Command and Control

EPILOGUE

The sociologist Charles B. Perrow began his research on dangerous technologies in August 1979, after the partial meltdown of the core at the Three Mile Island nuclear power plant. In the early minutes of the accident, workers didn’t realize that the valves on the emergency coolant pipes had mistakenly been shut — one of the indicator lights on the control panel was hidden by a repair tag. Perrow soon learned that similar mistakes had occurred during the operation of other nuclear power plants. At a reactor in Virginia, a worker cleaning the floor got his shirt caught on the handle of a circuit breaker on the wall. He pulled the shirt off it, tripped the circuit breaker, and shut down the reactor for four days. A lightbulb slipped out of the hand of a worker at a reactor in California. The bulb hit the control panel, caused a short circuit, turned off sensors, and made the temperature of the core change so rapidly that a meltdown could have occurred. After studying a wide range of “trivial events in nontrivial systems,” Perrow concluded that human error wasn’t responsible for these accidents. The real problem lay deeply embedded within the technological systems, and it was impossible to solve: “Our ability to organize does not match the inherent hazards of some of our organized activities.” What appeared to be the rare exception, an anomaly, a one-in-a-million accident, was actually to be expected. It was normal.

Perrow explored the workings of high-risk systems in his book Normal Accidents, focusing on the nuclear power industry, the chemical industry, shipping, air transportation, and other industrial activities that could harm a large number of people if something went wrong. Certain patterns and faults seemed common to all of them. The most dangerous systems had elements that were “tightly coupled” and interactive. They didn’t function in a simple, linear way, like an assembly line. When a problem arose on an assembly line, you could stop the line until a solution was found. But in a tightly coupled system, many things occurred simultaneously — and they could prove difficult to stop. If those things also interacted with each other, it might be hard to know exactly what was happening when a problem arose, let alone know what to do about it. The complexity of such a system was bound to bring surprises. “No one dreamed that when X failed, Y would also be out of order,” Perrow gave as an example, “and the two failures would interact so as to both start a fire and silence the fire alarm.”

Dangerous systems usually required standardized procedures and some form of centralized control to prevent mistakes. That sort of management was likely to work well during routine operations. But during an accident, Perrow argued, “those closest to the system, the operators, have to be able to take independent and sometimes quite creative action.” Few bureaucracies were flexible enough to allow both centralized and decentralized decision making, especially in a crisis that could threaten hundreds or thousands of lives. And the large bureaucracies necessary to run high-risk systems usually resented criticism, feeling threatened by any challenge to their authority. “Time and time again, warnings are ignored, unnecessary risks taken, sloppy work done, deception and downright lying practiced,” Perrow found. The instinct to blame the people at the bottom not only protected those at the top, it also obscured an underlying truth. The fallibility of human beings guarantees that no technological system will ever be infallible.

AFTER SERVING AS A CONSULTANT to the Joint Chiefs of Staff on strategic nuclear policy, Scott D. Sagan applied “normal accident” theory to the workings of the American command-and-control system during the Cuban Missile Crisis. According to Sagan, now a professor of political science at Stanford University, the crisis was the most severe test of that system during the Cold War, “the highest state of readiness for nuclear war that U.S. military forces have ever attained and the longest period of time (thirty days) that they have maintained an alert.” Most historians attributed the peaceful resolution of the crisis to decisions made by John F. Kennedy and Nikita Khrushchev — to the rational behavior of leaders controlling their military forces. But that sense of control may have been illusory, Sagan argued in The Limits of Safety, and the Cuban Missile Crisis could have ended with a nuclear war, despite the wishes of Khrushchev and Kennedy.

With hundreds of bombers, missiles, and naval vessels prepared to strike, the risk of accidents and misunderstandings was ever present. At the height of the confrontation, while Kennedy and his advisers were preoccupied with the Soviet missiles in Cuba, an Atlas long-range missile was test-launched at Vandenberg Air Force Base, without the president’s knowledge or approval. Other missiles at Vandenberg had already been placed on alert with nuclear warheads — and the Soviet Union could have viewed the Atlas launch as the beginning of an attack. The Jupiter missiles in Turkey were an issue of great concern to Secretary of Defense Robert McNamara throughout the crisis. McNamara ordered American troops to sabotage the missiles if Turkey seemed ready to launch them. But he was apparently unaware that nuclear weapons had been loaded onto fighter planes in Turkey. The control of those weapons was “so loose, it jars your imagination,” Lieutenant Colonel Robert B. Melgard, the commander of the NATO squadron, told Sagan. “In retrospect,” Melgard said, “there were some guys you wouldn’t trust with a .22 rifle, much less a thermonuclear bomb.”

During one of the most dangerous incidents, Major Charles Maultsby, the pilot of an American U-2 spy plane, got lost and inadvertently strayed into Soviet airspace. His mistake occurred on October 27, 1962 — the same day as the Atlas missile launch and the shooting down of a U-2 over Cuba. Maultsby was supposed to collect air samples above the North Pole, seeking radioactive evidence of a Soviet nuclear test. But the flight path was new, the aurora borealis interfered with his attempt at celestial navigation, and Maultsby soon found himself flying over Siberia, pursued by Soviet fighter planes. The U-2 ran out of fuel, and American fighters took off to escort Maultsby back to Alaska. Under the DEFCON 3 rules of engagement, the American fighter pilots had the authority to fire their atomic antiaircraft missiles and shoot down the Soviet planes. A dogfight between the two air forces was somehow avoided, the U-2 landed safely — and McNamara immediately halted the air sampling program. Nobody at the Pentagon had considered the possibility that these routine U-2 flights could lead to the use of nuclear weapons.

America’s command-and-control system operated safely during the crisis, Sagan found, and yet “numerous dangerous incidents… occurred despite all the efforts of senior authorities to prevent them.” He’d long believed that the risk of nuclear weapon accidents was remote, that nuclear weapons had been “a stabilizing force” in international relations, reducing the risk of war between the United States and the Soviet Union. “Nuclear weapons may well have made deliberate war less likely,” Sagan now thought, “but, the complex and tightly coupled nuclear arsenal we have constructed has simultaneously made accidental war more likely.” Researching The Limits of Safety left him feeling pessimistic about our ability to control high-risk technologies. The fact that a catastrophic accident with a nuclear weapon has never occurred, Sagan wrote, can be explained less by “good design than good fortune.”

