockpile would be that “custody of atomic warheads remains exclusively with the United States.”

On January 1, 1960, General Lauris Norstad, the supreme allied commander in Europe, placed all of NATO’s nuclear-capable units on a fifteen-minute alert, without consulting Congress. Every NATO air squadron was ordered to keep at least two fighter planes loaded with fuel and a nuclear weapon, parked near a runway. And thermonuclear warheads were mated to the intermediate-range Jupiter missiles in Italy and the Thor missiles in Great Britain. The new alert policy had the full support of President Eisenhower, who thought that NATO should be able to respond promptly to a Soviet attack. Eisenhower had faith in the discipline of NATO forces. And he had, most likely, a private understanding with Norstad similar to the one made with LeMay — granting the permission to use nuclear weapons, if Washington, D.C., had been destroyed or couldn’t be reached during a wartime emergency. The supreme commander of NATO reported directly to the president, not to the Joint Chiefs of Staff, and Norstad was fiercely protective of his authority. He disliked General Thomas Power, the head of the Strategic Air Command, and wanted to preserve NATO’s ability to destroy the Soviet Union without any help from SAC. The thermonuclear warheads atop NATO’s Jupiter missiles were aimed at Soviet cities. With those missiles, and the hundreds of other nuclear weapons under NATO command, Norstad could conceivably fight his own war against the Soviets, on his own terms.

Members of the Joint Committee on Atomic Energy visited fifteen NATO bases in December 1960, eager to see how America’s nuclear weapons were being deployed. The group was accompanied by Harold Agnew, the Los Alamos physicist who’d come up with the idea of attaching parachutes to hydrogen bombs and later helped to develop one-point safety standards. Agnew was an expert on how to design bombs — and how to handle them properly. At a NATO base in Germany, Agnew looked out at the runway and, in his own words, “nearly wet my pants.” The F-84F fighter planes on alert, each carrying a fully assembled Mark 7 bomb, were being guarded by a single American soldier. Agnew walked over and asked the young enlisted man, who carried an old-fashioned, bolt-action rifle, what he’d do if somebody jumped into one of the planes and tried to take off. Would he shoot at the pilot — or the bomb? The soldier had never been told what to do. The wings of the fighters were decorated with the Iron Cross, a symbol that powerfully evoked two world wars. Agnew realized there was little to prevent a German pilot from taking a plane, flying it to the Soviet Union, and dropping an atomic bomb.

The custody arrangements at the Jupiter missile sites in Italy were even more alarming. Each site had three missiles topped with a 1.4-megaton warhead — a weapon capable of igniting firestorms and flattening every brick structure within thirty square miles. All the security was provided by Italian troops. The launch authentication officer was the only American at the site. Two keys were required to launch the missiles; one was held by the American, the other by an Italian officer. The keys were often worn on a string around the neck, like a dog tag.

Congressman Chet Holifield, the chairman of the joint committee, was amazed to find three ballistic missiles, carrying thermonuclear weapons, in the custody of a single American officer with a handgun. “All [the Italians] have to do is hit him on the head with a blackjack, and they have got his key,” Holifield said, during a closed-door committee hearing after the trip. The Jupiters were located near a forest, without any protective covering, and brightly illuminated at night. They would be sitting ducks for a sniper. “There were three Jupiters setting there in the open — all pointed toward the sky,” Holifield told the committee. “Over $300 million has been spent to set up that little show and it can be knocked out with 3 rifle bullets.”

Foreign personnel weren’t supposed to enter the nuclear weapon igloos at NATO bases. But little had been done to stop them. A lone American soldier manned the entrance to the igloos, serving as a custodian of the weapons, not as an armed guard. Once again, security was provided by troops from the host nation, who also moved weapons in and out of the storage facilities. Senator Albert A. Gore, Sr., could hardly believe the arrangement: “Non-Americans with non-American vehicles are transporting nuclear weapons from place to place in foreign countries.” It was one thing to entrust these weapons to the Strategic Air Command, with its strict operating procedures and rigorous devotion to checklists. But the competence of NATO troops varied considerably. And their level of professionalism wasn’t the most important consideration, when it came to guarding America’s nuclear weapons. “The prime loyalty of the guards, of course, is to their own nation, and not to the U.S.,” the joint committee said.

A nuclear weapon might be stolen by a deranged or psychotic NATO soldier; by a group of officers seeking political power; or by the government of a host nation, for use against an enemy other than the Soviet Union. These scenarios were, unfortunately, plausible. A pair of NATO countries, Greece and Turkey, despised each other and would soon go to war over the island of Cyprus. Right-wing officers had staged two coups d’état in Turkey during the previous year, and Jupiter missiles were scheduled for deployment there in the fall of 1961. Covertly funded by the Soviet Union, the Italian Communist Party had strong support in the region where Jupiter missiles were based. Members of the party might seek to sabotage or steal a nuclear weapon. Concerns about theft weren’t absurd or far-fetched. A few months after the joint committee’s visit to NATO bases, a group of dissident French officers sought to gain control of a nuclear device in Algeria, as part of a coup. At the time, Algeria was the site of French nuclear tests — and a French colony fighting for independence. A nuclear test code-named “Gerboise verte” was promptly conducted in the Sahara desert so that the officers attempting to overthrow President Charles de Gaulle couldn’t get hold of a nuclear device. “Refrain from detonating your little bomb,” General Maurice Challe, one of the coup leaders, had urged the head of the special weapons command. “Keep it for us, it will always be useful.”

In addition to being loosely controlled by the United States, the nuclear weapons in the NATO stockpile were often old and poorly maintained. According to the joint committee’s report, NATO had been turned into “the dumping ground for obsolete warheads and weapon systems” that were, nevertheless, placed “in an ‘alert’ position of 15 minutes readiness without adequate safety precautions.” Congressman Holifield estimated that about half of the Jupiters wouldn’t take off, if the order to launch was ever given. The missiles were complicated, liquid fueled, and leaky. The chairman of the Joint Chiefs of Staff admitted that, from a military standpoint, the Jupiters were useful mainly for increasing the number of targets that the Soviet Union would have to hit during a first strike. “It would have been better to dump them in the ocean,” Eisenhower later said of the missiles, “instead of trying to dump them on our allies.”

The Mark 7 atomic bombs carried by NATO fighters had been rushed into production during the Korean War, almost a decade earlier. The nickel cadmium batteries of a Mark 7 constantly had to be recharged, and its nuclear core had to be carefully placed into an in-flight insertion mechanism before takeoff. The bombs were not designed for use during an alert. Once the core was inserted, a Mark 7 wasn’t one-point safe. And the bomb had to undergo at least twenty different diagnostic tests, increasing the odds of a mistake during assembly and disassembly. It was plagued by mechanical problems and seemed to invite human error.

Harold Agnew was amazed to see a group of NATO weapon handlers pull the arming wires out of a Mark 7 while unloading it from a plane. When the wires were pulled, the arming sequence began — and if the X-unit charged, a Mark 7 could be detonated by its radar, by its barometric switches, by its timer, or by falling just a few feet from a plane and landing on a runway. A stray cosmic ray could, theoretically, detonate it. The weapon seemed to invite mistakes. A rocket-propelled version of the Mark 7 was unloaded, fully armed, with its X-unit charged, from a U.S. Navy plane in the spring of 1960. The ground crew had inadvertently yanked out the arming wires. An incident report noted defects in another Mark 7:

And a Mark 7 sometimes contained things it shouldn’t. A screwdriver was found inside one of the bombs; an Allen wrench was somehow left inside another. In both bombs, the loose tools could have caused a short circuit.

The risk of a nuclear accident at a European base was increased by the fact that the training and operating manuals for the Mark 7 — indeed, for all the weapons in the NATO atomic stockpile — were written in English. But many of the NATO personnel who handled the weapons could not read or speak English. And few of them knew what to do if something went wrong. “In many areas we visited,” the joint committee found, “little or no Explosive Ordnance Disposal (EOD) capability was available in the event of accidental radioactive contamination resulting from fire, carelessness, or accident, or in the event of threat to custody and security of the weapon requiring emergency disposal.” Western Europe was more densely populated than the United States, and a cloud of plutonium, released by a nuclear weapon, could threaten a large number of people. The possibility of such an accident was “far from remote,” according to the joint committee. It cited a mishap on January 16, 1961, just a few days before Kennedy’s inauguration. The underwing fuel tanks of a U.S. Air Force F-100D fighter were mistakenly jettisoned when the pilot started the engines. The plane was on alert at the Lakenheath air base in Suffolk, England. The fuel tanks hit the runway and ruptured, some fuel ignited, and a Mark 28 hydrogen bomb mounted beneath the plane was engulfed in flames. Firefighters managed to extinguish the blaze before the weapon’s high explosives could detonate or ignite. Because the accident occurred at a military base, away from the scrutiny of the press and the public, neither the American government nor the British would acknowledge that it happened.

THE JOINT COMMITTEE on Atomic Energy unanimously agreed that the Jupiter missiles should be removed from Italy — and should never be deployed in Turkey. The missiles seemed to pose more of a threat to NATO, one way or another, than to the Soviets. And placing missiles with thermonuclear warheads in Turkey, a politically unstable country that bordered the Soviet Union, might be viewed as a provocation at the Kremlin. The joint committee also recommended that the Mark 7 bomb either be removed from the NATO stockpile or fitted with a trajectory-sensing switch, so that a mistake by a ground crew would be less likely to cause an accidental detonation. Moreover, the current “fictional” custody arrangements had to be replaced with measures that gave the United States “real” possession and control of its nuclear weapons in Europe. A lone American sentry, ordered to stand on a runway for eight hours at a time, was bound to start “goofing off.” The committee wanted at least two American solders keeping an eye on the igloos, the missiles, the fighter planes on alert. It wanted American vehicles and troops, at every major NATO base, capable of evacuating or destroying nuclear weapons that an enemy or an ally might want to seize. And most of all, the committee wanted some kind of mechanical device added to NATO’s weapons so that unauthorized personnel couldn’t detonate them.

Harold Agnew had recently met with Donald R. Cotter, a supervisor at Sandia, about the best way to install use controls on a nuclear weapon. Cotter mentioned an electromechanical lock that Sandia was developing for atomic land mines. The weapons were, essentially, time bombs that NATO troops could arm and then leave behind to destroy buildings, bridges, airfields, or units of an invading Red Army. The new lock had originally been conceived as a safety device. Because these weapons wouldn’t be dropped from a plane or launched by a missile, a trajectory-sensing switch wouldn’t help to prevent accidental detonations. The g-forces that a land mine would normally experience before being armed would be the same as those of the soldier carrying it. And the weapon might sit for hours or days before exploding. But a motor-driven lock inside the mine, connected by a long cable to a handheld decoder, would allow troops to arm the weapon from a safe distance. Agnew thought that sort of lock would solve many of the custody problems at NATO. A coded switch, installed in every nuclear weapon, would block the crucial arming circuits. It would make a clear distinction between the physical possession of a weapon and the ability to use one. It would become a form of remote control. And the power to exert that control, to prohibit or allow a nuclear detonation, would remain with whoever had the code.

Agnew brought an early version of the electromechanical locking system to Washington, D.C., for a closed-door hearing of the joint committee, putting the switch and the decoder in the seat next to him on a commercial flight from Albuquerque. The coded switch that went inside a weapon weighed about a pound; the decoder weighed about forty. It was a black box with knobs, numbers, and a series of colored lights on it, powered by a large internal battery. To unlock a nuclear weapon, a two-man custodial team would attach a cable to it from the decoder. Then they’d turn the knobs on the decoder to enter a four-digit code. It was a “split-knowledge” code — each custodian would be given only two of the four numbers. Once the correct code was entered, the switch inside the weapon would take anywhere from thirty seconds to two and a half minutes to unlock, as its little gears, cams, and cam followers whirred and spun. When Agnew and Cotter showed the committee how the new lock worked, it didn’t. Something was wrong. But none of the senators, congressmen, or committee staff members realized that it wouldn’t unlock, no matter how many times the proper code was entered. The decoder looked impressive, the colored lights flashed, and everyone in the hearing room agreed that it was absolutely essential for national security.

The American military, however, vehemently opposed putting any locks on nuclear weapons. The Army, the Navy, the Air Force, the Marines, the Joint Chiefs of Staff, General Power at SAC, General Norstad at NATO — all of them agreed that locks were a bad idea. The always/never dilemma lay at the heart of military’s thinking. “No single device can be expected to increase both safety and readiness,” the Joint Chiefs of Staff argued. And readiness was considered more important: the nuclear weapons in Europe were “adequately safe, within the limits of the operational requirements imposed on them.”

Although the description “adequately safe” was hardly reassuring, the possibility of America’s nuclear weapons being rendered useless during wartime, when their locks somehow malfunctioned, was more worrisome to the Joint Chiefs. Even if the locking and unlocking mechanisms worked flawlessly, use of the weapons would depend on effective code management. If only a few people were allowed to know the code, then the death of those few or an inability to reach them in an emergency could prevent the weapons from being unlocked. But if the code was too widely shared, the locks would offer little protection against unauthorized use. The joint committee’s desire for stronger use controls threatened to add complexity and uncertainty to the command and control of nuclear weapons. A State Department official summarized the military’s position: “all is well with the atomic stockpile program and there is no need for any changes.”

The Kennedy administration was far more receptive to the committee’s proposals. The former RAND analysts at the Pentagon were familiar with Fred Iklé’s work and his recommendation, two years earlier, that locks should be put on nuclear weapons. Jerome Wiesner, the president’s science adviser, met with Agnew and agreed that something had to be done about NATO’s atomic stockpile. Wiesner was deeply concerned about the risk of an unauthorized or accidental detonation. He had trained as an electrical engineer, briefly worked at Los Alamos, and advised Eisenhower on nuclear issues. Wiesner supported placing locks on the weapons but had no illusions that locks would completely solve the problem. A skilled technician could open a stolen nuclear weapon and unlock it within a few hours. But Wiesner thought that the locks might help “to buy time” after a weapon had been taken, stop “individual psychotics,” and prevent “unauthorized use by military forces holding the weapons during periods of high tension or military combat.”

For Secretary of Defense McNamara, the locks were part of a larger effort to regain not only American control but also civilian control of nuclear weapons. He felt adamant that the president of the United States should have the sole authority to order a weapon’s use. The military had gained far too much power over the nuclear arsenal since the days of Harry Truman, McNamara thought — and the lack of civilian oversight at NATO was chilling. The Davy Crockett recoilless rifle was especially problematic. Its atomic projectiles weighed about fifty pounds and would be easy to steal. They were small enough to fit in a duffle bag or a backpack. After reading the joint committee’s report, President Kennedy halted the dispersal of nuclear weapons among America’s NATO allies. Studies on weapon safety and command and control were commissioned. At Sandia, the development of coded, electromechanical locks was begun on a crash basis. Known at first as “Prescribed Action Links,” the locks were given a new name, one that sounded less restrictive, in the hopes of appeasing the military. “Permissive Action Links” sounded more friendly, as did the acronym: PALs.

WITHIN SEVEN WEEKS of President Kennedy’s inauguration, the broad outlines of his defense policies were set. Spending on conventional forces would increase. More Polaris submarines would be built. And intercontinental ballistic missiles would largely replace bombers. Missiles were thought to be faster, cheaper, and less likely to be destroyed in a surprise attack. The Atlases, Titans, Jupiters, and Thors, so recently rushed into service, would be decommissioned as soon as possible. Less expensive, solid-fueled missiles would replace them. McNamara and his team had come to believe that nuclear weapons with a lower yield were more cost effective. The Minuteman missile carried a 1-megaton warhead, and calculations suggested that five of them would inflict more damage than a single 9-megaton warhead carried by a Titan II. Nevertheless, a relatively small number of Titan II missiles would be retained, for the time being. They would be useful for destroying naval bases, missile complexes, and underground command centers.

The Polaris submarine seemed like the ideal weapon system for the Kennedy administration’s strategic goals. The sixteen missiles on each sub would serve as a powerful deterrent to the Soviets, greatly increasing the odds that the United States could offer some sort of nuclear response after a surprise attack. Safely hidden beneath the ocean, the submarines could also give the president more time to think or negotiate during a crisis. In 1958 the Navy had requested a dozen Polaris subs; facing intense pressure from Congress, Eisenhower later agreed to deploy 19. Kennedy decided to build 41. The 656 missiles of the Polaris fleet would be aimed solely at “countervalue” targets — at civilians who lived in the major cities of the Soviet Union.

The Air Force didn’t like most of the Pentagon’s new spending priorities, which seemed to favor the Army and the Navy. The B-47 bomber — long the mainstay of the Strategic Air Command and the favorite ride of Colonel Jimmy Stewart — was to be taken out of service. No additional B-52 bombers would be built. The fate of a supersonic replacement for the B-52 was suddenly uncertain, and plans for a nuclear-powered bomber were scrapped. McNamara had concluded that bombers were not only too costly to operate but increasingly vulnerable to Soviet air defenses. The B-47 and the B-52 had been designed for high-altitude bombing; they would now have to attack at low altitudes to avoid Soviet radar. And the Soviets were beginning to put atomic warheads on their antiaircraft missiles, as well. During an attack on the Soviet Union, about half of SAC’s bomber crews, if not more, were expected to lose their lives.