THE TITAN II EXPLOSION at Damascus was a normal accident, set in motion by a trivial event (the dropped socket) and caused by a tightly coupled, interactive system (the fuel leak that raised the temperature in the silo, making an oxidizer leak more likely). That system was also overly complex (the officers and technicians in the control center couldn’t determine what was happening inside the silo). Warnings had been ignored, unnecessary risks taken, sloppy work done. And crucial decisions were made by a commanding officer, more than five hundred miles from the scene, who had little firsthand knowledge of the system. The missile might have exploded no matter what was done after its stage 1 fuel tank began to leak. But to blame the socket, or the person who dropped it, for that explosion is to misunderstand how the Titan II missile system really worked. Oxidizer leaks and other close calls plagued the Titan II until the last one was removed from a silo, northwest of Judsonia, Arkansas, in June 1987. None of those leaks and accidents led to a nuclear disaster. But if one had, the disaster wouldn’t have been inexplicable or hard to comprehend. It would have made perfect sense.

The nuclear weapon systems that Bob Peurifoy, Bill Stevens, and Stan Spray struggled to make safer were also tightly coupled, interactive, and complex. They were prone to “common-mode failures” — one problem could swiftly lead to many others. The steady application of high temperature to the surface of a Mark 28 bomb could disable its safety mechanisms, arm it, and then set it off. “Fixes, including safety devices, sometimes create new accidents,” Charles Perrow warned, “and quite often merely allow those in charge to run the system faster, or in worse weather, or with bigger explosives.” Perrow was not referring to the use of sealed-pit weapons during SAC’s airborne alerts. But he might as well have been. Promoted as being much safer than the weapons they replaced, the early sealed-pit bombs posed a grave risk of accidental detonation and plutonium scattering. Normal accident theory isn’t a condemnation of modern technological systems. But it calls for more humility in how we design, build, and operate them.

The title of an influential essay on the role of technology in society asked the question: “Do Artifacts Have Politics?” According to its author, Langdon Winner, the answer is yes — the things that we produce are not only shaped by social forces, they also help to mold the political life of a society. Some technologies are flexible and can thrive equally well in democratic or totalitarian countries. But Winner pointed to one invention that could never be managed with a completely open, democratic spirit: the atomic bomb. “As long as it exists at all, its lethal properties demand that it be controlled by a centralized, rigidly hierarchical chain of command closed to all influences that might make its workings unpredictable,” Winner wrote. “The internal social system of the bomb must be authoritarian; there is no other way.”

Secrecy is essential to the command and control of nuclear weapons. Their technology is the opposite of open-source software. The latest warhead designs can’t be freely shared on the Internet, improved through anonymous collaboration, and productively used without legal constraints. In the years since Congress passed the Atomic Energy Act of 1946, the design specifications of American nuclear weapons have been “born secret.” They are not classified by government officials; they’re classified as soon as they exist. And intense secrecy has long surrounded the proposed uses and deployments of nuclear weapons. It is intended to keep valuable information away from America’s enemies. But an absence of public scrutiny has often made nuclear weapons more dangerous and more likely to cause a disaster.

Again and again, safety problems were hidden not only from the public but also from the officers and enlisted personnel who handled nuclear weapons every day. The strict, compartmentalized secrecy hid safety problems from the scientists and engineers responsible for weapon safety. Through the Freedom of Information Act, I obtained a document that listed the “Accidents and Incidents Involving Nuclear Weapons” from the summer of 1957 until the spring of 1967. It was 245 pages long. It gave brief accounts of the major Broken Arrows during that period. It also described hundreds of minor accidents, technical glitches, and seemingly trivial events: a Genie antiaircraft missile released from a fighter plane by mistake and dropped onto a weapon trailer; a Boar missile crushed by the elevator of an aircraft carrier; a Mark 49 warhead blown off a Jupiter missile when explosive bolts detonated due to corrosion; smoke pouring from a W-31 warhead atop a Nike missile after a short circuit; the retrorockets of a Thor missile suddenly firing at a launch site in Great Britain and startling the crew; a Mark 28 bomb emitting strange sounds, for reasons that were never discovered. I shared the document with Bob Peurifoy and Bill Stevens — who’d never seen it. Both were upset after reading it. The Defense Atomic Support Agency had never told them about hundreds of accidents.

The United States was often more successful at keeping secrets from its own weapon designers than at keeping them from the Soviet Union. Beginning with the Soviet infiltration of the Manhattan Project, through the John Walker spy ring — which from the late 1960s until 1985 provided about a million documents on the Pentagon’s war plans, codes, and submarine technology to the Soviets — the leadership in the Kremlin knew a lot more about the nuclear capabilities of the United States than the American people were ever allowed to know. One of the most important secrets of the Cold War was considered so secret that the president of the United States wasn’t allowed to know it. Harry Truman was deliberately never told that Army cryptologists had broken Soviet codes and deciphered thousands of messages about espionage within the United States. But the Soviet Union learned the secret, when one of its spies, the British double agent Kim Philby, was given a tour of the Army’s Signal Intelligence Service headquarters.

The need to protect national security has long been used as a justification for hiding things to avoid embarrassment. “Secrecy is a form of government regulation,” a Senate commission, headed by Daniel Patrick Moynihan, said in 1997. “What is different with secrecy is that the public cannot know the extent or the content of the regulation.” To this day, the classification decisions at the Department of Defense and the Department of Energy have an arbitrary, often Kafkaesque quality. Cold War documents that were declassified in the 1990s were later reclassified — making it illegal to possess them, even though the federal government once released them.