General Curtis LeMay, the second in command at the Air Force, had little use for McNamara and his whiz kids. Few of them had served in the armed forces, let alone seen combat — yet they acted like military experts. They seemed arrogant and clueless. General Thomas D. White, the Air Force chief of staff, had similar misgivings, later criticizing the “pipe-smoking, tree-full-of-owls type of so-called professional ‘defense intellectuals’ who have been brought into this nation’s capital.” LeMay was convinced that long-range bombers were still the best weapons for strategic warfare. The Pentagon had never allowed SAC to test-launch a ballistic missile with a live nuclear warhead, despite many requests. Such a launch, with a flight path over the United States, was considered too risky. Dummy warheads were successfully tested instead, on missiles fired from Vandenberg — and the same fuzing and firing mechanisms would presumably detonate a real one. But LeMay didn’t want the survival of the United States to depend on a weapon that had never been fully tested. And the idea of a “limited war” still seemed ridiculous to him. The phrase was an oxymoron. If you won’t fight to win, LeMay argued, then you damn well shouldn’t fight. His protégé at SAC, General Power, felt the same way and continued to push for a counterforce strategy, aiming at military targets. For that task, Polaris missiles — relatively inaccurate and impossible to launch simultaneously, as one massive salvo — were useless.

To placate the Air Force and gain additional security against a surprise attack, McNamara raised the proportion of SAC bombers on ground alert from one third to one half. The number of bombers on airborne alert was increased, as well. Twelve B-52s were soon in the air at all times, loaded with thermonuclear weapons, as part of Operation Chrome Dome. Every day, six of the bombers would head north and circumnavigate the perimeter of Canada. Four would cross the Atlantic and circle the Mediterranean. And two would fly to the ballistic missile early-warning facility in Thule, Greenland, and orbit it for hours, maintaining visual or radio contact with the base — just to make sure that it was still there. Thule would probably be hit by Soviet missiles during the initial stage of a surprise attack. Known as the “Thule monitor,” the B-52 assured SAC, more reliably than any bomb alarm system, that the United States was not yet at war.

Feuds between the Army, the Navy, and the Air Force continued, despite McNamara’s vow that the Pentagon would have “one defense policy, not three conflicting defense policies.” Interservice rivalries once again complicated the effort to develop a rational nuclear strategy. The Joint Chiefs of Staff had been instructed to alter the SIOP, so that President Kennedy would have a number of options during a nuclear war. Studies were under way to make that possible. But the nuclear ambitions of the Army, the Navy, and the Air Force still seemed incompatible — and, at times, incomprehensible.

General Maxwell Taylor had contended in his bestselling book that the Army needed more money to fight conventional wars, an argument that helped to make him the principal military adviser to President Kennedy. Nevertheless, with Taylor’s support, the Army was now seeking thirty-two thousand nuclear weapons for use on the battlefield. Even the little Davy Crockett was portrayed as an indispensable weapon, despite the risk of theft. The handheld atomic rifles were as urgently needed, the Army claimed, as intercontinental ballistic missiles. McNamara still couldn’t understand the rationale for battlefield nuclear weapons and challenged the Army to answer a series of questions about them: Is the purpose of our tactical weapons to prevent the Soviets from using their tactical weapons? Can the Army defend Europe with them, without destroying Europe? And how will our own troops survive the fallout? The maximum range of the Davy Crockett was so short — about a mile and a half — that the soldiers who fired it stood a good chance of being killed by it.

In response to McNamara’s questions, the Army admitted that its request for thirty-two thousand nuclear weapons might “appear to be unreasonably high.” But General Taylor insisted that tactical weapons would serve as a valuable first step on the ladder of nuclear escalation. They would demonstrate American resolve — and the United States obviously needed to have them “if the enemy does.”

The latest intelligence reports on the Soviet Union added a new twist to the debate over America’s nuclear strategy. Within weeks of taking office, President Kennedy found out that the missile gap did not exist. Like the bomber gap, it was a myth. For years it had been sustained by faulty assumptions, Soviet deception, and a willingness at the Department of Defense to believe the worst-case scenario — especially when it justified more spending on defense. The CIA had estimated that the Soviet Union might have five hundred long-range ballistic missiles by the middle of 1961. Air Force Intelligence had warned that the Soviets might soon have twice that number. But aerial photographs of the Soviet Union, taken by U-2 spy planes and the new Discoverer spy satellite, now suggested that those estimates were wrong. The photos confirmed the existence of only four missiles that could reach the United States.

Instead of deploying long-range missiles to attack the United States, the Soviets had built hundreds of medium- and intermediate-range missiles to destroy the major cities of Western Europe. The strategy had been dictated, in large part, by necessity. Khrushchev’s boasts — that his factories were turning out 250 long-range missiles a year, that the Soviet Union had more missiles than it would ever need — were all a bluff. For years the Soviet missile program had been plagued with engineering and design problems. Medium-range missiles were less technologically demanding. It wasn’t easy to build a weapon that could fly six thousand miles and put a warhead near its target. And on October 24, 1960, the Soviet program had secretly endured a major setback.

Like the Atlas, the first Soviet long-range missiles used liquid oxygen as a propellant, and they required a lengthy fueling process before launch. A new Soviet missile, the R-16, used hypergolic propellants stored separately within its airframe, like the Titan II. The R-16 would be able to lift off within minutes. It was the largest missile that had ever been built, and Khrushchev was eager for its inaugural flight to take place before November 7, the anniversary of the Bolshevik Revolution. Marshal Mitrofan Ivanovich Nedelin, head of the Soviet Strategic Rocket Forces, traveled to Kazakhstan and supervised preparations for the launch of an R-16 at the Baikonur Cosmodrome.

As the giant missile sat on the launchpad, full of oxidizer and fuel, a series of malfunctions occurred. Angry about the delay, under tremendous pressure from the Kremlin, and eager to know what was wrong, Nedelin drove to the pad. Half an hour before the scheduled launch, a crew of technicians was working on the missile when its second-stage engine started without warning. Flames from the engine shot downward and ignited the fuel tank of the first stage. Marshal Nedelin was sitting in a chair about fifty feet from the missile when it exploded. He was killed, along with many of the Soviet Union’s top rocket scientists and about one hundred other people. The chief designer of the R-16, Mikhail Yangel, happened to be taking a cigarette break in an underground bunker and survived the explosion. Movie cameras set up to record the launch instead captured some horrific images — men running for their lives, as an immense fireball pursues and then engulfs them; men falling to the ground, their clothes on fire; everywhere, clouds of deadly smoke with a reddish glow. The following day, TASS, the official Soviet news agency, announced that Nedelin had been killed in a plane crash.

Far from being grounds for celebration, the absence of a missile gap became a potential source of embarrassment for the Kennedy administration. Many of the claims made by the Democrats during the recent presidential campaign now seemed baseless. Although General Power still insisted that the Soviets were hiding their long-range missiles beneath camouflage, the United States clearly had not fallen behind in the nuclear arms race. Public knowledge of that fact would be inconvenient — and so the public wasn’t told. When McNamara admitted that the missile gap was a myth, during an off-the-record briefing with reporters, President Kennedy was displeased.

At a press conference the following day, Kennedy stressed that “it would be premature to reach a judgment as to whether there is a gap or not a gap.” Soon the whole issue was forgotten. Political concerns, not strategic ones, determined how many long-range, land-based missiles the United States would build. Before Sputnik, President Eisenhower had thought that twenty to forty would be enough. Jerome Wiesner advised President Kennedy that roughly ten times that number would be sufficient for deterrence. But General Power wanted the Strategic Air Command to have ten thousand Minuteman missiles, aimed at every military target in the Soviet Union that might threaten the United States. And members of Congress, unaware that the missile gap was a myth, also sought a large, land-based force. After much back and forth, McNamara decided to build a thousand Minuteman missiles. One Pentagon adviser later explained that it was “a round number.”

WHILE DISAGREEMENTS OVER NUCLEAR STRATEGY continued at the White House and the Pentagon, the need for an improved command-and-control system was beyond dispute. For McNamara, it was the most urgent national security issue that the United States faced, “a matter of transcendent priority.” A few weeks after his briefing on WSEG R-50 and the threat of a surprise attack, McNamara outlined the problem to Kennedy:

The Soviet Union might not need a thousand missiles to prevail in a nuclear war; twenty or thirty might do. And the relative weakness of the Soviets, the small size of their missile arsenal, had oddly become a source of anxiety. It might encourage the Soviet Union to strike first. A decapitation attack, launched without warning, like a “bolt out of the blue,” might be the Kremlin’s only hope of achieving victory.

A centralized, effective command-and-control system would ensure that the United States could retaliate — and that the order to do so would be given by the president. The demands placed on such a system would be enormous, if the Soviets attacked. The system would have to “classify the attack, as large or small,” a Pentagon report later noted, “accidental or deliberate, selective or indiscriminate, against cities or not, against high command or not… in order to support a decision as to an ‘appropriate’ retaliatory response.” The system had to do those things in real time. And it had to maintain communications between the president, the Joint Chiefs of Staff, and military commanders throughout a nuclear war.

After commissioning a number of studies on command and control, McNamara approved the creation of a new entity: the World Wide Military Command and Control System (WWMCCS). It would combine the radars, sensors, computers, and communications networks of the different armed services into a single integrated system. The challenges were formidable. Making the system work would require not only technological and administrative changes but also new ways of thinking about command. The task was further complicated by the efforts of the Army, the Navy, and the Air Force to retain as much authority as possible over their own facilities and resist any centralized system run by civilians.

Although the bureaucratic struggle between the demands of centralization and decentralization proved difficult to resolve at the Pentagon, Paul Baran, a researcher at RAND, came up with an ingenious method of harmonizing the two within a digital communications network. Centralized and even decentralized networks — like those traditionally used to broadcast radio or television, to send messages by telegraph or telephone — could be shut down by the destruction of a few crucial nodes. Any hierarchical network would remain vulnerable at its apex, at the point where all the lines of communication converged. “The first duty of the command and control system is to survive,” Baran argued, proposing a distributed network with hundreds or thousands of separate nodes connected through multiple paths. Messages would be broken into smaller “blocks,” sent along the first available path, and reassembled at their final destination. If nodes were out of service or destroyed, the network would automatically adapt and send the data along a route that was still intact. Baran’s work later provided the conceptual basis for the top secret communications networks at the Pentagon, as well as their civilian offshoot, the Internet.

The survival of America’s military and civilian leadership would be harder to achieve. As a subset of the World Wide Military Command and Control System, a new administrative structure was established. The National Military Command Center replaced the Joint War Room at the Pentagon. It would serve as the nation’s military headquarters during a nuclear war. Since the Pentagon was likely to be destroyed at the beginning of that war, an Alternate National Military Command Center was formed at Site R, inside Raven Rock Mountain. It would have the data-processing and communications equipment necessary to manage the SIOP. It would be staffed year-round, twenty-four hours a day, awaiting the arrival of the president and the Joint Chiefs during an emergency. But fixed sites now seemed like easy targets for Soviet missiles. McNamara thought that the United States also needed mobile command centers that would be difficult to find and destroy. The Air Force wanted these command centers to be located on airplanes. SAC already had a plane, nicknamed “Looking Glass,” in the air at all times as a backup to its headquarters in Omaha. The Navy wanted the command centers to be located on ships. McNamara decided to do both, creating the National Emergency Airborne Command Post and the National Emergency Command Post Afloat.

None of these command posts would matter if there were no means of transmitting the Go code after a nuclear attack on the United States. The Navy began work on an airborne system for contacting its Polaris submarines. Take Charge and Move Out (TACAMO) planes would quickly get off the ground, climb steeply, and send an emergency war order on a very-low-frequency radio, using an antenna five miles long. SAC began to develop a Post Attack Command and Control System. It would rely on airborne command posts, a command post on a train, a command post at the bottom of an abandoned gold mine in Cripple Creek, Colorado, and a command post, known as The Notch, inside Bare Mountain, near Amherst, Massachusetts. The bunker in Cripple Creek was never constructed; airborne facilities were less expensive, and more likely to survive, than those underground. The Emergency Rocket Communications System provided another layer of redundancy. If SAC’s airborne command posts somehow failed to send the Go code, it could be sent by radio transmitters installed in a handful of Minuteman missiles. A prerecorded voice message, up to ninety seconds long, would be broadcast to bomber crews and launch crews, as the specially equipped missiles flew over SAC bases.

The most intractable problem was finding a way to keep the president alive. The National Emergency Airborne Command Post was placed on full-time alert at Andrews Air Force Base near Washington, D.C. But the plane would need at least ten or fifteen minutes to take off. And it would need another ten minutes to fly beyond the lethal range of a thermonuclear explosion. At least half an hour of warning might be necessary for the president to reach Andrews, get into the airborne command post, and escape the blast. Traveling by helicopter to the National Emergency Command Post Afloat, a Navy cruiser kept off the coast, would take even longer. And a Soviet missile attack might come with little or no warning.

After considering a variety of options, Secretary of Defense McNamara and Secretary of State Dean Rusk supported the construction of the National Deep Underground Command Center. McNamara described the bunker as a “logical, survivable node in the control structure… a unified strategic command and control center under duly constituted political authorities.” It would be located beneath the Pentagon, at a depth of 3,500 feet. High-speed elevators, a light-rail system, and horizontal tunnels more than half a mile underground would link it to the White House. It would hold anywhere from fifty to three hundred people, depending on whether Kennedy chose to build an “austere” version or one of “moderate size.” It was designed to “withstand multiple direct hits of 200 to 300 MT [megaton] weapons bursting at the surface or 100 MT weapons penetrating to depths of 70-100 feet.” If the Soviets attacked on that scale and the new bunker met those design goals, the president and his staff could expect to be the only people still alive in Washington, D.C.

Amid all the consideration of how to protect the president and the Joint Chiefs, how to gather information in real time, how to transmit war orders, how to devise the technical and administrative means for a flexible response, little thought had been given to an important question: how do you end a nuclear war? Thomas Schelling — a professor of economics at Harvard, a RAND analyst, proponent of game theory, and adviser to the Kennedy administration — began to worry about the issue early in 1961. While heading a committee on the risk of war by accident, miscalculation, or surprise, he was amazed to learn that there was no direct, secure form of communications between the White House and the Kremlin. It seemed almost unbelievable. Schelling had read the novel Red Alert a few years earlier, bought forty copies, and sent them to colleagues. The book gave a good sense of what could go wrong — and yet the president’s ability to call his Soviet counterpart on a “hot line” existed only in fiction. As things stood, AT&T’s telephone lines and Western Union’s telegraph lines were the only direct links between the United States and the Soviet Union. Both of them would be knocked out by a thermonuclear blast, and most radio communications would be, as well. The command-and-control systems of the two countries had no formal, reliable means of interacting. The problem was so serious and so obvious, Schelling thought, everybody must have assumed somebody else had taken care of it. Pauses for negotiation would be a waste of time, if there were no way to negotiate. And once a nuclear war began, no matter how pointless, devastating, and horrific, it might not end until both sides ran out of nuclear weapons.

The Brink

“Mankind must put an end to war — or war will put an end to mankind,” President John F. Kennedy told a gathering of world leaders at the United Nations, on September 25, 1961. Dag Hammarskjöld, the beloved secretary-general of the United Nations, had recently died in a plane crash, and to honor his memory Kennedy gave a speech that called for world peace and stressed the U.N.’s central role as a peacekeeper. He also revived the hope that nuclear weapons could be outlawed through an international agreement:

Instead of an arms race, Kennedy challenged the Soviets to join the United States in a “peace race,” a series of steps that would lead to “general and complete disarmament” under the supervision of the U.N. He proposed a ban on nuclear testing, an end to the production of fissile material for use in nuclear weapons, a prohibition on the transfer of nuclear weapons to other countries, and the destruction of all nuclear weapons, as well as their delivery systems. Kennedy had no illusions about the perfectibility of mankind, only a desire for its survival:

The abolition of nuclear weapons couldn’t be postponed any longer. “Together we shall save our planet,” he said, “or together we shall perish in its flames.”

During the same week that Kennedy appealed for an end to the arms race at the United Nations, he met with a handful of military advisers at the White House to discuss launching a surprise attack on the Soviet Union. General Thomas Power encouraged him to do it. According to notes of the meeting, held on September 20, Power warned that the United States now faced the greatest danger, ever, of a Soviet nuclear attack. “If a general atomic war is inevitable,” he argued, “the U.S. should strike first.” Power was not the only high-ranking officer having such thoughts. Kennedy had just received a memo from General Maxwell Taylor, summarizing how an American first strike might proceed. Taylor didn’t recommend it — or rule it out. “There are risks as well as opportunities in this approach,” he wrote.

The United States and the Soviet Union were, at the time, engaged in their most serious confrontation since the Berlin airlift of 1948. And once again, Berlin was at the center of the crisis. Sixteen years after the defeat of the Nazis, the city was still divided among four occupying powers: the British, French, and Americans in the West; the Soviets in the East. The division was economic, as well as political. While Communist East Berlin stagnated, capitalist West Berlin thrived. But it was a fragile prosperity. Located deep within East Germany, linked to West Germany only by air and a 110-mile stretch of highway, the free sectors of Berlin were surrounded by troops from the Soviet bloc. NATO forces in the city were vastly outnumbered. America’s nuclear weapons were all that protected West Berlin from being overrun.