In many of the documents that I obtained through the Freedom of Information Act, the redactions by government censors made little sense. Exactly the same information would be supplied in one document, yet blacked out in another. The government still won’t reveal the yield of the Titan II’s warhead — even though the weapon hasn’t been in the American arsenal for almost a quarter of a century, the Soviet Union no longer exists, and Soviet espionage discovered everything remotely interesting about the missile.

The operational details of nuclear weapons might seem like the kind of information that should always be kept secret. And yet throughout the Cold War, news reports about Broken Arrows and other nuclear weapon problems forced the Pentagon to adopt new safety measures. Bad publicity influenced the decision to lock hydrogen bombs securely inside bombers during takeoffs and landings, to end SAC’s airborne alert, retire the Titan II missile, remove Short-Range Attack Missiles from aircraft on ground alert. Too much secrecy often threatened the national security far more than revelations about America’s nuclear arsenal.

A detailed account of the nuclear weapon accidents in the Soviet Union has never been published. The absence of a free press no doubt contributed to the many large-scale industrial accidents and widespread environmental devastation that occurred in the Soviet bloc. Chelyabinsk-65, the site of a nuclear weapon facility in central Russia, has been called “arguably the most polluted spot on the planet.” A massive explosion there in 1957 contaminated hundreds of square miles with highly radioactive fallout. Countless accidents occurred at the plant, and tens of thousands of people were exposed to harmful levels of radiation. Soviet nuclear technology was, for the most part, inferior to that of the West. But the authoritarian rule of the Soviet Union was especially well suited to the demands of nuclear command and control. Unlike the president of the United States — who predelegated the authority to use nuclear weapons not only to SAC generals and Air Force fighter pilots but also to NATO officers in Europe — the leadership of the Communist Party and the Soviet general staff strictly retained that sort of power. Locks of various kinds were placed on Soviet weapons, and the permission to unlock them came only from the top. According to Bruce Blair, a leading command-and-control expert, Soviet safeguards against unauthorized use were “more stringent than those of any other nuclear power, including the United States.”

The rigidly centralized command structure, however, made the Soviet Union quite vulnerable to a decapitation attack. Despite all the underground bunkers and secret railways built in and around Moscow, Soviet leaders constantly worried about their ability to retaliate after an American first strike. Instead of loosening their control of nuclear weapons and shifting authority further down the chain of command, they automated the decision to use nuclear weapons. In 1974, little more than a decade after the release of Dr. Strangelove, the Soviet Union began work on the “Perimeter” system — a network of sensors and computers that could launch intercontinental ballistic missiles without any human oversight. Completed in 1985, it was known as the “dead hand.” The Soviet general staff planned to activate Perimeter if an American attack seemed imminent. The system would retaliate automatically, firing long-range missiles if it detected nuclear explosions on Russian soil. Perimeter greatly reduced the pressure to launch on warning at the first sign of an American attack. It gave Soviet leaders more time to investigate the possibility of a false alarm, confident that a real attack would trigger a computer-controlled, devastating response. But it rendered American plans for limited war meaningless; the Soviet computers weren’t programmed to allow pauses for negotiation. And the deterrent value of Perimeter was wasted. Like the doomsday machine in Dr. Strangelove, the system was kept secret from the United States.

IN MARCH 1991, three months after the Drell panel submitted its report to Congress, Bob Peurifoy retired from Sandia. He had no more tolerance for the bureaucratic warfare and petty slights, the disrespect from Sandia’s upper management. More important, his goals had been achieved. Congress, the weapons laboratories, the Pentagon, and the Department of Energy all agreed that the safety of America’s nuclear weapons had to be improved. Weak link/strong link devices were put into every nuclear weapon. And other safety technologies — insensitive high explosives, nuclear cores encased in a fire-resistant shell — were to be included in every new design. The changes in the stockpile that Peurifoy had sought for decades, once dismissed as costly and unnecessary, were now considered essential. Building a nuclear weapon without these safety features had become inconceivable.

Sidney Drell regards Bob Peurifoy as one of the leading, though largely unacknowledged, figures in the history of nuclear technology. He thinks that Peurifoy’s achievements rank alongside those of Admiral Hyman G. Rickover, who pioneered the safe use of nuclear propulsion for the U.S. Navy. And yet Peurifoy told me, on many occasions, that he regrets not having been braver, especially about the safety problems with the Mark 28 bomb. He’d chosen to work within the system, despite his strong opposition to many of its practices. Although he was critical of the way in which official secrecy has been used to cover up mistakes, he’d honorably obeyed its code. As we sat in the sunroom of Peurifoy’s modest home, with a lovely view of the Texas hill country, talking for hours about his work to improve nuclear weapon safety, his wife, Barbara, listened attentively. Despite a close, loving marriage that had lasted for sixty years, he’d kept these details to himself, never sharing the weight of that dark knowledge with Barbara or their children.

Within a year of Peurifoy’s retirement, the nuclear weapon community that had long ignored, dismissed, and opposed him became outspoken in defense of his cause. The Comprehensive Nuclear Test Ban Treaty was being discussed at the United Nations. The treaty prohibited the sort of underground nuclear detonations that the United States and other countries needed to develop new weapons. A ban on these tests was, in many respects, a ban on new weapons — since no military would place its faith in a warhead or bomb that had never been proven to work. During a Senate debate on the treaty in August 1992, the opponents of a test ban came up with a novel rationale for continuing to detonate nuclear weapons.

“Why is testing of nuclear weapons so important?” asked one senator, a close ally of the Pentagon and the weapons laboratories. “It is so important because nuclear weapons, even today’s nuclear weapons, represent a great danger to the American public and to the world because of the lack of safety of their devices.” He then put a list of Broken Arrows into the Congressional Record. Another senator opposing the treaty claimed that “we already know that science and technology cries out for safety modifications.” A third attacked the Department of Energy for its negligence on safety issues over the years, warning: “A vote to halt nuclear testing today is a vote to condemn the American people to live with unsafe nuclear weapons in their midst for years and years — indeed, until nuclear weapons are eliminated.”

In 1996 the United States became the first country to sign the Comprehensive Nuclear Test Ban Treaty, and since then more than 180 other nations have signed it, too. But the U.S. Senate voted against ratifying the treaty in 1999. Once again, the treaty’s opponents argued that nuclear tests might be necessary to ensure that the American stockpile remains safe and reliable. During the administration of President George W. Bush, the Pentagon and the weapons laboratories supported the development of a new nuclear weapon, the Reliable Replacement Warhead (RRW). It would be safer, more secure, and more reliable than current weapons, the administration promised. The RRW would also be the first “green” nuclear weapon — designed to avoid the use of beryllium, a toxic environmental contaminant.

Bob Peurifoy has been bemused by the newfound passion for nuclear weapon safety and security among his former critics. He sees no need for more weapon tests, supports the test ban treaty, and thinks it would be highly irresponsible to add a new weapon like the RRW to the stockpile without having detonated it first. The plans to develop new warheads and bombs, Peurifoy says, are just “a money grab” by the Pentagon and the weapons laboratories. The yield-to-weight ratio of America’s nuclear weapons became asymptotic — approached their mathematical upper limit — around 1963. New designs won’t make detonations any more efficient. And a study by JASON scientists concluded that the cores of existing weapons will be good for at least another hundred years. Although the boosting gas and neutron generators within the weapons deteriorate with age, they can be replaced through programs currently managed by the Department of Energy. Harold Agnew, the former head of Los Alamos who championed one-point safety and permissive action links, agrees with Peurifoy. Agnew says that the idea of introducing a new weapon without testing it is “nonsense.” And he opposes any additional tests.

The only weapons in today’s stockpile that trouble Peurifoy are the W-76 and W-88 warheads carried by submarine-launched Trident II missiles. The Drell panel expressed concern about these warheads more than twenty years ago. Both of them rely on conventional high explosives, instead of insensitive high explosives. The Navy had insisted upon use of the more dangerous explosive to reduce the weight of the warheads, increase their range, and slightly increase their yield. The decision was unfortunate from a safety perspective, because the multiple warheads of a Trident II don’t sit on top of the missile. They surround the rocket motor of its third stage, as a space-saving measure. And the Navy chose a high-energy propellant for the rocket motor that’s much more likely to explode in an accident — simply by being dropped or struck by a bullet — than other solid fuels. A Trident submarine has as many as twenty-four of these missiles, each carrying between four to five warheads. An accident with one missile could detonate the third-stage propellant, set off the high explosives of the warheads, and spread a good deal of plutonium around the ports in Georgia and Washington State where Trident submarines are based.

For years the Navy has resisted changing the third-stage rocket propellant of the Trident II missile or using the W-87 warhead — which is almost identical to the W-88 but employs a safer insensitive high explosive. Using a less energetic propellant would decrease the missile’s range by perhaps 4 percent, and the W-87 warhead has a slightly lower yield. Parochial concerns may also be a factor in the Navy’s attachment to the W-88. That warhead was designed for the Navy by Los Alamos; the W-87, by Lawrence Livermore for the Air Force.

The best way to load a Trident II missile onto a submarine is one of the few areas of disagreement between Sidney Drell and Bob Peurifoy. Drell endorses the Navy’s current method: load the missile first, then attach the warheads. Peurifoy prefers another method: put fully assembled missiles into the launch tubes. The difference between the two opinions may seem esoteric, and yet the potential consequences of an accident are beyond dispute: a missile explosion inside a submarine with as many as 144 nuclear warheads.

TODAY’S UNITED STATES AIR FORCE bears little resemblance to the Air Force of the 1970s. The arms buildup during the Reagan administration greatly increased spending on new aircraft, new weapons, spare parts, and better training. Morale improved and illegal drug use plummeted, thanks to widespread testing. A cultural shift occurred, as well. While serving as head of the Tactical Air Command from 1978 until 1984, General Wilbur L. Creech had the same sort of lasting influence on the Air Force that Curtis LeMay once exerted. But Creech promoted a fundamentally different type of leadership — the adaptive, decentralized, independent thinking of the fighter pilot. By the early 1980s the bomber generals had been driven from power, and the leading staff positions at the Air Force were filled with fighter generals. The new tactics, equipment, and esprit de corps transformed its performance in battle. During the Vietnam War, 1,737 Air Force planes were shot down. During the past quarter century of air campaigns over Iraq, Kuwait, Kosovo, Libya, and Afghanistan, the Air Force has lost fewer than 30 planes to enemy fire.

The Air Force’s focus on tactical warfare, however, led to severe neglect of its strategic mission. Nuclear weapons seemed largely irrelevant after the Cold War, and ambitious officers wanted nothing to do with them. The United States Strategic Command not only combined the nuclear arsenals of the Air Force and the Navy, it also assumed control of numerous conventional missions: missile defense, intelligence and reconnaissance, space operations, cyber warfare. After the Strategic Air Command was dismantled, the Air Force no longer had an organization solely devoted to maintaining nuclear weapons and planning for their use. The no-notice inspections and black hat exercises that LeMay thought indispensable were ended. Nuclear weapon units were now given seventy-two hours of warning before an inspection. And instead of a four-star general commanding the Air Force’s strategic assets, a captain or a colonel became the highest-ranking officer in charge of daily nuclear operations. The lack of interest in the subject began to show.

In 2003 half of the Air Force units responsible for nuclear weapons failed their safety inspections — despite the three-day advance warning. In August 2006 the nose-cone fuze assemblies of four Minuteman III missiles were inadvertently shipped from Hill Air Force Base in Utah to Taiwan. Workers at the Defense Logistics Agency thought they were helicopter batteries. The top secret nuclear-weapon fuzes sat in unopened boxes for two years, until Taiwanese officials discovered the error. On August 29, 2007, six cruise missiles armed with nuclear warheads were mistakenly loaded onto a B-52 bomber named Doom 99 at Minot Air Force Base in North Dakota. The plane sat on the tarmac at Minot overnight without any armed guards, took off the next morning, flew almost fifteen hundred miles to Barksdale Air Force Base in Louisiana — violating the safety rule that prohibits nuclear weapons from being transported by air over the United States — landed at Barksdale, and sat on the tarmac there for nine hours, unguarded, until a maintenance crew noticed the warheads. For a day and a half, nobody in the Air Force realized that half a dozen thermonuclear weapons were missing.