Since 1958 the Soviet Union had been threatening to sign a treaty with East Germany, hand over the eastern part of the city to its Communist ally — and block NATO access to West Berlin. The threat was forcefully repeated at a summit meeting between President Kennedy and Nikita Khrushchev in June 1961. The Soviet Union seemed ascendant, having recently launched the first man into space. And Kennedy’s stature had been greatly diminished by the Bay of Pigs invasion, a failed attempt to overthrow the Communist government of Cuba. Khrushchev thought the new president was young and inexperienced, perhaps too timid to provide air support for the CIA-backed army pinned down on the beaches of Cuba. Kennedy had hoped that the summit would lead to warmer relations between the two superpowers. Instead, Khrushchev confronted him with an ultimatum: if the United States did not agree to the creation of a “free” and demilitarized Berlin, the Soviets would sign a treaty with East Germany by the end of the year and severely limit NATO’s rights in the city. When Kennedy made clear that would be unacceptable, the Soviet leader didn’t back down.

“It is up to the United States to decide whether there will be war or peace,” Khrushchev said.

“Then it will be a cold winter,” Kennedy replied.

DURING THE EISENHOWER ADMINISTRATION, the Joint Chiefs of Staff seemed to have few options if the Soviets tried to close the autobahn to Berlin. A convoy of American troops would most likely depart from West Germany on the road — and if they were attacked, the United States would be under great pressure to launch a massive nuclear strike on the Soviet Union. Secretary of Defense McNamara hoped that a subtler response could be devised. He wanted a plan that would permit the gradual escalation of a conflict, and delay the use of nuclear weapons for as long as possible. But the French president, Charles de Gaulle, and the British prime minister, Harold Macmillan, had little confidence that West Berlin could be defended with conventional weapons. Any suggestion that the United States might not use nuclear weapons immediately, they worried, could weaken deterrence and encourage the Soviets to take risks.

General Lauris Norstad, the supreme allied commander of NATO, agreed with the British and the French. Norstad thought that once the fighting began, the escalation wouldn’t be gradual. It would be “explosive,” and NATO had to be ready for all-out nuclear war. After the Bay of Pigs fiasco, Norstad had persuaded McNamara to keep the Jupiter missiles in Turkey and Italy. “This is the time to create strength,” Norstad said, “not reduce it.”

As Khrushchev continued to make public threats against West Berlin and raise the specter of war, President Kennedy followed the advice of former Secretary of State Dean Acheson. “If a crisis is provoked,” Acheson had suggested, “a bold and dangerous course may be the safest.” The United States should raise the stakes, send more conventional forces to Germany, and show a willingness to fight. On July 25, Kennedy gave a televised address on the Berlin crisis. The Soviet Union had no right to restrict NATO’s presence in West Berlin, Kennedy asserted, “and we have given our word that an attack upon that city will be an attack upon us all.” He proposed a call-up of reservists and National Guard units, an expansion of the draft, the addition of more than 100,000 troops to the Army, a delay in the retirement of the Strategic Air Command’s B-47 bombers — and a plan to build more civilian bomb shelters in the United States. Angered by the speech, Khrushchev asked John McCloy, a White House adviser who was visiting Russia, to pass along a message: “Tell Kennedy that if he starts a war then he would probably become the last President of the United States.”

Although Kennedy and McNamara now understood the urgency of America’s command-and-control problems, little had been done to rectify them. Barely six months had passed since the inauguration, and much more time would be needed to make fundamental changes in the system. As the Berlin crisis deepened, the commanders of NATO units were ordered not to use their nuclear weapons without the explicit approval of General Norstad. But locks had not been installed in those weapons — and McNamara soon agreed to equip American troops on the front line with Davy Crockett atomic rifles. They were likely to be the first weapons fired at an invading Red Army.

More important, the SIOP remained the same. It had officially become the nuclear war plan of the United States in mid-April, although Kennedy hadn’t even received a formal briefing on it. His national security adviser, McGeorge Bundy, thought that an alternative to the SIOP was needed, now that a war with the Soviets seemed like a real possibility. “[T]he current strategic war plan is dangerously rigid,” Bundy informed the president, “and, if continued without amendment, may leave you with very little choice as to how you face the moment of thermonuclear truth.” One of Bundy’s aides, Carl Kaysen, was given the task of quickly preparing a new war plan. During the Second World War, Kaysen had selected bomb targets in Germany. He later worked at RAND and served as a professor of economics at Harvard. Kaysen thought that NATO should rely increasingly on conventional weapons and that Germany should eventually become a nuclear-free zone. Nevertheless, he enlisted help from one of McNamara’s aides, Henry Rowen, to come up with a nuclear war plan that the president might actually use. The “spasm war” demanded by the current SIOP, they agreed, was a “ridiculous and unworkable notion.”

Just after midnight, on August 13, without any warning, East German troops began to string a barbed wire fence between East and West Berlin. For weeks, thousands of people had fled East Germany through the city, the last stretch of the border that hadn’t been militarized. NATO troops now watched helplessly as the fence became a wall.

After an initial, tentative response, on August 18 President Kennedy ordered a battle group of 1,500 soldiers to travel the autobahn from West Germany to Berlin. McNamara had opposed the move, afraid that it might start a nuclear war. The Soviets didn’t challenge the convoy. When it arrived in West Berlin, the American troops were greeted by hundreds of thousands of cheering Germans and Vice President Lyndon B. Johnson, who felt relieved. Twelve days later, the Soviet Union surprised the Kennedy administration again, unilaterally ending the moratorium on nuclear tests. As a show of strength, within the next month, the Soviets detonated twenty-six nuclear weapons.

Carl Kaysen’s war plan was ready by the first week of September. It was designed for use during the Berlin crisis. “We should be prepared to initiate general war by our own first strike,” Kaysen wrote. “We should seek the smallest possible list of targets, focusing on the long-range striking capacity of the Soviets, and avoiding, as much as possible, casualties and damage in Soviet civil society.” If President Kennedy launched the current SIOP, the United States would have to kill more than half of the people in the Soviet Union — and millions more in Eastern Europe and China — just to maintain the freedom of West Berlin. Doing so would be not only morally questionable but impractical. The scale of the military operations required by the SIOP was so large, it would “inevitably” tip off the Soviets that a nuclear strike was coming. It would give them time to retaliate. Kaysen proposed a surprise attack that would use just forty-one American bombers, approaching at low altitude, to destroy roughly twice that number of long-range missile and bomber bases in the Soviet Union. The whole thing would be over “no more than fifteen minutes” after the first bomb dropped.

Following the attack, Kaysen suggested, “we should be able to communicate two things to Khrushchev: first, that we intend to concentrate on military targets unless he is foolish enough to hit our cities; secondly, that we are prepared to withhold the bulk of our force from the offensive… provided that he accepts our terms.” Instead of killing hundreds of millions, the raid would probably kill “less than 1,000,000 and probably not much more than 500,000.”

General Lyman Lemnitzer, head of the Joint Chiefs of Staff, was not overly impressed by the plan. At a meeting the following week, Lemnitzer told President Kennedy that the United States still lacked the command-and-control capabilities for a limited nuclear attack. Any forces withheld from a first strike might never be available for a second one. And there was no guarantee that Khrushchev would understand, amid the chaos of nuclear war, that only his military targets had been attacked. Kaysen’s plan left the Soviet Union’s medium-range and intermediate-range missiles untouched — and if Khrushchev didn’t get the message and capitulate, Great Britain and most of Europe would be destroyed. Lemnitzer opposed any changes to the SIOP:

General Curtis LeMay wholeheartedly agreed with Lemnitzer. Indeed, if war came, LeMay thought the Soviet Union should be hit by more nuclear weapons, not fewer, to guarantee that every strategic target was eliminated. Despite strong political and philosophical differences, President Kennedy had recently promoted LeMay to Air Force chief of staff, out of respect for his operational skills. “If you have to go, you want LeMay in the lead bomber,” Kennedy later explained. “But you never want LeMay deciding whether or not you have to go.”

The underlying logic of both nuclear war plans was inescapable: kill or be killed. General Lemnitzer said that regardless of how the SIOP was executed, “some portion of the Soviet… nuclear force would strike the United States.” By the fall of 1961, the Soviet Union had about 16 long-range missiles, 150 long-range bombers, and 60 submarine-based missiles that could hit North America. It would be hard to find and destroy every one of them. Kaysen estimated that the number of American deaths stemming from his plan, “while small percentage wise — between three and seven percent [of the total U.S. population],” would nevertheless range between 5 million and 13 million. Just a handful of high-yield weapons, landing on New York City and Chicago, could produce that many deaths. “In thermonuclear warfare,” Kaysen noted, “people are easy to kill.” But the alternative to launching a surprise attack on the Soviet Union might be a lot worse. A Soviet first strike could kill as many as 100 million Americans.

PRESIDENT KENNEDY WAS WRESTLING WITH these issues in the days leading up to his U.N. speech. The recommendations of the young civilians at the Pentagon seemed, in many ways, to contradict those of the Joint Chiefs of Staff. The president would have to decide who was right. Neither superpower wanted a nuclear war. But neither wanted to back down, alienate its allies, or appear weak. Behind the scenes, all sorts of formal and informal contacts were being made between the two governments, including a secret correspondence between Kennedy and Khrushchev. And yet their positions seemed irreconcilable, especially with a deadline approaching. For the Soviet leader, West Berlin was a “rotten tooth which must be pulled out,” a center of American espionage, a threat to the future of East Germany. For Kennedy, it was an outpost of freedom, surrounded by totalitarian rule, whose two million inhabitants couldn’t be abandoned. The Berlin Wall, at least, had preserved the status quo. “It’s not a very nice solution,” Kennedy said, the day the barbed wire went up, “but a wall is a hell of a lot better than a war.”

On September 19, the day before the White House meeting on whether to launch a surprise attack, Kennedy sent a list of questions to General Power:

The president also wanted to know if the missiles aimed at Europe could be destroyed by an American first strike. During the meeting on the twentieth, General Power expressed concern that Khrushchev was hiding many of his long-range missiles. Without better intelligence, a limited strike on the Soviet Union would be too risky. The choice was all or nothing — and Power advocated an attack with the full SIOP.

“The Western Powers have calmly resolved,” Kennedy said at the United Nations a few days later, “to defend, by whatever means are forced upon them, their obligations and their access to the free citizens of West Berlin.” The following week, Secretary of Defense McNamara told the press that the United States would not hesitate to use nuclear weapons “whenever we feel it necessary to protect our vital interests.” And he confidently added that America’s nuclear stockpile was much larger than that of the Soviet Union. The administration now found it useful to deflate the myth of the missile gap. Details about SAC’s ability to destroy the Soviet Union were provided to NATO officials — so that Soviet intelligence officers who’d infiltrated NATO would share the information with the Kremlin. Perceptions of American military strength were important, as tensions rose in Europe. Soviet fighter planes buzzed commercial airliners heading to West Berlin and dropped chaff to disrupt their navigational systems. Border guards in East Berlin shot at civilians trying to get past the wall. Police officers in West Berlin responded by firing clouds of tear gas to help the refugees escape — and fought a gun battle with East German police.

Although negotiations with the Soviets quietly continued, on October 10, President Kennedy, the secretary of state, the secretary of defense, the head of the Joint Chiefs, and a few other advisers met at the White House to finalize plans for a military defense of West Berlin. Everyone agreed about the first three phases, a gradually escalating set of responses with conventional weapons. But a disagreement arose over Phase IV, the point at which nuclear weapons would be introduced. McNamara said that tactical weapons should be used first, to protect NATO troops and show the Soviets that America wasn’t afraid to fight a nuclear war. Paul H. Nitze — a McNamara aide and an advocate not only of containing, but of overthrowing, Communist regimes throughout the world — thought the use of tactical weapons would be a mistake. According to notes of the meeting, Nitze said that Phase IV should begin with the United States launching an all-out first strike against the Soviet Union, because “with such a strike, we could in some real sense be victorious.” Neither side could be confident of winning a nuclear exchange, McNamara argued — and the consequences would be devastating for both. The meeting ended with the issue unresolved.

When President Kennedy later sent instructions for the defense of West Berlin to General Norstad, Phase IV was made up of three parts:

Although Norstad was supposed to try A and B before proceeding to C, the behavior of the Soviets could prompt the United States to begin with C.

Norstad had already received these orders on October 27, when Soviet and American tanks confronted one another at Checkpoint Charlie, the last border crossing in Berlin. An American diplomat had been detained by East German border guards the previous week, and a dispute arose over the process of gaining access to East Berlin. American tanks were sent to Checkpoint Charlie as a show of strength. Soviet tanks appeared there at about five in the evening on the twenty-seventh. The British soon deployed two antitank guns to support the Americans, while all the French troops in West Berlin remained safely in their barracks. For the first time since the Cold War began, tanks belonging to the U.S. Army and the Red Army pointed their guns at one another, separated by about a hundred yards. General Norstad had ordered his tank commanders to tear down the Berlin Wall, if East German guards blocked the rightful passage of American civilians. Amid the armored standoff at the border, Secretary of State Rusk had those orders rescinded. A miscalculation by either side, a needless provocation, could lead to war.

The Soviet foreign minister met with the American ambassador in Moscow to discuss the situation. Attorney General Robert F. Kennedy, the president’s younger brother, had a secret, late-night meeting with Georgi Bolshakov, a Soviet intelligence officer, in Washington, D.C. The negotiations were successful. Sixteen hours after arriving at the border, the Soviet tanks turned around and left. The American tanks departed half an hour later.

Khrushchev had already backed away from his ultimatum that NATO troops must leave West Berlin by the end of the year — and withdrawing the tanks first seemed like another sign of weakness. Two days later, Khrushchev made a blunt, defiant statement. Above an island in the Arctic Sea, the Soviet Union detonated Tsar Bomba, “the King of Bombs” — the most powerful nuclear weapon ever built. It had a yield of 50 megatons. The mushroom cloud rose about forty miles into the sky, and the fireball could be seen more than six hundred miles from ground zero. The shock waves circled the earth three times with enough force to be detected in New Zealand.

The Berlin crisis eased somewhat. But Khrushchev did not let go of his central demands, Kennedy distrusted the Soviets, and the city still threatened to become a flash point where a third world war would begin. McGeorge Bundy later recalled, “There was hardly a week in which there were not nagging questions about what would happen if….” On November 6, a tear-gas battle erupted between East German and West German police officers. On November 20, a crowd of fifty thousand gathered to protest the wall, and the demonstration ended in chaos, with about a thousand people battling police. And on November 24, just before dawn, SAC headquarters in Omaha lost contact with the Ballistic Missile Early Warning System radar in Thule, Greenland. A SAC controller picked up the phone and called NORAD headquarters in Colorado Springs to find out what was wrong. The line was dead.

The odds of a communications breakdown simultaneously extending east and west from Omaha seemed low. SAC’s entire alert force was ordered to prepare for takeoff. At air bases worldwide, Klaxons sounded and pilots climbed into hundreds of planes. A few minutes later the order was rescinded. The B-52 circling Thule had made contact with the base. It had not been destroyed by the Soviets. An investigation subsequently found that the failure of a single AT&T switch in Black Forest, Colorado, had shut down all the ballistic missile early warning circuits, voice communications between the SAC and NORAD command posts, and the “hot line” linking SAC’s commander to NORAD headquarters. AT&T had neglected to provide redundant circuits for some of the nation’s most important communications links, despite assurances that it had done so. When news of the “Black Forest incident” leaked, Radio Moscow claimed the false alarm was proof that “any maniac at a US military base can, in a panic, easily throw mankind into the abyss of a nuclear war.”

THE BERLIN CRISIS LED Secretary of Defense McNamara to believe, even more strongly, that NATO’s reliance on tactical nuclear weapons increased the threat of a nuclear holocaust. During the first week of May 1962, at a meeting of NATO ministers in Athens, Greece, McNamara urged America’s European allies to spend more money on their own defense. Despite having a larger population than the Soviet Union and much larger economies, the European members of NATO refused to pay for conventional forces that could stop the Red Army. In his top secret speech, McNamara warned that NATO should never be forced to choose between suffering a military defeat or starting a nuclear war. “Highly dispersed nuclear weapons in the hands of troops would be difficult to control centrally,” he said. “Accidents and unauthorized acts could well occur on both sides.”

In addition to greater spending on conventional weapons, McNamara proposed a new nuclear strategy. Later known as “no cities,” it was similar to Kaysen’s plan, influenced by RAND — and like Henry Kissinger’s early work, hopeful that a nuclear war could be fought humanely. Its goal was to save the lives of civilians. “Our best hope lies in conducting a centrally controlled campaign against all of the enemy’s vital nuclear capabilities,” McNamara said. Attacking only military targets would give the Soviets a strong incentive to do the same. The centralized control of nuclear weapons was essential for this strategy — and the control would ultimately lie with the president of the United States. McNamara’s remarks were partly aimed at the French, who planned to keep their nuclear weapons outside of NATO’s command structure. By acting alone during a conflict with the Soviet Union, France could threaten the survival of everyone else. The independent actions of one country, McNamara explained, could “lead to the destruction of our hostages — the Soviet cities — just at a time at which our strategy of coercing the Soviets into stopping their aggression was on the verge of success.” Without the centralized command and control of nuclear weapons, NATO might suffer “the catastrophe which we most urgently wish to avoid.”