The Defense Science Board later conducted an investigation of the safety and security lapses at Minot. It found a serious breakdown in command and control. Cruise missiles armed with nuclear warheads were being stored in the same bunker as those armed with conventional or training warheads. Verification checklists were routinely ignored to save time. On the day of the incident, the breakout crew that initially entered the bunker, the convoy crew that drove the cruise missiles to the B-52, the load crew that placed them on the bomber, and the aircrew that flew the plane were all supposed to check whether the missiles were carrying nuclear warheads. None of the crews did. After interviewing them, the Defense Science Board noted a basic lack of understanding about who had the authority to remove weapons from the bunker — and “significant confusion about delegation of responsibility and authority for movement of nuclear weapons.” Nobody seemed to know who was in charge. And nobody was ever asked to sign a piece of paper recording the movement of nuclear weapons or acknowledging the transfer of custody from one Air Force unit to another. Paper would be necessary for that sort of record keeping — unlike packages shipped by Federal Express, the weapons had serial numbers that had to be written down, not bar codes that could be scanned.

On May 28, 2008, the Air Force discovered another safety problem. A maintenance team arrived at a Minuteman III silo near F. E. Warren Air Force Base in Wyoming and found the walls covered with soot. A fire had started in an equipment room, melting a shotgun case, part of a shotgun, and the shotgun shells stored there. Heat from the flames had damaged one of the electrical cables attached to the Minuteman III. The fire had extinguished itself — but hadn’t been detected by the smoke alarm at the site. The launch crew in its control center miles away never received any indication that the missile might be at risk. The fire was most likely caused by a lightning strike or an improperly installed battery charger. And it may have occurred five days before the maintenance team noticed the soot.

The Global Strike Command was created in 2009 to improve the management of the Air Force’s nuclear weapons. The command assumed responsibility for the remaining Minuteman III missiles, as well as the B-2 and B-52 bombers that still have nuclear missions. It is a successor to the Strategic Air Command, though smaller and less influential, with the same narrow focus on maintaining deterrence and fighting a nuclear war. Among other reforms, the new command has recently introduced “unique identifiers” for its nuclear weapons — bar codes that will allow them to be tracked. The Global Strike Command hopes to instill the same sort of dedication, motivation, and attention to detail that SAC long possessed. But the Air Force emphasis on tactical warfare has left the new command with aging and expensive weapon systems. Each of its twenty B-2 bombers costs $2 billion, and no more will be produced. Its Minuteman III missiles were first deployed in 1970. And its B-52 bombers haven’t been manufactured since John F. Kennedy was president. The B-52s are scheduled to remain in service through the year 2040.

The age of these strategic weapons raises doubts about whether the Air Force will have a significant nuclear role in the future. At the moment, funding for new long-range missiles and bombers has not been approved. But the command-and-control mechanisms used by the Air Force, the Global Strike Command, and the other armed services are continually being upgraded. The World Wide Military Command and Control System was deactivated in 1996. Its mainframe computers had become hopelessly out of date. The WWMCCS was replaced by the Global Command and Control System and its various subsets: the Secret Internet Protocol Router Network, the Pentagon Global Information Grid, the Army LandWarNet, the Air Force Constellation Net, the Navy FORCENet, the Minimum Essential Communications Network, and the Defense Improved Emergency Message Automatic Transmission System Replacement Command and Control Terminal System. Known by the acronym DIRECT, it sends and receives the war order to use nuclear weapons. A DIRECT terminal looks like a desktop PC, circa 2003, with a round slot on the front for a metal key.

All of these military computer networks are far more technologically advanced than the gold telephone that used to connect General LeMay to the White House. But sometimes they experience a glitch. In October 2010 a computer failure at F. E. Warren Air Force Base knocked fifty Minuteman III missiles offline. For almost an hour, launch crews could not communicate with their missiles. One third of the Minuteman IIIs at the base had been rendered inoperable. The Air Force denied that the system had been hacked and later found the cause of the problem: a circuit card was improperly installed in one of the computers during routine maintenance. But the hacking of America’s nuclear command-and-control system remains a serious threat. In January 2013, a report by the Defense Science Board warned that the system’s vulnerability to a large-scale cyber attack had never been fully assessed. Testifying before Congress, the head of the U.S. Strategic Command, General C. Robert Kehler, expressed confidence that no “significant vulnerability” existed. Nevertheless, he said that an “end-to-end comprehensive review” still needed to be done, that “we don’t know what we don’t know,” and that the age of the command-and-control system might inadvertently offer some protection against the latest hacking techniques. Asked whether Russia and China had the ability to prevent a cyber attack from launching one of their nuclear missiles, Kehler replied, “Senator, I don’t know.”

Operation Neptune Spear, the raid that killed Osama bin Laden, was an extraordinarily complex military operation, and much of its success can be attributed to the Global Command and Control System. Personnel belonging to the Army, the Navy, the Air Force, and the CIA, as well as unmanned drones, secretly communicated with one another in real time. And details of the raid in Pakistan were simultaneously shared with President Barack Obama at the White House; CIA director Leon Panetta at the agency’s headquarters in Langley, Virginia; and Admiral William H. McRaven at a special operations base in Jalalabad, Afghanistan. The effectiveness of a command-and-control system in launching an attack, however, reveals little about how it will perform when under attack.

The 9/11 Commission Report offers a sobering account of the confusion, miscommunication, and parallel decision making that occurred at the highest levels of the government during an attack on the United States that lasted about seventy-eight minutes. President George W. Bush did not board Air Force One until almost an hour after the first hijacked airliner struck the World Trade Center. His calls to the Pentagon and the White House underground bunker were constantly dropped. Continuity of government measures weren’t implemented until more than an hour after the initial attack. Vice President Cheney ordered Air Force fighter planes to shoot down any hijacked airliners over Washington, D.C., and New York City, but the order was never received. The only fighter planes that got an authorization to fire their weapons belonged to the District of Columbia Air National Guard — and they were ordered into the air by a Secret Service agent, acting outside the chain of command, without Cheney’s knowledge. A command-and-control system designed to operate during a surprise attack that could involve thousands of nuclear weapons — and would require urgent presidential decisions within minutes — proved incapable of handling an attack by four hijacked airplanes.

AS OF THIS WRITING, the United States has approximately 4,650 nuclear weapons. About 300 are assigned to long-range bombers, 500 are deployed atop Minuteman III missiles, and 1,150 are carried by Trident submarines. An additional 200 or so hydrogen bombs are stored in Turkey, Belgium, Germany, Italy, and the Netherlands for use by NATO aircraft. About 2,500 nuclear weapons are held in reserve, mainly at the Kirtland Underground Munitions Maintenance and Storage Complex near Albuquerque, New Mexico. America’s current nuclear war plan, now known as the Operations Plan (OPLAN) 8010, has two official aims: “Strategic Deterrence and Global Strike.” Both seek to prevent an attack with weapons of mass destruction against the United States — one, with an implied threat; the other with an American first strike. While the attack options of the SIOP focused primarily on targets in the Soviet Union, the OPLAN enables the president to use nuclear weapons against Russia, China, North Korea, Syria, and Iran. “Adaptive planning” allows targets in other countries to be chosen at the last minute.

The United States now plans to spend as much as $180 billion, over the next twenty years, to maintain its nuclear weapons, run its weapon laboratories, and upgrade its uranium-processing facilities. The world’s other nuclear powers are behaving in much the same way. Russia has about 1,740 deployed strategic weapons and perhaps 2,000 tactical weapons. It plans to introduce a new long-range missile by the end of the decade. France is adding new aircraft and submarines to carry its roughly 300 weapons. The United Kingdom plans to obtain new Trident submarines for its approximately 160 warheads. China is thought to have about 240 nuclear weapons. It is building new cruise missiles, long-range missiles, and submarines to carry them. It has also constructed an “underground Great Wall” — thousands of miles of deeply buried tunnels, large enough to fit cars, trucks, and trains — in which to hide them. The size of China’s arsenal is not limited by any arms control treaties. After vowing for decades that nuclear weapons would be used only for retaliation after an enemy attack, China may be abandoning its “no-first-use” pledge. And a more aggressive Chinese strategy would increase the number of ballistic missiles, worldwide, that are ready to be fired at a moment’s notice — as well as the risk of mistakes.

The number of nuclear weapons possessed by Israel has never been revealed. Israel recently purchased submarines from Germany to deploy some of them and hopes in the near future to place others on long-range missiles. The nuclear programs of North Korea and Iran remain shrouded in mystery. Both may be seeking to deploy long-range missiles with nuclear warheads. North Korea may already have half a dozen nuclear weapons. Despite well-publicized threats to launch a nuclear attack on American cities, North Korea may not have the capability to destroy targets thousands of miles away. The technical proficiency of the world’s aspiring nuclear powers remains unknown. The yield of North Korea’s first weapon test was less than 1 kiloton. And Iraq’s nuclear weapon program, before it was halted, may have posed a greater threat to Baghdad than to Saddam Hussein’s enemies. “It could go off if a rifle bullet hit it,” one United Nations inspector said about the Iraqi weapon design. “I wouldn’t want to be around if it fell off the edge of this desk.”

The United States and Russia still maintain thousands of missiles on alert, ready to be launched within minutes. As tensions between the two countries have eased, the risk of an accidental war has diminished; but it has not disappeared. The targets of American missiles are no longer preprogrammed. They are transmitted right before launch, and the default setting of the missiles would send their warheads into the nearest ocean. The command-and-control systems of both countries, however, are still profoundly important. Russia has become far more dependent on land-based missiles than the United States — and, as a result, more vulnerable to a first strike. Any sign of a surprise attack must be taken seriously at the Kremlin. The ballistic-missile submarines in the Russian fleet are old, poorly maintained, and rarely leave their ports. The subs have become easy targets and no longer provide a secure retaliatory threat. The odds of the United States launching an all-out surprise attack on Russia’s nuclear forces are infinitesimal. But the pressure to maintain a launch-on-warning policy may be stronger now in Moscow than it was thirty years ago. And the reliability of the Russian early-warning system has declined considerably since the end of the Cold War.

On January 25, 1995, the launch of a small research rocket by Norway prompted a warning at the Kremlin that Russia was under attack by the United States. Russian nuclear forces went on full alert. President Boris Yeltsin turned on his “football,” retrieved his launch codes, and prepared to retaliate. After a few tense minutes, the warning was declared a false alarm. The weather rocket had been launched to study the aurora borealis, and Norway had informed Russia of its trajectory weeks in advance.

The greatest risk of nuclear war now lies in South Asia. The United States and the Soviet Union, for all their cultural differences, were separated by thousands of miles. Their animosity was more theoretical and geopolitical than personal. Pakistan and India are neighbors, embittered by religious and territorial disputes. Both countries have nuclear weapons. The flight time of a missile from one to the other may be as brief as four or five minutes. And the command-and-control facilities on both sides are not hardened against an attack. During a crisis, the pressure to launch first would be enormous.

Much like China, India for many years embraced a strategy of minimum deterrence, building a small arsenal of weapons and vowing to use them only in retaliation. But India may be moving toward a more aggressive strategy, too. Pakistan has doubled the size of its arsenal since 2006. It now has about 100 nuclear weapons. It is the only nuclear power whose weapons are entirely controlled by the military. And the Pakistan army has not ruled out using them first, even in response to an Indian attack with conventional weapons. To make that sort of deterrent credible, the authority to use tactical nuclear weapons has probably been given to lower-level Pakistani officers, much like the United States once predelegated it to NATO commanders on the front lines.