The following month, McNamara repeated many of these themes during a commencement speech at the University of Michigan, in his hometown of Ann Arbor. The speech was poorly received. McNamara’s plan to save civilian lives — without the classified information that supported its central argument — sounded like a boast that the United States could fight and win a nuclear war. Great Britain and France publicly repudiated the strategy. In their view the threat of total annihilation was a better deterrent than a more limited and more expensive form of warfare, fought with conventional weapons. And America’s NATO allies suspected that a “no cities” approach would primarily spare the cities of the United States. Nikita Khrushchev didn’t like the speech, either. “Not targeting cities — how aggressive!” Khrushchev told the Presidium of the Supreme Soviet of the Soviet Union. He suggested that McNamara’s remarks had a sinister aim: “To get the population used to the idea that nuclear war will take place.”

Although the United States and the Soviet Union publicly supported peace, diplomacy, and a settlement of their differences through negotiation, both countries behaved less nobly in secret. During the summer of 1962, the Kennedy administration was trying to overthrow the government of Cuba and assassinate its leader, Fidel Castro. Robert Kennedy guided the CIA’s covert program Operation Mongoose enlisting help from Cuban exiles and the Cosa Nostra. Robert McNamara supervised the planning for a full-scale invasion of the island, should Operation Mongoose succeed. Meanwhile, Khrushchev approved a KGB plan to destabilize and overthrow the governments of El Salvador, Guatemala, and Nicaragua. More important, he decided to turn Cuba into a military outpost of the Soviet Union, armed with nuclear weapons.

If Khrushchev’s scheme worked, by the end of 1962, the Soviets would have twenty-four medium-range ballistic missiles, sixteen intermediate-range ballistic missiles, forty-two bombers, a fighter wing, a couple of tank battalions, antiaircraft missiles, and about 50,000 personnel in Cuba. The medium-range missiles would be able to strike targets as far north as Washington, D.C.; the intermediate-range, to destroy SAC bases in the West and the Midwest. The Cuban deployment would triple the number of Soviet land-based missiles that could hit the United States. Throughout the summer, Soviet merchant ships secretly transported the weapons to Cuba, hidden belowdecks, along with troops dressed in civilian clothes. Once the Cuban missile sites were operational, Khrushchev planned to announce their existence during a speech at the United Nations. And then he would offer to remove them — if NATO agreed to leave West Berlin. Or he would keep them in Cuba, just a hundred miles from Florida, and build a naval base on the island for ballistic-missile submarines.

“We have no bases in Cuba, and we do not intend to establish any,” Khrushchev had assured Kennedy in a personal note. That promise was later repeated by the Soviet ambassador, Anatoly Dobrynin, during a meeting with Robert Kennedy. On September 11, TASS issued a flat-out denial: “Our nuclear weapons are so powerful in their explosive force and the Soviet Union has such powerful rockets to carry these nuclear warheads, there is no need to search for sites for them beyond the boundaries of the Soviet Union.” A month later photographs taken by an American U-2 spy plane revealed Soviet missile sites under construction in the countryside near San Cristobal, about fifty miles west of Havana. Kennedy had warned the Soviets that the United States would not tolerate the deployment of ballistic missiles in Cuba. Now he had to figure out what to do about them.

FOR THE NEXT THIRTEEN DAYS, the Kennedy administration debated how to respond, worried that a wrong move could start a nuclear war. Many of the crucial discussions were secretly recorded; the president and his brother were the only ones at the meetings who knew that a tape recorder was running. At first, President Kennedy thought that the Soviet missiles had to be destroyed before they became operational. Most of his advisers felt the same way. They disagreed mainly on the issue of how large the air strike should be — confined solely to the missiles or expanded to include Cuban air bases and support facilities. As the days passed, doubts began to intrude. A surprise attack had the best chance of success; but it might anger America’s allies in Europe, especially if Khrushchev used it as a pretext to seize West Berlin. A small-scale attack might not destroy every missile and nuclear weapon on the island; but getting them all might require a full-scale invasion. And a blockade of the island would prevent the Soviets from delivering more weapons to Cuba; but it might have little effect on the weapons already there.

The Joint Chiefs of Staff unanimously agreed that the Soviet missiles had to be attacked at once, without any warning. Like the Jupiters in Italy and Turkey, the missiles in Cuba weren’t protected by concrete silos. From a strictly military point of view, they were useful only for a Soviet first strike. And their strategic purpose seemed to be a decapitation attack against the military and civilian leadership of the United States. The Ballistic Missile Early Warning System was oriented to the north and the east, not the south. Missiles launched from Cuba might not be detected until their thermonuclear warheads hit American targets three or four minutes later. The Joint Chiefs recommended a massive air strike against the Soviet missiles, planes, and weapons in Cuba. A limited strike would not only be more dangerous, they argued, it might be worse than doing nothing at all. Missiles that survived the attack would probably be hidden or launched — and the one opportunity to destroy them, lost.

The strategic implications of the missiles meant less to President Kennedy than the intangible threat they posed. “It doesn’t make any difference if you get blown up by an ICBM flying from the Soviet Union or one that was ninety miles away,” he said the day after the missiles were discovered. Failing to destroy them or to force their removal would make America look weak. It might encourage the Soviets to move against Berlin. But attacking the missiles brought a whole new set of risks. At a meeting with the Joint Chiefs of Staff on October 19, four days into the crisis, after the president and his brother and his national security advisers had gone back and forth discussing what sort of action to take, the stark differences between America’s civilian and military leadership were exposed.

“If we attack Cuba, the missiles, or Cuba, in any way then it gives [the Soviets] a clear line to take Berlin,” President Kennedy said.

General LeMay disagreed.

“We’ve got the Berlin problem staring us in the face anyway,” LeMay said. “If we don’t do anything to Cuba, then they’re going to push on Berlin and push real hard because they’ve got us on the run.”

LeMay thought the Strategic Air Command was so overwhelmingly powerful, and America’s nuclear superiority was so great, that the Soviets wouldn’t dare to attack Berlin or the United States. Anything short of an air strike on Cuba, he told Kennedy, would be “almost as bad as the appeasement at Munich” that led to the Second World War. The remark was especially pointed: Kennedy’s father had long been criticized for supporting that appeasement of Hitler. An extraordinary exchange soon occurred between America’s commander in chief and one of its most prominent generals:

When the meeting ended, Kennedy left the Cabinet Room, unsure about what to do. The tape recorder was still running. General David Shoup, commandant of the Marine Corps, turned to LeMay. “I just agree with you,” Shoup said. “I agree with you a hundred percent.”

On the evening of October 22, America’s television networks interrupted their regularly scheduled programming to broadcast a special message from the president. Appearing somber and grim behind his desk in the Oval Office, Kennedy informed the nation that Soviet missiles had been spotted in Cuba. He called upon Khrushchev to “eliminate this clandestine, reckless and provocative threat to world peace.” He reminded viewers that a policy of appeasement, of allowing aggressive conduct to go unchallenged, had led to the Second World War. And he declared that the United States was imposing a modified blockade, a “quarantine,” on the shipment of offensive weapons to Cuba. The Soviet missiles had to be removed, and Khrushchev had to “move the world back from the abyss of destruction.” Otherwise, Kennedy said, the United States would take further, unspecified actions.

The Joint Chiefs of Staff had established five defense readiness conditions (DEFCON) for the armed forces. DEFCON 5 was the state of military readiness during normal peacetime operations; DEFCON 1 meant that war was imminent. As Kennedy spoke to the nation, the Joint Chiefs ordered American forces to DEFCON 3. Polaris submarines left their ports and headed for locations within range of the Soviet Union. Fighter-interceptors patrolled American airspace with Genies and Falcons, atomic antiaircraft rockets, in case Soviet planes tried to attack from Cuba. Nearly two hundred B-47 bombers left SAC bases and flew to dozens of civilian airports throughout the United States — to Portland, Spokane, and Minneapolis; to Chicago and Detroit; to Birmingham, Philadelphia, and Tulsa. Dispersing the bombers from SAC bases made them less vulnerable to a Soviet missile attack. Aircrews slept on the ground beside their planes, which were loaded with hydrogen bombs, as commercial airliners took off and landed on nearby runways.

The number of B-52s on airborne alert was increased more than fivefold. Every day about sixty-five of the bombers circled within striking distance of the Soviet Union. Each of them carried a Hound Dog missile with a thermonuclear warhead, as well as two Mark 39 or four Mark 28 hydrogen bombs. On October 24, when the quarantine of Cuba took effect, the Strategic Air Command was placed on DEFCON 2 for the first time in its history. “I am addressing you for the purpose of reemphasizing the seriousness of the situation this nation faces,” General Power said in a message transmitted to all his commanders worldwide. “We are in an advanced state of readiness to meet any emergencies…. I expect each of you to maintain strict security and use calm judgment during this tense period.” Sent by radio, without any encryption, his announcement that SAC was ready for war could also be heard by the Soviets.

One quarter of a million American troops prepared for an invasion of Cuba. Secretary of Defense McNamara worried that, with thousands of nuclear weapons on high alert, something could go wrong. President Kennedy had recently approved the installation of permissive action links. But his executive order applied only to weapons in the NATO atomic stockpile — and none of the locks had been installed yet. U.S. Air Force units in Europe were kept at DEFCON 5, and the readiness of NATO forces wasn’t increased. Any sign of a mobilization in Europe might alarm the Soviets, creating another potential trigger for nuclear war. McNamara also worried that if the United States attacked the Soviet missiles in Cuba, the Soviet Union might retaliate by attacking the Jupiter missiles in Turkey. The American custodians of the Jupiters were ordered to render the missiles inoperable, somehow, if Turkish officers tried to launch them without Kennedy’s approval.

The lack of direct, secure communications between the White House and the Kremlin, the distrust that Kennedy felt toward the Soviet leader, and Khrushchev’s impulsive, unpredictable behavior complicated efforts to end the crisis peacefully. Khrushchev felt relieved, after hearing Kennedy’s speech, that the president hadn’t announced an invasion of Cuba. Well aware that the Soviet Union’s strategic forces were vastly inferior to those of the United States, Khrushchev had no desire to start a nuclear war. He did, however, want to test Kennedy’s mettle and see how much the Soviets could gain from the crisis. Khrushchev secretly ordered his ships loaded with missiles not to violate the quarantine. But in private letters to Kennedy, he vowed that the ships would never turn around, denied that offensive weapons had been placed in Cuba, and denounced the quarantine as “an act of aggression which pushes mankind toward… a world nuclear-missile war.”

Bertrand Russell agreed with the Soviet leader and sent President Kennedy a well-publicized telegram. “Your action desperate,” it said. “Threat to human survival. No conceivable justification. Civilized man condemns it…. End this madness.” Khrushchev’s first public statement on the missile crisis was a cordial reply to the British philosopher, proposing a summit meeting. While the Kennedy administration anxiously wondered if the Soviets would back down, Khrushchev maintained a defiant facade. And then on October 26, persuaded by faulty intelligence that an American attack on Cuba was about to begin, he wrote another letter to Kennedy, offering a deal: the Soviet Union would remove the missiles from Cuba, if the United States promised never to invade Cuba.

Khrushchev’s letter arrived at the American embassy in Moscow around five o’clock in the evening, which was ten in the morning, Eastern Standard Time. It took almost eleven hours for the letter to be fully transmitted by cable to the State Department in Washington, D.C. Kennedy and his advisers were encouraged by its conciliatory tone and decided to accept the deal — but went to bed without replying. Seven more hours passed, and Khrushchev started to feel confident that the United States wasn’t about to attack Cuba, after all. He wrote another letter to Kennedy, adding a new demand: the missiles in Cuba would be removed, if the United States removed its Jupiter missiles from Turkey. Instead of being delivered to the American embassy, this letter was broadcast, for the world to hear, on Radio Moscow.

On the morning of October 27, as President Kennedy was drafting a reply to Khrushchev’s first proposal, the White House learned about his second one. Kennedy and his advisers struggled to understand what was happening in the Kremlin. Conflicting messages were now coming not only from Khrushchev, but from various diplomats, journalists, and Soviet intelligence agents who were secretly meeting with members of the administration. Convinced that Khrushchev was being duplicitous, McNamara now pushed for a limited air strike to destroy the missiles. General Maxwell Taylor, now head of the Joint Chiefs of Staff, recommended a large-scale attack. When an American U-2 was shot down over Cuba, killing the pilot, the pressure on Kennedy to launch an air strike increased enormously. A nuclear war with the Soviet Union seemed possible. “As I left the White House… on that beautiful fall evening,” McNamara later recalled, “I feared I might never live to see another Saturday night.”

The Cuban Missile Crisis ended amid the same sort of confusion and miscommunication that had plagued much of its thirteen days. President Kennedy sent the Kremlin a cable accepting the terms of Khrushchev’s first offer, never acknowledging that a second demand had been made. But Kennedy also instructed his brother to meet privately with Ambassador Dobrynin and agree to the demands made in Khrushchev’s second letter — so long as the promise to remove the Jupiters from Turkey was never made public. Giving up dangerous and obsolete American missiles to avert a nuclear holocaust seemed like a good idea. Only a handful of Kennedy’s close advisers were told about this secret agreement.

Meanwhile, at the Kremlin, Khrushchev suddenly became afraid once again that the United States was about to attack Cuba. He decided to remove the Soviet missiles from Cuba — without insisting upon the removal of the Jupiters from Turkey. Before he had a chance to transmit his decision to the Soviet embassy in Washington, word arrived from Dobrynin about Kennedy’s secret promise. Khrushchev was delighted by the president’s unexpected — and unnecessary — concession. But time seemed to be running out, and an American attack might still be pending. Instead of accepting the deal through a diplomatic cable, Khrushchev’s decision to remove the missiles from Cuba was immediately broadcast on Radio Moscow. No mention was made of the American vow to remove its missiles from Turkey.

Both leaders had feared that any military action would quickly escalate to a nuclear exchange. They had good reason to think so. Although Khrushchev never planned to move against Berlin during the crisis, the Joint Chiefs had greatly underestimated the strength of the Soviet military force based in Cuba. In addition to strategic weapons, the Soviet Union had almost one hundred tactical nuclear weapons on the island that would have been used by local commanders to repel an American attack. Some were as powerful as the bomb that destroyed Hiroshima. Had the likely targets of those weapons — the American fleet offshore and the U.S. naval base at Guantánamo — been destroyed, an all-out nuclear war would have been hard to avoid.

Pushed to the brink, Kennedy and Khrushchev chose to back down. But Kennedy emerged from the crisis looking much tougher — his concession to the Soviets not only remained secret but was vehemently denied. LeMay, among others, suspected that some sort of deal had been struck. Asked at a Senate hearing whether the Jupiters in Turkey had been traded for the missiles in Cuba, McNamara replied, “Absolutely not… the Soviet Government did raise the issue… [but the] President absolutely refused even to discuss it.” Secretary of State Rusk repeated the lie. In order to deflect attention from the charge, members of the administration told friendly journalists, off the record, that Adlai Stevenson, the American ambassador to the United Nations, had urged Kennedy to trade NATO missiles in Turkey, Italy, and Great Britain for the missiles in Cuba, but the president had refused — another lie. A reference to the secret deal was later excised from Robert Kennedy’s diary after his death. And a virile myth was promoted by the administration: when the leaders of the two superpowers stood eye to eye, threatening to fight over Cuba, Khrushchev was the one who blinked.

Within the following year, President Kennedy gave a speech at American University that called for a relaxation of the Cold War and “genuine peace” with the Soviets. The United States, the Soviet Union, and Great Britain signed the Limited Test Ban Treaty, prohibiting nuclear detonations in the atmosphere, the ocean, and outer space. And a hot line was finally created to link the Kremlin and the Pentagon, with additional terminals at the White House and the headquarters of the Communist Party in Moscow. The Soviet Union welcomed the new system. At the height of the Cuban Missile Crisis, urgent messages from the Soviet ambassador in Washington had been encoded by hand and then given to a Western Union messenger who arrived at the embassy on a bicycle. “We at the embassy could only pray,” Ambassador Dobrynin recalled, “that he would take it to the Western Union office without delay and not stop to chat on the way with some girl!”

Unlike the hot line frequently depicted in Hollywood films, the new system didn’t provide a special telephone for the president to use in an emergency. It relied on Teletype machines that could send text quickly and securely. Written statements were considered easier to translate, more deliberate, and less subject to misinterpretation than verbal ones. Every day, a test message was sent once an hour, alternately from Moscow, in Russian, and from Washington, in English. The system would not survive nuclear attacks on either city. But it was installed with the hope of preventing them.

DURING THE CUBAN MISSILE CRISIS, the Strategic Air Command conducted 2,088 airborne alert missions, involving almost fifty thousand hours of flying time, without a single accident. The standard operating procedures, the relentless training, and the checklists introduced by LeMay and Power helped to achieve a remarkable safety record when it was needed most. Nevertheless, in the aftermath of the crisis, public anxieties about nuclear war soon focused on the dangers of SAC’s airborne alert. The great risk — as depicted in the 1964 films Fail-Safe and Dr. Strangelove — wasn’t that a hydrogen bomb might accidentally explode during the crash of a B-52. It was that an order to attack the Soviet Union could be sent without the president’s authorization, either through a mechanical glitch (Fail-Safe) or the scheming of a madman (Dr. Strangelove).

The plot of both films strongly resembled that of the novel Red Alert. Its author, Peter George, cowrote the screenplay of Dr. Strangelove and sued the producers of Fail-Safe for copyright infringement. The case was settled out of court. The threat of accidental nuclear war was the central theme of the films — and Strangelove, although a black comedy, was by far the more authentic of the two. It astutely parodied the strategic theories pushed by RAND analysts, members of the Kennedy administration, and the Joint Chiefs. It captured the absurdity of debating how many million civilian deaths would constitute a military victory. And it ended with an apocalyptic metaphor for the arms race, conjuring a Soviet doomsday machine that’s supposed to deter an American attack by threatening to launch a nuclear retaliation, automatically, through the guidance of a computer, without need of any human oversight. The failure of the Soviets to tell the United States about the contraption defeats its purpose, inadvertently bringing the end of the world. “The whole point of the doomsday machine is lost,” Dr. Strangelove, the president’s eccentric science adviser, explains to the Soviet ambassador, “IF YOU KEEP IT A SECRET!”

The growing public anxiety about accidental war prompted a spirited defense of America’s command-and-control system. Sidney Hook, a prominent conservative intellectual, wrote a short book dismissing the fears spread by Cold War fiction. “The probability of a mechanical failure in the defense system,” Hook wrote in The Fail-Safe Fallacy, “is now being held at so low a level that no accurate quantitative estimate of the probability… can be made.” Senator Paul H. Douglas, a Democrat from Illinois praised the book and condemned the misconception that America’s nuclear deterrent was a grave danger to mankind, not “the Communist determination to dominate the world.” And Roswell L. Gilpatric, one of McNamara’s closest advisers, assured readers of the New York Times that any malfunction in the command-and-control system would make it “‘fail safe,’ not unsafe.” Gilpatric also suggested that permissive action links would thwart the sort of unauthorized attack depicted in Dr. Strangelove.

In fact, there was nothing to stop the crew of a B-52 from dropping its hydrogen bombs on Moscow — except, perhaps, Soviet air defenses. The Go code was simply an order from SAC headquarters to launch an attack; bombers on airborne alert didn’t have any technological means to stop a renegade crew. General Power had waged a successful bureaucratic battle against the installation of permissive action links in SAC’s weapons. All of its bombs and warheads were still unlocked, as were those of the Navy. The effort to prevent the unauthorized use of nuclear weapons remained largely administrative. In 1962, SAC had created a Human Reliability Program to screen airmen and officers for psychological problems, drug use, and alcohol abuse. And a version of the two-man rule was introduced in its bombers. A second arming switch was added to the cockpit. In order to use a nuclear weapon, both the ready/safe switch and the new “war/peace switch” had to be activated by two different crew members. Despite these measures, an unauthorized attack on the Soviet Union was still possible. But the discipline, training, and esprit de corps of SAC’s bomber crews made it unlikely.

As a plot device in novels and films, an airborne alert gone wrong could provide suspense. A stray bomber would need at least an hour to reach its target, enough time to tell a good story. But one of the real advantages of SAC’s bombers was that their crews could be contacted by radio and told to abort their missions, if the Go code had somehow been sent by mistake. Ballistic missiles posed a far greater risk of unauthorized or accidental use. Once they were launched, there was no calling them back. Missiles being flight-tested usually had a command destruct mechanism — explosives attached to the airframe that could be set off by remote control, destroying the missile if it flew off course. SAC refused to add that capability to operational missiles, out of a concern that the Soviets might find a way to detonate them all, midflight. And for similar reasons, SAC opposed any system that required a code to enable the launch of Minuteman missiles. “The very existence of the lock capability,” General Power argued, “would create a fail-disable potential for knowledgeable agents to ‘dud’ the entire Minuteman force.”

After examining the launch procedures proposed for the Minuteman, John H. Rubel — who supervised strategic weapon research and development at the Pentagon — didn’t worry about the missiles being duds. He worried about an entire squadron of them being launched by a pair of rogue officers. A Minuteman squadron consisted of fifty missiles, overseen by five crews housed underground at separate locations. Only two of the crews were necessary to launch the missiles — making it more difficult for the Soviet Union to disable a squadron by attacking its control centers. When both of the officers in two different centers turned their keys and “voted” for a launch, all of the squadron’s missiles would lift off. There was no way to fire just a few of them: it was all or nothing. And a launch order couldn’t be rescinded. After the keys were turned, fifty missiles would leave their silos, either simultaneously or in a “ripple order,” one after another.

By requiring a launch vote from at least two crews, SAC hoped to prevent the launch of Minuteman missiles without proper authorization. But Rubel was surprised to learn that SAC had also installed a timer in every Minuteman control center. The timer had been added as a backup — an automated vote to launch — in case four of the five crews were killed during a surprise attack. When the officers in a control center turned their launch keys, the timer started. And when the timer ran out, if no message had been received from the other control centers, approving or opposing the order to launch, all the missiles lifted off. The problem with the timer, Rubel soon realized, was that a crew could set it to six hours, six minutes — or zero. In the wrong hands, it gave a couple of SAC officers the ability to wipe out fifty cities in the Soviet Union. An unauthorized attack on that scale, a classified history of the Minuteman program noted, would be “an accident for which a later apology might be inadequate.”

In 1959, Rubel sent a copy of Red Alert to every member of the Pentagon’s Scientific Advisory Committee for Ballistic Missiles. He thought that the Minuteman launch control system needed much stronger safeguards against unauthorized use, as well as some sort of “stop-launch” capability. The committee agreed with him. But the Air Force fought against any modifications of the system, arguing that they would be too expensive and that the Minuteman, America’s most important land-based missile, was “completely safe.”

Rubel’s concerns were taken seriously by the Kennedy administration, and an independent panel was appointed to investigate them. The panel found that Minuteman missiles were indeed vulnerable to unauthorized use — and that an entire squadron could be launched, accidentally, by a series of minor power surges. Although that sort of mistake was unlikely, it was possible. Two young SAC officers might be sitting innocently at their consoles, on an ordinary day, their launch keys locked away in the safe, as small fluctuations in the electricity entering the control center silently mimicked the pulses required by the launch switch. The crew would be caught by surprise when fifty Minuteman missiles suddenly left the ground.

“I was scared shitless,” said an engineer who worked on the original Minuteman launch control system. “The technology was never to be trusted.” Secretary of Defense McNamara insisted that a number of command-and-control changes be made to the Minuteman, and the redesign cost about $840 million. The new system eliminated the timer, allowed missiles to be launched individually, and prevented minor power surges from causing an accidental launch. Minuteman missiles became operational for the first time during the Cuban Missile Crisis. To err on the side of safety, the explosive bolts were removed from their silo doors. If one of the missiles were launched by accident, it would explode inside the silo. And if President Kennedy decided to launch one, some poor enlisted man would have to kneel over the silo door, reconnect the explosive bolts by hand, and leave the area in a hurry.

WHILE THE DEPARTMENT OF DEFENSE publicly dismissed fears of an accidental nuclear war, the Cuban Missile Crisis left McNamara more concerned than ever about the danger. At a national security meeting a few months after the crisis, he opposed allowing anyone other than the president of the United States to authorize the use of nuclear weapons. A secret memorandum on the meeting summarized his views:

The supreme commander of NATO should not be granted any type of predelegation “to fire nuclear weapons,” McNamara argued — and even the president should never order their use without knowing all the details of a nuclear explosion, whether it was deliberate or accidental, “whether or not it was Soviet launched, how large, where it occurred, etc.” Secretary of State Rusk agreed with McNamara. But their views did not prevail. The head of NATO retained the authority to use nuclear weapons, during an emergency, on the condition that “every effort to contact the President must be made.”

The elaborate nuclear strategies promoted by RAND and embraced by McNamara now seemed largely irrelevant. After the Cuban Missile Crisis, a “no cities” policy lost its appeal. Newspapers had criticized it, NATO allies had repudiated it, and the dispersal of SAC bombers to commercial airports had blurred the distinction between civilian and military targets. And as the Soviet Union built more long-range missiles, a counterforce strategy would require the United States to deploy more missiles to destroy them. The arms race would become never ending. The hope of eliminating the Soviet threat with a first strike and defending America from attack now seemed illusory. Thousands of new missiles, the construction of more bomb shelters, or even an antiballistic missile system couldn’t change what appeared to be an unavoidable fact for both superpowers: launching any nuclear attack would be suicidal.

Within weeks of President Kennedy’s assassination, McNamara formally endorsed a strategy of “Assured Destruction.” The idealism and optimism that had accompanied Kennedy’s inauguration were long gone. The new strategy was grounded in a sense of futility. It planned to deter a Soviet attack by threatening to wipe out at least “30 % of their population, 50 % of their industrial capacity, and 150 of their cities.” McNamara’s staff had calculated that the equivalent of 400 megatons, detonated above the Soviet Union, would be enough for the task. Anything more would be overkill. Informed by a reporter that the Soviets were hardening their silos to protect the missiles from an American attack, McNamara said, “Thank God.” The move would improve “crisis stability.” Once the Soviets felt confident that they could retaliate after being attacked, they’d feel much less pressure to strike first. Leaving the cities of the United States and the Soviet Union vulnerable to annihilation, McNamara now thought, would keep them safe. The strategy was soon known as MAD: “mutually assured destruction.”

The strategic thinking at the White House and the Department of Defense, however, didn’t correspond to the targeting policies at SAC headquarters in Omaha. The gulf between theory and practice remained vast. Although the SIOP had been revised during the Kennedy administration, General Power had blocked significant changes in weapon allocation. The new SIOP divided the “optimum mix” into three separate target groups: Soviet nuclear forces, conventional military forces, and urban-industrial areas. The president could decide to attack only the first group, the first two groups, or all three. Moscow, China, and cities in the Eastern bloc could selectively be spared from destruction. The SIOP could be launched as a first strike or as retaliation. But all the attack options still required that the Soviet Union be hit by thousands of nuclear weapons, far more than were necessary for “assured destruction.” The three target categories of the SIOP — Alpha, Bravo, Charlie — were the same as those in the attack plan proposed by SAC in 1950. And the new SIOP was almost as destructive, inflexible, and mechanistic as the previous one. A war plan that seemed too horrible to contemplate when Kennedy and McNamara first learned of its existence had become institutionalized.

By the time Robert McNamara retired from the Pentagon in February 1968, the command-and-control system of the United States had been improved. The new Missile Defense Alarm System — satellites with infrared sensors that could detect heat from the launch of missiles — promised to give as much as half an hour of warning, if the Soviets attacked. SAC’s Looking Glass command post, airborne twenty-four hours a day, increased the likelihood that a Go code could be sent after the United States was hit. New computer and communications systems were being added to the World Wide Military Command and Control System. But many of the underlying problems hadn’t been solved.

The number of nuclear weapons in the American arsenal had increased by more than 50 percent since the Eisenhower administration. The United States now had about thirty thousand of them, and each one could potentially be lost, stolen, sabotaged, or involved in an accident. Tactical weapons hadn’t been removed from Europe. On the contrary, the number of tactical weapons had more than doubled, and they were no longer safely tucked away in igloos. Putting locks in NATO’s weapons allowed them to be widely dispersed to units in the field — where they could be more easily stolen. And the question of how to keep the president alive and in command still didn’t have a satisfactory answer. The plans for a Deep Underground Command Center were scrapped after Kennedy’s death. The bunker had a good chance of surviving multiple hits from Soviet warheads. But its survival would prove meaningless. After an attack the president and his aides would most likely find themselves trapped two thirds of a mile beneath the rubble of the Pentagon, unable to communicate with the rest of the world or even get out of their bunker. The facility would serve primarily as a multimillion-dollar tomb.

Although McNamara’s efforts to avoid a nuclear war were tireless and sincere, he left office as one of the most despised men in the United States. Half a million American soldiers were fighting in Vietnam, the war seemed unwinnable, and most Americans blamed the number-crunching secretary of defense and his Ivy League advisers for the fiasco. A centralized command-and-control system — so essential for managing a nuclear war — had proven disastrous when applied to a civil war in Southeast Asia. Distrusting the Joint Chiefs of Staff and convinced that victories on the battlefield could be gained through cost-benefit analysis, the secretary of defense micromanaged the Vietnam War. McNamara personally chose targets to be bombed and supervised air strikes from his office at the Pentagon. “I don’t object to its being called McNamara’s war,” he said in 1964. “In fact I’m proud to be identified with it.”

Four years later hundreds of thousands of Vietnamese civilians had been killed, tens of thousands of American servicemen had been killed or wounded, antiwar protests were spreading throughout the United States, and the Pentagon had become a symbol of bureaucratic malevolence and pointless slaughter. Known for his cool, detached manner, McNamara was now prone to bouts of sobbing in his office. While receiving the Presidential Medal of Freedom, the day before his retirement, he apologized for being unable to speak. President Lyndon Johnson put a hand on McNamara’s shoulder, ended the ceremony, and guided him from the room.

Curtis LeMay withdrew from public life the same year, having left the Air Force in 1965. Once the darling of Hollywood and the media, he was now widely mocked and ridiculed. His well-publicized disputes with the Kennedy administration had given him a reputation for being a right-wing Neanderthal. When a fictionalized version of General LeMay appeared in film, the character was no longer a heroic defender of freedom. He was a buffoon, like General Buck Turgidson in Dr. Strangelove, willing to sacrifice twenty million American lives for the sake of defeating the Soviet Union. Or he was a crypto-fascist, like General James Mattoon Scott in Seven Days in May, preferring a coup d’état in the United States to a disarmament treaty with the Soviets.

LeMay seemed to confirm those stereotypes in October 1968, when he agreed to serve as the vice presidential candidate for the American Independent Party. George C. Wallace, an outspoken racist and segregationist, was the presidential candidate. LeMay had played a leading role in integrating the Air Force, and his support for equal rights, labor unions, birth control, and abortion seemed out of place in the Wallace campaign. But LeMay’s anger at how the Vietnam War was being fought — and his belief that both the Democratic and Republican candidates, Hubert H. Humphrey and Richard M. Nixon, were willing to appease the Communists — persuaded him to run. It was perhaps the worst decision of his life.

Tough and disciplined as a commander, LeMay was a supremely incompetent politician. At the press conference announcing his candidacy, he refused to rule out the use of nuclear weapons in Vietnam. The same implied threat that Eisenhower had made to end the Korean War sounded heartless and barbaric sixteen years later, as images of Vietnamese women and children burned by napalm appeared on the nightly news. LeMay had strongly opposed sending ground troops to Vietnam and disagreed with McNamara’s strategy for fighting a limited war there. “War is never ‘cost-effective,’” LeMay argued. “People are killed. To them the war is total.” At the press conference he stressed that the United States should always try to avoid armed conflict, “but when you get in it, get in it with both feet and get it over with as soon as you can.” The logic of his argument received less attention than the tone-deaf remark that preceded it: “We seem to have a phobia about nuclear weapons.”

On the campaign trail, the general who’d risked his life countless times fighting the Nazis was jeered by protesters yelling, “Sieg Heil.” He told reporters that the antiwar movement was “Communist-inspired,” lost his job as an aerospace executive for running with Wallace, and largely faded into obscurity after their defeat. LeMay and McNamara, polar opposites who’d battled over a wide range of national security issues, each convinced that the other was dangerously wrong, now found themselves in much the same place. They ended 1968 in humiliation and disgrace, their views repudiated by the American people.

An Abnormal Environment

On March 13, 1961, at about half past eleven in the morning, a B-52 took off from Mather Air Force Base in California, not far from Sacramento. The plane was on a Chrome Dome mission, carrying two Mark 39 hydrogen bombs. Twenty minutes after takeoff, the pilot, Major Raymond Clay, felt too much hot air coming from the vents in the cockpit. He and one of the copilots, First Lieutenant Robert Bigham, tried to turn off the heat. The vents wouldn’t close, and it became uncomfortably warm in the cockpit. Almost seven hours into the flight, the control tower at Mather instructed Clay to “continue mission as long as you can… if it gets intolerable, of course, bring it home.” Before the second refueling, Clay guided the plane to a low altitude and depressurized the cabin to cool it. But it heated up again, as the bomber climbed to thirty thousand feet. Fourteen hours into the flight, the temperature in the cockpit had reached 160 degrees Fahrenheit — so hot that one of the pilot’s windows shattered.

Clay descended to twelve thousand feet again and requested permission to end the mission. In addition to the broken window, a couple of the crew members were feeling sick. The cockpit had become so hot that Clay and his two copilots took turns flying the plane, going back and forth to the cabin below, where the temperature was a little cooler. Passing through overcast skies, the bomber flew off course, fell behind schedule by about half an hour, and lost another seven or eight minutes avoiding bad weather. Twenty-two hours into the flight, First Lieutenant Bigham realized that a gauge for one of the main fuel tanks was broken. The reading hadn’t changed for at least ninety minutes — but nobody had noticed, amid the heat and the hassle of coming and going from the cockpit. Bigham asked the control tower to send a tanker; they were running low on fuel. Forty minutes later, while approaching the tanker, the B-52 ran out of gas. All eight engines flamed out at once.