Instead of making a war between India and Pakistan less likely, nuclear weapons may have the opposite effect. For most of the Cold War, the status quo in Europe, the dividing line between East and West, was accepted by both sides. The border dispute in South Asia is far more volatile, with Pakistan seeking to dislodge India from Kashmir. Pakistan’s nuclear weapons have allowed it to sponsor terrorism against India, a much larger and more powerful nation, without fear of retaliation. Since the early 1990s the two countries have come close to nuclear war about half a dozen times, most recently in November 2008, after suicide attacks on India’s largest city, Mumbai.

The security of Pakistan’s nuclear arsenal is now threatened not only by an attack but also by radical Islamists within the country seeking to steal weapons. The internal and external threats place competing demands on Pakistan’s command-and-control system. To protect against theft, the weapons should be stored at a handful of well-guarded locations. But to safeguard against an Indian surprise attack, the weapons should be dispersed to numerous storage sites. Pakistan has most likely chosen the latter approach. Although the warheads and bombs are said to be stored without their nuclear cores, the dispersal of Pakistan’s weapons makes it a lot easier for terrorists to seize one.

Islamic militants staged a bold attack on the headquarters of the Pakistan army in October 2009. They wore military uniforms, used fake IDs, penetrated multiple layers of security, and held dozens of hostages for almost a full day. The head of the Strategic Forces Command, responsible for Pakistan’s nuclear arsenal, worked at that headquarters. Another attack penetrated a naval aviation base outside Karachi in May 2011. Most of Pakistan’s nuclear weapon storage facilities were built in the northwestern part of the country, as far as possible from India, to extend the warning time of a missile attack and to make a conventional attack on them more difficult. Unfortunately, that means the nuclear storage sites are located near the border with Afghanistan, Pakistan’s lawless tribal areas, and the heart of its radical Islamist movement.

MOST OF THIS BOOK has been devoted to stories of accidents, miscalculations, and mistakes, tempered by a great deal of personal heroism. But one crucial fact must be kept in mind: none of the roughly seventy thousand nuclear weapons built by the United States since 1945 has ever detonated inadvertently or without proper authorization. The technological and administrative controls on those weapons have worked, however imperfectly at times — and countless people, military and civilian, deserve credit for that remarkable achievement. Had a single weapon been stolen or detonated, America’s command-and-control system would still have attained a success rate of 99.99857 percent. But nuclear weapons are the most dangerous technology ever invented. Anything less than 100 percent control of them, anything less than perfect safety and security, would be unacceptable. And if this book has any message to preach, it is that human beings are imperfect.

A retired Strategic Air Command general told me about the enormous, daily stress of his job during the Cold War. It involved, among other things, managing the nuclear command-and-control system of the United States. New codes had to be regularly obtained from the National Security Agency and distributed to missile sites, bombers, submarines. False alarms from NORAD had to be considered and dismissed, Soviet military transmissions carefully analyzed, their submarines off the coast tracked. Thousands of things seemed to be happening in the system at once, all over the world, subtly interconnected, and at any moment something could go terribly wrong. He compared the job to holding an angry tiger by the tail. And like almost every single Air Force officer, weapon designer, Pentagon official, airman, and missile maintenance crew member whom I interviewed about the Cold War, he was amazed that nuclear weapons were never used, that no major city was destroyed, that the tiger never got loose.

The challenges that the United States has faced in the management of its arsenal should give pause to every other nation that seeks to obtain nuclear weapons. This technology was invented and perfected in the United States. I have no doubt that America’s nuclear weapons are among the safest, most advanced, most secure against unauthorized use that have ever been built. And yet the United States has narrowly avoided a long series of nuclear disasters. Other countries, with less hard-earned experience in the field, may not be as fortunate. One measure of a nation’s technological proficiency is the rate of industrial accidents. That rate is about two times higher in India, three times higher in Iran, and four times higher in Pakistan than it is in the United States. High-risk technologies are easily transferred across borders; but the organizational skills and safety culture necessary to manage them are more difficult to share. Nuclear weapons have gained allure as a symbol of power and a source of national pride. They also pose a grave threat to any country that possesses them.

In recent years an international movement to abolish nuclear weapons has arisen from an unlikely source: the leadership of America’s national security establishment during the Cold War. In January 2007, two former Republican secretaries of state — George Shultz and Henry Kissinger — along with two prominent Democrats — former Secretary of Defense William J. Perry and Sam Nunn, the former chairman of the Senate Armed Services Committee — wrote an op-ed for the Wall Street Journal that spelled out their goal: “A World Free of Nuclear Weapons.” Sidney Drell had given the group not only technical guidance but also encouragement to take a bold stance. “The world is now on the precipice of a new and dangerous nuclear era,” they warned. The end of the Cold War, the threat of nuclear terrorism, and the spread of nuclear weapons to countries like North Korea rendered long-standing notions of deterrence obsolete. The use of nuclear weapons had become more, not less, likely. And the two nations that control about 90 percent of those weapons — the United States and Russia — had an obligation to remove their missiles from hair-trigger alert, minimize the risk of accidents, reduce the size of their arsenals, and pursue abolition with the collaborative spirit that reigned, briefly, at the 1986 Reykjavik summit.

The campaign to eliminate nuclear weapons was subsequently endorsed by a wide variety of former Cold Warriors, including Robert McNamara, Colin Powell, and George H. W. Bush. It became part of America’s foreign policy on April 5, 2009. “Some argue that the spread of these weapons cannot be stopped, cannot be checked — that we are destined to live in a world where more nations and more people possess the ultimate tools of destruction,” President Barack Obama said that day, during a speech before a crowd of twenty thousand people in Prague. “Such fatalism is a deadly adversary, for if we believe that the spread of nuclear weapons is inevitable, then in some way we are admitting to ourselves that the use of nuclear weapons is inevitable.” Obama committed his administration to seeking “a world without nuclear weapons,” warning that the threat of global nuclear war had gone down but the risk of a nuclear attack had gone up. Later that year, the United Nations Security Council voted to support abolition. The idealistic rhetoric at the U.N. has not yet been followed, however, by the difficult steps that might lead to the elimination of nuclear weapons: passage of the Comprehensive Nuclear Test Ban Treaty by the U.S. Senate; major reductions in the Russian and American arsenals; arms control talks that include China, India, Pakistan, North Korea, and Israel; strict rules on the production and distribution of fissile materials; and harsh punishments for countries that violate the new international norms.

In the United States, the nuclear abolition movement has failed to generate much popular support. The retired officials who jump-started the debate in 2007 had an average age of seventy-nine. Many of the issues at stake seem hypothetical and remote. Almost half of the American population were not yet born or were children when the Cold War ended. And support for the abolition of nuclear weapons is hardly universal. The administration of President George W. Bush not only sought to develop new warheads and hydrogen bombs but also broadened the scope of the OPLAN. Bush’s counterforce strategy, adopted after 9/11, threatened the preemptive use of nuclear weapons to thwart conventional, biological, and chemical attacks on the United States. A pair of liberal Democrats, former Secretary of Defense Harold Brown and former director of the CIA John M. Deutch, criticized the “nuclear disarmament fantasy” from a different perspective. Nuclear weapons can never be un-invented, Brown and Deutch argued, and countries that secretly violate an international ban might achieve unchecked power. The temptation to cheat would be enormous. In their view, utopian proposals shouldn’t distract attention from practical measures to reduce the nuclear threat and avoid armed conflicts: “Hope is not a policy, and, at present, there is no realistic path to a world free of nuclear weapons.”

Between the extremes of a counterforce strategy requiring thousands of nuclear weapons always on alert and an agreement to abolish all nuclear weapons, there lies a third course. Promoted by the U.S. Navy in the late 1950s, when its submarine-based missiles were too inaccurate to hit military targets, the strategy of minimum deterrence has lately gained strong support, even in some unexpected places. In 2010 a group of high-ranking Air Force officials, including its chief of strategic planning, argued that the United States needed only 311 nuclear weapons to deter an attack. Any more would be overkill. The arsenal proposed by these Air Force strategists would contain almost 200 fewer weapons than the one recommended by the National Resources Defense Council and the Federation of American Scientists, a pair of liberal groups that also support minimum deterrence.

Bob Peurifoy advocates a similar strategy. He considers himself a realist and thinks that a world free of nuclear weapons is unattainable. He would like the United States to get rid of its land-based missiles, take all its weapons off alert, give up the notion that a counterforce strategy might work, and retain a few hundred ballistic missiles securely deployed on submarines. To avoid accidental launches and mistakes, the subs shouldn’t be capable of firing their missiles quickly. And to dissuade foreign enemies from attacking the United States, Peurifoy would let them know in advance where America’s warheads might land on their territory. That knowledge would deter any rational world leader. But the problems with a strategy of minimum deterrence have changed little in the past fifty years. It cannot defend the United States against an impending attack. It can only kill millions of enemy civilians after the United States has already been attacked.

LAUNCH COMPLEX 374-7 was never rebuilt. The underground passages were disassembled. The land around it was cleared of debris. Toxic waste was pumped from the silo, and then the silo was filled with gravel and dirt. The Air Force returned the land to Ralph and Reba Jo Parish, from whom it had been taken through eminent domain. Seeing the place today, you would never think that one of the most destructive weapons ever built once lay beneath the ground there. Nature has reclaimed the site. It’s covered with grass, surrounded by woods and farmland. A large mound covers the spot where the missile stood. The paved access road is now dirt. Quiet, peaceful, bucolic — it could not feel more removed from international diplomacy, Washington politics, nuclear strategy. The only hints of what happened there are patches of concrete overgrown with weeds and a few scattered pieces of metal, lying on the ground, that have been bent and deformed by tremendous heat.

I first heard about the accident at Damascus in the fall of 1999, while visiting Vandenberg Air Force Base. I was interested in the future of warfare in space, the plans to build laser beam, particle beam, and directed energy weapons. The Air Force Space Command invited me to watch the launch of a Titan II missile, and it seemed like an opportunity that shouldn’t be missed. The payload of the missile was a weather satellite. During the long delay of the scheduled launch, I spoke to officers who’d served on missile combat crews. They told me Cold War stories and showed me footage of warheads arriving at the Kwajalein Test Site in the South Pacific. A Peacekeeper missile had been fired from Vandenberg at night, and as one warhead after another fell from the sky and landed precisely within their target circles, it was an oddly beautiful sight. They looked like shooting stars.

The evening before the Titan II launch, I rode an elevator to the top of the tower and got to see the missile up close. I could just about reach out and touch it. The Titan II seemed a living, breathing thing, attached to all sorts of cables and wires, like an angry patient about to be released from intensive care. The tower hummed with the sound of cooling units. Looking down the length of the missile, I could hardly believe that anyone would be brave enough and crazy enough to sit on top of it, like the Gemini astronauts did, and ride it into space.

The next morning I signed a waiver, promising not to sue the Air Force for any injuries, and received training in the use of a Scott Air-Pak. I carried the breathing apparatus in case the Titan II misfired on the pad. The officer who served as my host had never been allowed to stand so close to a launch. When the missile left the ground, you could feel it in your bones. The blast, the roar, the sight of the flames slowly lifting the Titan II upward — they suddenly affected me. They were more visceral and more powerful than any Cold War story. I had grown up in the 1970s hearing about missiles and warheads, throw weights and megatons, half believing that none of those weapons really worked, that the fears of nuclear Armageddon were overblown and based on some terrible fiction. The Titan II hesitated for a moment and then really took off, like a ten-story silver building disappearing into the sky. Within moments, it was gone, just a tail of flame somewhere over Mexico.

Watching that launch, the imaginary became tangible and concrete for me. It rattled me. It pierced a false sense of comfort. Right now thousands of missiles are hidden away, literally out of sight, topped with warheads and ready to go, awaiting the right electrical signal. They are a collective death wish, barely suppressed. Every one of them is an accident waiting to happen, a potential act of mass murder. They are out there, waiting, soulless and mechanical, sustained by our denial — and they work.