At an altitude of seven thousand feet, the crew started to bail out. Major Clay stayed in the cockpit and banked the plane away from Yuba City, California, just forty miles short of their base. Confident that the bomber wouldn’t hit the town, Clay ejected at an altitude of four thousand feet. The B-52 made a full 360-degree turn and then crashed nose first into a barley field. The high explosives of both hydrogen bombs shattered on impact and didn’t burn or detonate. The weapons harmlessly broke into pieces. All eight members of the crew survived the crash. But an Air Force fireman, rushing to the scene, was killed when his truck overturned.

Fred Iklé had predicted that as the number of nuclear weapons and airborne alerts increased, so would the number of accidents. He was correct, and the aircraft involved in those accidents had few safeguards to protect weapons during a crash. The Air Force considered the performance of a bomber or a fighter — its speed, maneuverability, capacity, and range — more important than its structural integrity. The B-52 had been designed in the late 1940s, and its designers never anticipated that the bomber would be used for airborne or ground alerts. It wasn’t built to carry fully assembled nuclear weapons during peacetime. When the weapons were attached to the underside of a plane, they were fully exposed to the effects of a crash. And when they were carried inside the bomb bay of a B-52, a Sandia report noted, they were located in “a weak point in the aircraft’s structure, a point at which the aircraft is apt to break open, spewing weapons beyond the protection afforded by the fuselage.”

On Johnston Island in the central Pacific, tests designed to measure the effects of high-altitude nuclear explosions served as a reminder that missiles and warheads didn’t always behave in predictable ways. On June 3, 1962, a Thor intermediate-range missile with a 400-kiloton warhead lifted off smoothly. But a radar tracking station failed, endangering ships in the area if the missile flew off course. The range safety officer decided to abort the flight. The command destruct mechanism blew up the missile, destroying its warhead. Two and a half weeks later, another Thor was launched, this time with a 1.4-megaton warhead. The missile’s engine shut down after fifty-nine seconds, and the range safety officer decided, once again, to use the command destruct mechanism. The Thor exploded at an altitude of about thirty thousand feet. Pieces of the missile and the warhead, including plutonium from its core, fell on Johnston Island and the surrounding lagoon.

About a month later, another Thor missile with a 1.4-megaton warhead misfired on the launchpad. It never got off the ground. The range safety officer gave the command destruct order, and a massive explosion destroyed much of the launch complex, showering it with debris, burning fuel, and plutonium. The next two months were spent rebuilding the complex and decontaminating the island. On October 15, during the first use of the new launchpad, a Thor missile went off course about ninety seconds after liftoff. The command destruct order was given, the missile exploded, and more plutonium fell onto Johnston Island. Two thirds of the Thor missiles used in the tests — modified versions of the Thors deployed in Great Britain — had to be destroyed by remote control.

The mishaps on Johnston Island occurred during test launches carefully planned for months. But mundane, everyday tasks also caused nuclear weapon accidents. On November 13, 1963, three workers at an Atomic Energy Commission base in Medina, Texas, were moving partially assembled Mark 7 bombs into a storage igloo. The weapons were being decommissioned. Their high explosives would eventually be burned, their uranium recovered. Two explosive spheres most likely rubbed together while being unloaded, and one of them ignited. The three workers — Marvin J. Ehlinger, Hilary F. Huser, and Floyd T. Lutz — noticed the flames, ran out of the igloo, and jumped into a ditch across the road. The sphere burned for about forty-five seconds and then detonated, setting off approximately 123,000 pounds of high explosives in the building. The explosion did not produce a nuclear yield, although the mushroom cloud rising from the blast contained uranium dust. Shop windows were blown out in San Antonio, fourteen miles away. All that remained, where the igloo had once stood, was a crater twenty feet deep. The other igloos at the base were undamaged, the three workers unharmed. They were given the rest of the day off.

A few weeks later a B-52 encountered severe air turbulence while crossing the Appalachian Mountains. It was transporting two Mark 53 hydrogen bombs — an air-delivered version of the weapon carried by the Titan II missile, with a yield of 9 megatons. The pilot, Major Thomas McCormick, took the plane down to about twenty-nine thousand feet, looking for a smoother ride. But the turbulence got worse, and McCormick received permission to climb another few thousand feet. The crew heard a loud thud. The fifty-foot-high tail fin had snapped off the bomber. McCormick told everyone to bail out, as the plane rolled over and flew upside down for a moment before spiraling downward. Four crew members got out safely; the radar navigator, Major Robert Townley, didn’t. The plane crashed into the side of Savage Mountain, about twenty miles from Cumberland, Maryland, during a heavy snowstorm. It was one thirty in the morning, and the temperature outdoors was about 0 degrees Fahrenheit.

Technical Sergeant Melvin Wooten, the gunner, landed in a field about half a mile from Salisbury, Pennsylvania. The lights of the town were visible in the distance, but Wooten died before reaching it. He’d suffered severe head, chest, and leg injuries. Major Robert Payne, the navigator, walked for hours in the darkness, through snowdrifts two to three feet deep. He fell into a stream and froze to death. Major McCormick and a copilot, Captain Parker Peedin, landed near trees, about three miles apart. They waited until daylight to seek help. McCormick found refuge in a farmhouse, after walking for two miles. Peedin was spotted by a search plane, and both men were hospitalized with minor injuries. The hydrogen bombs were found amid the wreckage of the B-52, partially buried in snow. Their high explosives had neither detonated nor burned.

Another accident with a Mark 53 bomb took place on December 8, 1964. During a training exercise at Bunker Hill Air Force Base, about a dozen miles north of Kokomo, Indiana, a B-58 bomber turned onto an icy runway. The plane carried five hydrogen bombs — four Mark 43s and the Mark 53 — with a combined yield of perhaps 13 megatons. As the B-58 turned, the plane ahead revved its engines. The strong, sudden gust of exhaust hit the B-58. The bomber slid off the runway, and the landing gear beneath the right wing collapsed. The pilot, Captain Leary Johnson, saw a bright flash; fuel had leaked and ignited. Johnson gave the order to bail out, jettisoned his canopy, climbed over the nose of the plane, leaped through flames, and caught on fire. He rolled through snow and puddles of water to put out the flames, suffering only minor burns. The defensive systems operator, Roger Hall, jettisoned his canopy, noticed the left wing was on fire, climbed onto the right one, jumped off the engine, and briefly caught on fire, too. His burns were superficial. Instead of climbing out, the navigator, Manuel Cervantes, Jr., triggered his escape capsule, and a rocket blasted it into the air. The capsule landed about 150 yards from the burning plane, but Cervantes was killed by the impact. He had two young sons.

The five hydrogen bombs incurred varying degrees of damage: two were intact; one was scorched; another was mostly consumed by the fire; and the fifth completely melted into the tarmac. None of the high explosives detonated. Fire crews aggressively fought the blaze, long past the time factors of the bombs. The fire threatened not only a SAC base crowded with bombers and nuclear weapons but also the fifty thousand inhabitants of Kokomo. At one point firefighters dragged a burning hydrogen bomb fifty yards from the plane, dumped it into a trench, covered it with sand, and extinguished the flames.

During the same week as the Bunker Hill accident, a couple of young airmen, Leonard D. Johnson and Glenn A. Dodson, Jr., drove out to a Minuteman missile site at Ellsworth Air Force Base in South Dakota. A crew in the launch control center, about twenty miles away, had reported a problem with the security system around the silo. Johnson and Dodson were told to find out what was wrong. They entered the silo, opened the security alarm control box, and checked the fuses. Dodson had forgotten to bring a fuse puller, so he used a screwdriver instead. After removing each fuse, he’d put it back into place. You could hear the difference between a good fuse and one that had burned out. When a good fuse was inserted, it made a clicking sound. One of the fuses didn’t make that “click.” Dodson pulled it out again with the screwdriver, put it back, and heard a different kind of sound — a loud explosion.

The two airmen ran out of the launch duct and called the control center. Half an hour later, a Missile Potential Hazard Team ordered them to reenter the silo. They found it full of thick, gray smoke. One of the retrorockets atop the Minuteman had fired. The reentry vehicle, containing a W-56 thermonuclear weapon, had lifted a few inches into the air, flipped over, fallen nose first from the missile, bounced off the wall, hit the second-stage engine, and landed at the bottom of the silo. The warhead wasn’t damaged, although its arming and fuzing package was torn off during the seventy-five-foot drop. An investigation later found that the retrorocket had been set off by a fault in an electrical connector — and by Dodson’s screwdriver.

The weapon accidents often felt sudden and surreal. On December 5, 1965, a group of sailors were pushing an A-4E Skyhawk fighter plane onto an elevator aboard the USS Ticonderoga, an aircraft carrier about seventy miles off the coast of Japan. The plane’s canopy was open; Lieutenant Douglas M. Webster, its pilot, strapped into his seat. The deck rose as the ship passed over a wave, and one of the sailors blew a whistle, signaling that Webster should apply his brakes. Webster didn’t hear the whistle. The plane started to roll backward. The sailor kept blowing the whistle; other sailors yelled, “Brakes, brakes,” and held onto the plane. They let go as it rolled off the elevator into the sea. In an instant, it was gone. The pilot, his plane, and a Mark 43 hydrogen bomb vanished. No trace of them was ever found; the ocean there was about three miles deep. The canopy may have closed after the plane fell, trapping Webster in his seat. He had recently graduated from Ohio State University, gotten married, and completed his first tour of duty over Vietnam.

BY THE MID-1960s, sealed-pit nuclear weapons had burned, melted, sunk, blown apart, smashed into the ground. But none had detonated accidentally. The B-52 crash in Goldsboro, North Carolina, had been an awfully close call, gaining the attention of engineers at Sandia. Nobody wanted that sort of thing to happen again — and yet during the Goldsboro crash, the weapons had failed safe. Now that nuclear testing had resumed, Los Alamos, Lawrence Livermore, and Sandia were busy designing new warheads and bombs for every branch of the armed services. The need for new safety devices was not apparent. Again and again, the existing ones worked.

President Kennedy and Secretary of Defense McNamara had taken a personal interest in nuclear weapon safety. A few months after Goldsboro, Kennedy gave the Department of Defense “responsibility for identifying and resolving health and safety problems connected with the custody and storage of nuclear weapons.” The Atomic Energy Commission was to play an important, though subsidiary, role. Kennedy’s decision empowered McNamara to do whatever seemed necessary. But it also reinforced military, not civilian, control of the system. At Los Alamos, Livermore, and Sandia, the reliability of nuclear weapons continued to receive far greater attention than their safety. And a dangerous way of thinking, a form of complacency later known as the Titanic Effect took hold among weapon designers: the more impossible an accidental detonation seemed to be, the more likely it became.

The military’s distrust of use control and safety devices was encouraged by some of the early models. The first permissive action links — Category A PALs — did not always operate flawlessly. The batteries in their decoders had a tendency to run down without warning. When that happened, the weapons couldn’t be unlocked. And the gears in the Category A PALs were too loud. During a black hat exercise at Sandia, an engineer listened carefully to the sounds of a PAL, deciphered its code, and picked the lock.

The W-47 warhead had a far more serious problem. Designed at Lawrence Livermore in the late 1950s and rushed into production amid the anxiety about Sputnik, the warhead sat atop every missile in Polaris submarines. Its primary had a revolutionary new core — small and egg shaped, with only two detonators — that could generate a large yield for a weapon so compact. But the W-47 wasn’t one-point safe, by a significant margin. And the moratorium on nuclear testing, during Eisenhower’s last two years in office, prevented the sort of tests that could make it one-point safe. Edward Teller, now the director of Lawrence Livermore, considered using a more traditional core designed at Los Alamos, even though the two labs had competed fiercely for this contract with the Navy. Each Polaris submarine would have sixteen missiles, aligned closely together in two rows. An unsafe warhead could threaten the sub’s 150 crew members — and the port cities where it docked.

To avoid the embarrassment of relying on a Los Alamos design, Teller used Livermore’s new core but added a mechanical safing device to it. A strip of cadmium tape coated with boron was placed in the center of the core. Cadmium and boron absorb neutrons, and the presence of the tape would stop a chain reaction, making a nuclear detonation impossible. During the warhead’s arming sequence, the tape would be pulled out by a little motor before the core imploded. It seemed like a clever solution to the one-point safety problem — until a routine examination of the warheads in 1963 found that the tape corroded inside the cores. When the tape corroded, it got stuck. And the little motor didn’t have enough torque to pull the tape out. Livermore’s mechanical safing device had made the warheads too safe. A former director of the Navy’s Strategic Systems Project Office Reentry Body Coordinating Committee explained the problem: there was “almost zero confidence that the warhead would work as intended.” A large proportion of W-47 warheads, perhaps 75 percent or more, wouldn’t detonate after being launched. The Polaris submarine, the weapon system that McNamara and Kennedy considered the cornerstone of the American arsenal, the ultimate deterrent, the guarantor of nuclear retaliation and controlled escalation and assured destruction, was full of duds. For the next four years, Livermore tried to fix the safety mechanism of the W-47, without success. The Navy was furious, and all the warheads had to be replaced. The new cores were inherently one-point safe.

The Strategic Air Command’s safety procedures had become so effective that the risks of its airborne alert were easily overlooked. During the first five years of the program, SAC conducted tens of thousands aerial refuelings — with only one fatal accident. But the laws of probability couldn’t be escaped. On January 17, 1966, at about ten fifteen in the morning, a B-52 on a Chrome Dome mission prepared for its second refueling, a couple of miles inland from the southern coast of Spain. It had left Goldsboro, North Carolina, the previous evening and needed more fuel, after seventeen hours of flight, for the trip home. The B-52 approached the tanker too quickly, flew into the fuel boom, and started to break apart. Flames traveled straight through the boom. The tanker exploded, incinerating its four-man crew.

Major Larry G. Messinger, a copilot who was flying the B-52 at the time, bailed out first. His ejection seat cleared the plane, his parachute opened, and high winds carried him out to sea. The morning sky was clear enough for him to watch the coast of Spain receding in the distance. Messinger landed in the ocean, eight miles from shore, and inflated a life raft. Captain Ivans Buchanan, the radar navigator, left the plane, passed through a fireball, couldn’t get out of his ejection seat — and couldn’t get his parachute to open. Stuck in the chair as it plummeted and spun, Buchanan removed the parachute from the pack by hand. The chute finally opened, but the weight of the seat caused a hard landing. It hurt his back, broke his shoulder, and knocked him unconscious. Captain Charles J. Wendorf, the pilot, broke an arm ejecting from the plane. Although his parachute caught on fire, it deposited him safely in the ocean, about three miles out.

Lieutenant Michael J. Rooney, another copilot, was sitting below the cockpit, reading a book, when the two planes collided. He wasn’t near an ejection seat. The g-forces of the falling bomber delayed his exit for a few long minutes, tossing him against the walls, the roof, the floor. He managed to crawl out through the navigator’s escape hatch and opened his parachute. A burning engine pod flew right past him, close enough to singe hair. Rooney landed in the ocean, not far from Wendorf, and started to swim.

Rooney and Wendorf were picked up by fishing boats within half an hour, and Messinger was rescued about fifteen minutes later. Residents of Palomares, a nearby village, discovered Buchanan sitting in a field, strapped into the ejection seat, still unconscious. They took him to a hospital. Sergeant Ronald Snyder, the gunner, and Lieutenant George Glesner, the electronic warfare operator, died in the plane. Lieutenant Stephen Montanus, the navigator, bailed out, fell thirty thousand feet in his ejection seat, and hit the ground. For some reason, the parachute hadn’t opened. Montanus was the youngest member of the crew, just twenty-three, and his wife was only nineteen.

The B-52 carried four Mark 28 hydrogen bombs. None of the crew knew what had happened to them. A full-scale nuclear explosion clearly hadn’t occurred, and yet beyond that, little was known. A Disaster Control Team from the SAC base in Torrejón, Spain, arrived in the afternoon and started to look for the bombs. Debris from the B-52 littered the ground for miles; much of it had fallen in and around Palomares. The village was so poor and remote that it didn’t appear on most maps of southern Spain. The roughly two thousand inhabitants lacked electricity until 1958 and still didn’t have running water.

At dusk, members of the Spanish federal police led the Disaster Control Team to the first bomb, which had landed southeast of Palomares, about three hundred yards from the beach. The weapon was remarkably intact. One of the parachutes had opened, dropping the Mark 28 onto soft, clay soil. Air Force sentries were left there to guard it overnight. A group of experts from Los Alamos, Sandia, and the Atomic Energy Commission, assembled by the Joint Nuclear Accident Coordinating Center in Albuquerque, were supposed to arrive the next morning.

The second bomb was spotted from a helicopter, almost twenty-four hours after the crash. What was left of the weapon lay in the hills above the local cemetery. Its parachutes hadn’t opened. And its high explosives had partially detonated, digging a crater twenty feet wide, scattering bomb parts, and spreading plutonium across the hills. The third bomb was found about an hour later. It had struck the base of a stone wall, amid a vegetable garden on the outskirts of Palomares. The hydrogen bomb had missed a farmhouse by about seventy-five feet. One of its parachutes had deployed, and some of the high explosives had gone off. Pieces of the weapon, charred explosives, and a cloud of plutonium had been blown into nearby tomato fields.

The fourth bomb couldn’t be found. Long lines of troops walked for miles, shoulder to shoulder, looking for it. Planes and helicopters looked for it. Hundreds of abandoned mine shafts, wells, and other holes in the ground were carefully explored for it. A month and a half after the crash, the Mark 28 was still missing, and the search of the countryside near Palomares was called off.

The little village had been overrun by reporters from around the world. At first, the Air Force refused to confirm or deny that nuclear weapons were involved in the accident. But the sight of “450 airmen with Geiger counters looking for nuclear material,” as Reuters reported, soon made the subject hard to avoid. Three days after the accident, the Air Force admitted that the B-52 had been carrying “unarmed nuclear armament,” stressed that “there is no danger to public health or safety as a result of this accident,” and failed to disclose that a bomb had been lost. As a small armada of American ships searched for it, headlines conveyed the growing anger and doubts about the official story: “SECRECY SHROUDS URGENT HUNT FOR MISSING A-WEAPON,” “MADRID POLICE DISPERSE MOB AT U.S. EMBASSY,” “NEAR CATASTROPHE FROM U.S. BOMB, SOVIETS SAY; ‘NUCLEAR VOLCANO’ IN SEA OFF SPAIN.” After weeks of bad publicity, the Pentagon finally acknowledged that a nuclear weapon was missing. The news brought to mind the plot of the latest James Bond film, Thunderball, and its underwater search for stolen hydrogen bombs.

The governments of Spain and the United States denied that the plutonium released by the two weapons posed any threat to the public. “There is not the slightest risk in eating meat, fish, vegetables from the [impact] zone, or of drinking milk from there,” Spain’s Nuclear Energy Board declared. The truth was somewhat more complex. Little research had been done on plutonium dispersal or the proper methods of decontamination. And the alpha particles emitted by plutonium were hard to detect outside of a laboratory. They traveled about an inch and could be blocked by a blade of grass or even a thin film of dew — making it almost impossible, with the available equipment, to determine exactly how much land was contaminated around Palomares. The Air Force had been caught unprepared for a weapon accident that spread plutonium. Portable alpha detectors had to be rushed to Spain from bases in other NATO countries, the United States, and North Africa. And the detectors often didn’t work.

Nevertheless, traces of plutonium were detected in the mile-long strip of land between the two spots where bombs had landed. The contamination extended through the village of Palomares into nearby tomato fields. Residents weren’t evacuated from these areas, and hazard control lines weren’t established, a report by the Defense Nuclear Agency (DNA) later explained, because of “the politics of the situation.”

The United States promised to decontaminate Palomares. But guidelines for removing plutonium after a weapon accident didn’t exist. Nor did criteria for determining safe levels of plutonium in the environment. Almost four thousand truckloads of contaminated beans, cabbages, and tomatoes were harvested with machetes and burned. About thirty thousand cubic feet of contaminated soil were scraped from the ground, packed into steel drums, sent to an AEC facility in Aiken, South Carolina, and buried. The soldiers who cleared the fields and filled the drums were given surgical masks. According to the DNA report, the masks offered no protection against radiation hazards and served mainly as a placebo — “a psychological barrier to plutonium inhalation.” To reassure the public and encourage tourists to visit southern Spain, the American ambassador brought his family to the beach near Palomares, put on a bathing suit, invited the press to join him, and took a well-publicized swim in the ocean, not far from where the hydrogen bomb had landed.

Randall C. Maydew, head of the aerodynamics department at Sandia, was recruited to help look for the missing bomb. His group had designed the parachutes and casing of the Mark 28. Before Maydew left for Spain, his friend Bob Peurifoy gave him a tool to aid with the search: a forked stick, like the divining rods used by dowsers to find water. Maydew and his team tried to ascertain where in the sky the two planes had collided. They performed reverse trajectory calculations — based on where the three bombs and the B-52’s engines had hit the ground — and decided that the crash had happened somewhere within a circular, mile-wide patch of the sky, two miles from the coast, at an altitude of fifteen thousand feet. Given that location, the prevailing winds at the time of the accident, the discovery of the missing bomb’s tail plate on the beach, and an assumption that its parachutes had opened, Maydew’s team pointed to an eight-square-mile area in the Atlantic where it had most likely landed. A few days later, their conclusions were supported by a Spanish fisherman, who claimed to have seen a “stout man,” attached to a large parachute, fall into the water there.

Ships, planes, helicopters, underwater television platforms, more than one hundred deep-sea divers, and four manned submersibles — Deep Jeep, Cubmarine, Aluminaut, and Alvin — searched the ocean for weeks, as Soviet vessels lingered nearby. “It isn’t like looking for a needle in a haystack,” Rear Admiral William S. Guest, the commander of the operation, said. “It’s like looking for the eye of a needle in a field full of haystacks in the dark.” On March 15, the crew of the Alvin spotted the bomb, wrapped in a parachute, at a depth of roughly half a mile. Nine days later, while it was being pulled from the sea, the line snapped — and the bomb disappeared again. The search resumed, another week passed, and Alvin found the bomb a second time. Aside from a small dent on the nose, it looked fine. The second attempt to recover it went smoothly. Having endured two and a half months of bad press, the Pentagon invited reporters aboard Admiral Guest’s ship to show off the weapon, which sailed past them on the deck of another ship, proudly displayed like a prizewinning fish that had just been caught. Although the United States had deployed thousands of hydrogen bombs during the previous decade, this was the first time the American people were allowed to see one.

AFTER THE PALOMARES ACCIDENT, the government of Spain prohibited American planes from carrying nuclear weapons in its airspace. The SAC base in Torrejón was handed over to NATO, and members of President Lyndon Johnson’s administration debated whether to end the airborne alert. It now seemed risky, expensive, outdated, and unnecessary. The kind of surprise attack that Pentagon officials had feared in 1960 no longer seemed likely. And as a nuclear deterrent, the twelve B-52s on airborne alert weren’t as intimidating to the Soviets as the roughly 1,600 ballistic missiles in American silos and submarines. But the Joint Chiefs of Staff and the new commander of SAC, General John Dale Ryan, insisted that the airborne alert was crucial for the national defense. President Johnson decided to continue the alert for the time being, but reduced the number of daily flights to four.

“The possibility of an accidental nuclear explosion taking place is essentially negligible,” the director of nuclear safety at Kirtland Air Force Base told CBS News. The Atomic Energy Commission said much the same thing to the New York Times, claiming the odds were “so remote that they can be ruled out completely.” But a number of scientists and engineers at Sandia didn’t share that degree of optimism. Bob Peurifoy felt uneasy that a simple, low-voltage signal, lasting a few seconds, was still being used to arm hydrogen bombs. That kind of signal dated back to the days of Thomas Edison — and it could come from a lot of places as a B-52 fell apart. It could come from a short circuit during an otherwise uneventful flight. Peurifoy thought that a more complicated signal — a unique series of electrical pulses — could prevent a bomb from being armed accidentally. Transmitted between the ready/safe switch in the cockpit and the nuclear weapon in the bomb bay, it would operate much like a secret code, alternating long and short pulses in a pattern that fate, bad luck, or even Mother Nature couldn’t randomly generate.

Another engineer, Thomas Brumleve, criticized the air of overconfidence at Sandia, the overemphasis on reliability, the faith that an accidental detonation could never happen. “But suppose some important aspect of nuclear safety has been overlooked,” Brumleve wrote in a 1967 report. “The nation, and indeed the world, will want to know who was responsible, how it could have happened, and why it wasn’t prevented.”

On January 21, 1968, a B-52 was serving as the Thule monitor. For hours it flew a “bowtie” pattern at thirty-five thousand feet, heading back and forth above the ballistic missile early warning complex in western Greenland. One of the copilots, Major Alfred D’Amario, Jr., had stuffed three cloth-covered, foam-rubber cushions beneath the instructor navigator’s seat, and someone later put a fourth one under it, keeping the cushions wedged in place with a small metal box. The cushions might ease the discomfort of a long, tedious mission. About five hours into the flight, the crew noticed that the heat wasn’t working properly. The cockpit felt too cold, and so D’Amario turned on a system that pulled air from the engine manifold into the cabin. The air was hot, about 428 degrees Fahrenheit. It ignited the cushions, which were blocking a vent under the seat.

The radar navigator, Major Frank F. Hopkins, thought he smelled something burning. It smelled like burning rubber. The crew looked for the source of the smoke, found it, sprayed the cushions with fire extinguishers, but couldn’t put out the fire. The pilot, Captain John Haug, asked the control tower at Thule for permission to conduct an emergency landing. As Haug started the descent, Hopkins opened the sextant port, a small hole in the fuselage, to let out smoke. The navigator, Captain Curtis R. Criss, tried to smother the burning cushions with a duffle bag. But the flames spread, and the smoke in the cockpit became so thick that Haug could barely see the instrument panel. He told Thule that the fire was out of control. Moments later, the plane lost all its power.

The crew would have to bail out into some harsh weather. The temperature that day in western Greenland was -23 degrees Fahrenheit; the windchill made it feel like -44. Haug wanted to get as close as possible to Thule and increase the odds of his crew’s survival — without crashing the B-52 into the base. Although their mission was simply to keep an eye on Thule and make sure that it still existed, the plane carried four Mark 28 bombs.

Haug stayed with the plane until everyone was out and then ejected, just four miles short of the runway. The B-52 passed right over Thule, made a 180-degree turn, flew another few miles, and slammed into the ice of Bylot Sound. The explosion caught most of the men on the base by surprise, shaking the buildings and lighting up the sky. It was about four thirty in the afternoon but completely dark outside. The sun hadn’t been seen in Thule for almost two months, since late November. Except for a brief period of dim light in the afternoon, the snow-covered landscape around the base seemed dark as night. SAC headquarters was notified, for the first time, about the fire on the plane, the crash, and the explosion. The command post at Thule had no idea if there were any survivors. And then Major D’Amario walked into one of the aircraft hangars and asked to use a phone. His parachute had deposited him near a runway. D’Amario told the base commander that at least six of the seven crew members had bailed out. Security police officers split into teams and got into trackmasters to find them, driving the large vehicles out of the base. Helicopters soon joined the search. In the Arctic weather, every minute counted: uncovered skin could become frostbitten within two.

Haug parachuted onto the base as well, and made his way to a different hangar. He and D’Amario had suffered only scrapes and bruises. About an hour after the crash, the gunner, Sergeant Calvin Snapp, was found in good shape near the dump. A couple of parachutes and ejection seats were spotted from a helicopter, three miles from Thule, along with footprints in the snow. Security police followed them to the base of a nearby mountain, where Major Hopkins and a copilot, Captain Richard Marx, had gone looking for help. Marx had bruises and abrasions; Hopkins, a broken arm. The body of Captain Leonard Svitenko, another copilot, was discovered at around midnight. He’d died leaving the plane. And almost a full day after the crash, the last remaining crew member, the navigator, Captain Criss, was found wrapped in his parachute, six miles from the base, suffering from frostbite, hypothermia, a dislocated shoulder. Criss was forty-three years old and eventually lost both of his feet. But he later worked as a postmaster in Maine, kept playing golf, and lived for another forty years.

The B-52 had struck the ice at a speed of almost six hundred miles per hour, about seven miles west of Thule. The high explosives of the four hydrogen bombs fully detonated upon impact, and roughly 225,000 pounds of jet fuel created a large fireball. For five or six hours, the fire burned, until being extinguished by the ice. When the first Explosive Ordnance Disposal team arrived at the site two days later, using flashlights and traveling from Thule on a dogsled, they found a patch of blackened ice about 720 yards long and 160 yards wide. Pieces of the bombs and the plane were scattered across an area of three square miles. The pieces were small — and highly radioactive. Tiny particles of plutonium had bonded with metal and plastic debris, mixed with jet fuel, water, and ice. Plutonium had risen in the smoke from the fire and traveled through the air for miles.

The one-point safety tests of the Mark 28’s core, performed secretly at Los Alamos during the Eisenhower administration, had been money well spent. If the Mark 28 hadn’t been made inherently one-point safe, the bombs that hit the ice could have produced a nuclear yield. And the partial detonation of a nuclear weapon, or two, or three — without any warning, at the air base considered essential for the defense of the United States — could have been misinterpreted at SAC headquarters. Nobody expected the Thule monitor to destroy Thule. Instead, the Air Force had to confront a less dangerous yet challenging problem: how to decontaminate about three square miles of ice, about seven hundred miles north of the Arctic Circle, during the middle of winter, in the dark.

Generators, floodlights, a helicopter pad, sleds, tracked vehicles, and half a dozen prefabricated buildings were brought to the crash site. New roads from the base were cut through the snow. A “Hot Line” was drawn around the contaminated area, with restrictions on who could enter it and decontamination control points for everyone who left it. Once again hundreds of young airmen walked shoulder to shoulder, looking for bomb parts and pieces of a B-52. Most of the debris was small, ranging from the size of a dime to that of a cigarette pack. Some of it had fallen through a gash in the ice, cut by the crash, that later refroze. The ice was about two feet thick; the water below it six hundred feet deep. Pieces of the bomb and the plane were carried away by the current or settled on the bottom of Bylot Sound.

Arctic storms with high winds complicated the recovery and cleanup efforts, spreading plutonium dust and hiding it beneath the snow. But the levels of contamination were more accurately measured at Thule than at Palomares. A new device, the Field Instrument for the Detection of Low-Energy Radiation (FIDLER), looked for the X-rays and gamma rays emitted by plutonium, instead of the alpha particles. Those rays traveled a longer distance and passed through snow. Over the next eight months, the top two inches of the blackened ice within the Hot Line were removed, trucked to the base, condensed, packed in containers, shipped to Charleston, South Carolina, and then transported by rail to the AEC facility in Aiken. The radioactive waste from Thule filled 147 freight cars.

During the summer of 1968, after Bylot Sound thawed, a Navy submersible searched for part of a Mark 28 bomb. The plutonium cores of the primaries in all four weapons had been blown to bits, and most of the uranium from their secondaries had been recovered. But a crucial piece of one bomb was still missing, most likely the enriched uranium spark plug necessary for a thermonuclear blast. It was never found — and the search later inspired erroneous claims that an entire hydrogen bomb had been lost beneath the ice.

The Air Force did a much better job of handling the press coverage at Thule than at Palomares. It helped that the B-52 had crashed near one of the most remote military installations in the world, far from any cities, towns, or tourists. An accident that contaminated three square miles of a large metropolitan area would have gained more attention. The Air Force admitted, from the outset, that nuclear weapons had been involved in the crash. Dozens of journalists were flown to Thule within days of the accident and supplied with a good deal of information. Few had the desire to remain in the Arctic for long. And a couple of other news stories — the seizure of the USS Pueblo by North Korea and the Tet offensive in Vietnam — quickly pushed Thule off the front page.

The Air Force account of the accident, however, was deliberately misleading. Denmark had imposed a strict ban on nuclear weapons, and its NATO allies were forbidden to bring them into Danish territory or airspace. For more than a decade, the Strategic Air Command had routinely violated that prohibition at Thule. The B-52 that crashed onto the ice, the Pentagon told reporters, had been on a “training flight” and had radioed that it was preparing to make an emergency landing. A handful of people within the Danish government and its military were no doubt aware that B-52s had been flying nuclear weapons over Danish territory every day for almost seven years. But they may not have known that atomic bombs were stored in secret underground bunkers at Thule as early as 1955. Hydrogen bombs were deployed there the following year. Before the introduction of SAC’s airborne alert, Thule was a convenient spot for American bombers to land, refuel, and pick up their weapons en route to the Soviet Union. The early hydrogen bombs were so heavy that prepositioning them in Greenland would allow SAC’s planes to make the long round-trip flight to Russia over the North Pole. Dozens of antiaircraft missiles with atomic warheads were later placed at Thule to defend the base from a Soviet attack. But none of these facts were shared with the Danish people.

The airborne alert program was terminated the day after the Thule accident. The risks no longer seemed justifiable, and many B-52s were now being used to bomb Vietnam. SAC’s ground alert was unaffected by the new policy. Hundreds of planes, loaded with hydrogen bombs, still sat beside runways all over the United States, ready to take off within minutes. And a B-52 secretly continued to fly back and forth above Thule, day and night, without nuclear weapons, just to make sure it was still there.

TWENTY-THREE YEARS AFTER Sandia became a separate laboratory, it created a nuclear weapon safety department. An assistant to the secretary of defense for atomic energy, Carl Walske, was concerned about the risks of nuclear accidents. He had traveled to Denmark, dealt with the aftermath of the Thule accident, and come to believe that the safety standards of the weapons labs were based on a questionable use of statistics. Before a nuclear weapon could enter the stockpile, the odds of its accidental detonation had to be specified, along with its other “military characteristics.” Those odds were usually said to be one in a million during storage, transportation, and handling. But the dimensions of that probability were rarely defined. Was the risk one in a million for a single weapon — or for an entire weapon system? Was it one in a million per year — or throughout the operational life of a weapon? How the risk was defined made a big difference, at a time when the United States had about thirty thousand nuclear weapons. The permissible risk of an American nuclear weapon detonating inadvertently could range from one in a million to one in twenty thousand, depending on when the statistical parameters were set.

Walske issued new safety standards in March 1968. They said that the “probability of a premature nuclear detonation” should be no greater than one in a billion, amid “normal storage and operational environments,” during the lifetime of a single weapon. And the probability of a detonation amid “abnormal environments” should be no greater than one in a million. An abnormal environment could be anything from the heat of a burning airplane to the water pressure inside a sinking submarine. Walske’s safety standards applied to every nuclear weapon in the American stockpile. They demanded a high level of certainty that an accidental detonation could never occur. But they offered no guidelines on how these strict criteria could be met. And in the memo announcing the new policy, Walske expressed confidence that “the adoption of the attached standards will not result in any increase in weapon development times or costs.”

A few months later, William L. Stevens was chosen to head Sandia’s new Nuclear Safety Department. Stevens had earned a degree in electrical engineering at Virginia Polytechnic Institute, served as an officer in the Army, and spent a few years in Baton Rouge, Louisiana, working for an oil company. He joined Sandia in 1957, at the age of twenty-eight. Bob Peurifoy had hired him, and the two worked together on the electrical system of the W-49 warhead, the first one to contain a trajectory-sensing switch as a safety device. When Stevens was assigned to lead the new safety department, he wasn’t convinced that nuclear weapon accidents posed a grave threat to the United States. But he’d been closer to a nuclear detonation than most scientific observers — and seen firsthand how unpredictable one could be.

While serving in the Army, Stevens had been trained to assemble the warheads of tactical weapon systems. In May 1953 members of his battalion participated in the test of an atomic cannon. Its shells could travel twenty miles and produce a yield equivalent to that of the bomb that destroyed Hiroshima. For the test in the Nevada desert, all sorts of things were placed near ground zero to study the weapon’s effects: trucks, tanks, railroad cars, aircraft panels, oil drums and cans of gasoline, household goods and materials — denim, flannel, rayon curtains, mops and brooms — a one-story brick structure, steel bridges, buildings that resembled motels, one hundred tall pine trees, field crops, flowers, insects, cages full of rats and mice, fifty-six dogs tethered inside aluminum tubes, forty-two pigs dressed in U.S. Army uniforms whose skin would respond to thermal radiation in a manner similar to that of human skin, and more than three thousand soldiers, including Bill Stevens, who huddled in a trench about three miles from ground zero.

The troops were part of an ongoing study of the psychological effects of nuclear warfare. They’d been ordered to climb out of their trenches and march toward the mushroom cloud after the blast. The Army Field Forces Human Research Unit hoped to discover how well they would follow the order, whether they’d obey it or come unglued at the sight of a large nuclear explosion. The atomic shell would fly directly over the heads of Stevens and the other soldiers. They were told to crouch in their trenches until the weapon detonated, then rise in time to brace against the blast wave and watch the explosion. At eight thirty in the morning, a great fireball lit up the desert, about ninety miles from Las Vegas.

As the troops stood, a powerful shock wave blew past, catching them by surprise. It was a “precursor wave,” a weapon effect that hadn’t been predicted. Highly compressed air had come down from the fireball, hit the ground, and spread outward, traveling faster than the blast wave. When Stevens and his unit climbed from the trenches to march toward ground zero, they were engulfed by a cloud of dirt and dust. Their lead officer couldn’t read the radiation dosage markers and led them closer to ground zero than planned. After returning to their base in Albuquerque, Stevens shook the dirt out of his uniform and saved some of it in a can. Twenty years later, he had the dirt tested at Sandia — and it was still radioactive.

After becoming the head of the nuclear safety department at the lab, Stevens looked through the accident reports kept by the Defense Atomic Support Agency, the Pentagon group that had replaced the Armed Forces Special Weapons Project. The military now used Native American terminology to categorize nuclear weapon accidents. The loss, theft, or seizure of a weapon was an Empty Quiver. Damage to a weapon, without any harm to the public or risk of detonation, was a Bent Spear. And an accident that caused the unauthorized launch or jettison of a weapon, a fire, an explosion, a release of radioactivity, or a full-scale detonation was a Broken Arrow. The official list of nuclear accidents, compiled by the Department of Defense and the AEC, included thirteen Broken Arrows. Bill Stevens read reports that secretly described a much larger number of unusual events with nuclear weapons. And a study of abnormal environments commissioned by Sandia soon found that at least 1,200 nuclear weapons had been involved in “significant” incidents and accidents between 1950 and March 1968.

The armed services had done a poor job of reporting nuclear weapon accidents until 1959 — and subsequently reported about 130 a year. Many of the accidents were minor: “During loading of a Mk 25 Mod O WR Warhead onto a 6X6 truck, a handler lost his balance… the unit tipped and fell approximately four feet from the truck to the pavement.” And some were not: “A C-124 Aircraft carrying eight Mk 28 War reserve Warheads and one Mk 49 Y2 Mod 3 War Reserve Warhead was struck by lightning…. Observers noted a large ball of fire pass through the aircraft from nose to tail…. The ball of fire was accompanied by a loud noise.”

Reading these accident reports persuaded Stevens that the safety of America’s nuclear weapons couldn’t be assumed. The available data was insufficient for making accurate predictions about the future; a thousand weapon accidents were not enough for any reliable calculation of the odds. Twenty-three weapons had been directly exposed to fires during an accident, without detonating. Did that prove a fire couldn’t detonate a nuclear weapon? Or would the twenty-fourth exposure produce a blinding white flash and a mushroom cloud? The one-in-a-million assurances that Sandia had made for years now seemed questionable. They’d been made without much empirical evidence.

Instead of basing weapon safety on probabilistic estimates, Stevens wanted to ground it in a thorough understanding of abnormal environments — and how the components of a nuclear weapon would behave in them. During a single accident a weapon might be crushed, burned, and struck by debris, at a wide range of temperatures and velocities. The interplay among those factors was almost impossible to quantify or predict, and no two accidents would ever be exactly the same. But he thought that good engineering could invent safety devices that would always respond predictably.

Bill Stevens hired half a dozen staff members to explore how to make nuclear weapons safer. Stan Spray was one of the first Sandia engineers to be recruited, and he soon led the research on abnormal environments. Spray had been concerned about weapon safety for years. While visiting the Naval Ordnance Test Station near Cape Canaveral, Florida, he’d watched a bent pin nearly detonate an atomic bomb during a routine test. The accident could have obliterated a large stretch of the Florida coast. In the early 1960s Spray investigated a series of electrical faults in nuclear weapons, analyzing more than a dozen anomalous events prompted by crashes, handling mistakes, and design errors. He had a rare ability to focus intently on a problem for hours, to the exclusion of almost everything around him, until it was solved.

Spray and his team began to gather components from existing weapons and subject them to every kind of abuse that might be encountered in an abnormal environment. It helped that Sandia had the world’s largest lightning simulator. Ever since Donald Hornig babysat the first nuclear device during a lightning storm, the night before the Trinity test, various forms of electromagnetic radiation had been considered a potential trigger of accidental detonations. The Navy tested many of its weapons by placing them, unarmed, on the deck of an aircraft carrier, turning on all the ship’s radars and communications equipment, and waiting to see if anything happened. The electroexplosive squibs of a Navy missile detonated during one of those shipboard tests — and similar squibs were used in some nuclear weapons. By 1968 at least seventy missiles with nuclear warheads had already been involved in lightning accidents. Lightning had struck a fence at a Mace medium-range missile complex, traveled more than a hundred yards along the fence, damaged three of the eight missiles, and knocked out the power to the site. Each missile carried a Mark 28 thermonuclear warhead.

Four Jupiter missiles in Italy had also been hit by lightning. Some of their thermal batteries fired, and in two of the warheads, tritium gas was released into their cores, ready to boost a nuclear detonation. The weapons weren’t designed to sit atop missiles, exposed to the elements, for days at a time. They lacked safety mechanisms to protect against lightning strikes. Instead of removing the warheads or putting safety devices inside them, the Air Force surrounded its Jupiter sites with tall metal towers to draw lightning away from the missiles.

Stan Spray’s group ruthlessly burned, scorched, baked, crushed, and tortured weapon components to find their potential flaws. And in the process Spray helped to overturn the traditional thinking about electrical circuits at Sandia. It had always been taken for granted that if two circuits were kept physically apart, if they weren’t mated or connected in any way — like separate power lines running beside a highway — current couldn’t travel from one to the other. In a normal environment, that might be true. But strange things began to happen when extreme heat and stress were applied.

When circuit boards were bent or crushed, circuits that were supposed to be kept far apart might suddenly meet. The charring of a circuit board could transform its fiberglass from an insulator into a conductor of electricity. The solder of a heat-sensitive fuse was supposed to melt when it reached a certain temperature, blocking the passage of current during a fire. But Spray discovered that solder behaved oddly once it melted. As a liquid it could prevent an electrical connection — or flow back into its original place, reconnect wires, and allow current to travel between them.

The unpredictable behavior of materials and electrical circuits during an accident was compounded by the design of most nuclear weapons. Although fission and fusion were radically new and destructive forces in warfare, the interior layout of bombs hadn’t changed a great deal since the Second World War. The wires from different components still met in a single junction box. Wiring that armed the bomb and wiring that prevented it from being armed often passed through the same junction — making it possible for current to jump from one to the other. And the safety devices were often located far from the bomb’s firing set. The greater the distance between them, Spray realized, the greater the risk that stray electricity could somehow enter an arming line, set off the detonators, and cause a nuclear explosion.

By 1970 the Nuclear Safety Department had come up with an entirely new approach to preventing accidental nuclear detonations. Three basic safety principles had been derived from its research — and each would be assured by a different mechanism or component inside a weapon. The first principle was incompatibility: there had to be a unique arming signal that couldn’t be sent by a short circuit or a stray wire. The second principle was isolation: the firing set and the detonators had to be protected behind a physical barrier that would exclude fire, electricity, and electromagnetic energy, that couldn’t be easily breached, and that would allow only the unique arming signal to enter it. The third principle was inoperability: the firing set had to contain a part that would predictably and irreversibly fail in an abnormal environment. That part was called a “weak link.” The hardened barrier was called a “strong link,” and combined with a unique arming signal, they promised a level of nuclear weapon safety that would meet or exceed Walske’s one-in-a-million standard.

Another Sandia safety effort was being concluded at roughly the same time. Project Crescent had set out to design a “supersafe” bomb — one that wouldn’t detonate “under any conceivable set of accident conditions” or spread plutonium, even after being mistakenly dropped from an altitude of forty thousand feet. At first, the Air Force was “less than enthusiastic about requiring more safety in nuclear weapons,” according to a classified memo on the project. But the Air Force eventually warmed to the idea; a supersafe bomb might permit the resumption of the Strategic Air Command’s airborne alert. After more than two years of research, Project Crescent proposed a weapon design that — like a concept car at an automobile show — was innovative but impractical. To prevent the high explosives from detonating and scattering plutonium after a plane crash, the bomb would have a thick casing and a lot of interior padding. Those features would make it three to four times heavier than most hydrogen bombs. The additional weight would reduce the number of nuclear weapons that a B-52 could carry — and that’s why the supersafe bomb was never built.

BOB PEURIFOY BECAME THE DIRECTOR of weapon development at Sandia-Albuquerque in September 1973. He’d closely followed the work of engineers in the safety department and shared many of their frustrations with the bureaucratic mind-set at the lab. Nothing had been done about the problems that they’d discovered. Bill Stevens had traveled to Washington, D.C., three years earlier, briefed the Military Liaison Committee to the AEC on the dangers of abnormal environments, and described the weak link/strong link technology that could minimize them. The committee took no action. The Department of Defense was preoccupied with the war in Vietnam, a Broken Arrow hadn’t occurred since Thule, and a familiar complacency once again settled upon the whole issue of nuclear weapon safety.

After taking the new job, Peurifoy made a point of reading the classified reports on every Broken Arrow and major weapon accident, a lengthy catalog of fires, crashes, and explosions, of near misses and disasters narrowly averted. The fact that an accidental detonation had not yet happened, that a major city had not yet been blanketed with plutonium, offered little comfort. The probabilities remained unknown. What were the odds of a screwdriver, used to repair an alarm system, launching the warhead off a missile, the odds of a rubber seat cushion bringing down a B-52? After reading through the accident reports, Peurifoy reached his own conclusion about the safety of America’s nuclear weapons: “We are living on borrowed time.”

Peurifoy had recently heard about an explosive called 1,3,5-triamino-2,4,6-trinitrobenzene (TATB). It had been invented in 1888 but had been rarely used since then — because TATB was so hard to detonate. Under federal law, it wasn’t even classified as an explosive; it was considered a flammable solid. With the right detonators, however, it could produce a shock wave almost as strong as the high explosives that surrounded the core of a nuclear weapon. TATB soon became known as an “insensitive high explosive.” You could drop it, hammer it, set it on fire, smash it into the ground at a speed of 1,500 feet per second, and it still wouldn’t detonate. The explosives being used in America’s nuclear weapons would go off from an impact one tenth as strong. Harold Agnew was now the director of Los Alamos, and he thought using TATB in hydrogen bombs made a lot more sense — as a means of preventing plutonium dispersal during an accident — than adding two or three thousand extra pounds of steel and padding.

All the necessary elements for nuclear weapon safety were now available: a unique signal, weak link/strong link technology, insensitive high explosives. The only thing missing was the willingness to fight a bureaucratic war on their behalf — and Bob Peurifoy had that quality in abundance. He was no longer a low-level employee, toiling away on the electrical system of a bomb, without a sense of the bigger picture. As the head of weapon development, he now had some authority to make policy at Sandia. And he planned to take advantage of it. Three months into the new job, Peurifoy told his superior, Glenn Fowler, a vice president at the lab, that all the nuclear weapons carried by aircraft had to be retrofitted with new safety devices. Peurifoy didn’t claim that the weapons were unsafe; he said their safety could no longer be presumed. Fowler listened carefully to his arguments and agreed. A briefing for Sandia’s upper management was scheduled for February 1974.

The briefing did not go well. The other vice presidents at Sandia were indifferent, unconvinced, or actively hostile to Peurifoy’s recommendations. The strongest opponents of a retrofit argued that it would harm the lab’s reputation — it would imply that Sandia had been wrong about nuclear weapon safety for years. They said new weapons with improved safety features could eventually replace the old ones. And they made clear that the lab’s research-and-development money would not be spent on bombs already in the stockpile. Sandia couldn’t force the armed services to alter their weapons, and the Department of Defense had the ultimate responsibility for nuclear weapon safety. The lab’s upper management said, essentially, that this was someone else’s problem.

In April 1974, Peurifoy and Fowler went to Washington and met with Major General Ernest Graves, Jr., a top official at the Atomic Energy Commission, whose responsibilities included weapon safety. Sandia reported to the AEC, and Peurifoy was aiming higher on the bureaucratic ladder. Graves listened to the presentation and then did nothing about it. Five months later, unwilling to let the issue drop and ready to escalate the battle, Peurifoy and Fowler put their concerns on the record. A letter to General Graves was drafted — and Glenn Fowler placed his career at risk by signing and sending it. The “Fowler Letter,” as it was soon called, caused a top secret uproar in the nuclear weapon community. It ensured that high-level officials at the weapons labs, the AEC, and the Pentagon couldn’t hide behind claims of plausible deniability, if a serious accident happened. The letter was proof that they had been warned.

“Most of the aircraft delivered weapons now in stockpile were designed to requirements which envisioned… operations consisting mostly of long periods of igloo storage and some brief exposure to transportation environments,” the Fowler letter began. But these weapons were now being used in ways that could subject them to abnormal environments. And none of the weapons had adequate safety mechanisms. Fowler described the “possibility of these safing devices being electrically bypassed through charred organic plastics or melted solder” and warned of their “premature operation from stray voltages and currents.” He listed the weapons that should immediately be retrofitted or retired, including the Genie, the Hound Dog, the 9-megaton Mark 53 bomb — and the weapons that needed to be replaced, notably the Mark 28, SAC’s most widely deployed bomb. He said that the secretary of defense should be told about the risks of using these weapons during ground alerts. And Fowler recommended, due to “the urgency associated with the safety question,” that nuclear weapons should be loaded onto aircraft only for missions “absolutely required for national security reasons.”

The scope of the Fowler Letter had deliberately been limited to the weapons whose safety devices were Sandia’s responsibility — mainly bombs carried by airplanes. The Army, the Navy, and the Air Force were responsible for the arming and fuzing mechanisms of the nuclear warheads carried by their missiles. And the safety of those warheads in an abnormal environment was even more questionable than the safety of the bombs. The batteries, accelerometers, barometric switches, and safety devices weren’t located inside the warhead of a ballistic missile. They were in an adaptation kit a few feet beneath it — which meant the arming wires traveled a good distance to the detonators. That distance made it easier for stray voltage to enter the wires. And the missile was constantly linked to sources of electrical power inside the silo. In 1974 the oldest nuclear warhead deployed on a ballistic missile was also the most powerful, the W-53 atop the Titan II, designed in the late 1950s. Tucked away inside a silo, the W-53 was less likely to encounter abnormal environments than a bomb. But how the warhead would respond to them was less clearly understood.