A quick recap:
A few weeks ago, I reacted to a story that’s been going around for years: that the launch code for the U.S. intercontinental ballistic missile (ICBM) force was set to “00000000″ until 1977. The story, as I remembered it, and as it was since repeated many times in the press, is that in the 1960s, Secretary of Defense Robert McNamara wanted an extra layer of security against unauthorized or accidental launch, but that the Air Force decided that the best thing to do was to ignore McNamara — or more precisely, to follow the order to create a launch code but then set it at a line of zeros.
I said I doubted the story, since the only source I could find for it was Bruce Blair, who mentioned it in a 2004 article. I theorized that Blair (a former missile officer himself and a leading arms control analyst now at Princeton) had either been misunderstood or had been misleading: perhaps, I thought, he meant that the initial settings on the mechanism for the codes had to be set at zero.
The story also appears in a new book about nuclear disasters, Eric Schlosser’s Command and Control, and again, the source is Bruce Blair, although this time there is also an unnamed engineer from Sandia Labs who confirmed the story, and in journalism, two sources = confirmed, so there we were. Still I was skeptical and said so.
Within a day of the post going up, Dr. Blair himself weighed in and assured me: no, he meant exactly what he said. He then corresponded with me, and graciously allowed me to use his response to clear this up. So here, including Blair’s comments, is the story as best as I can piece it together.
The dispute was specifically between McNamara (“the greatest SecDef in history,” said no one ever), and General Tommy Power.
Yes, that was really his name.
General Power was everything you’d expect from a nuclear commander with that name, and his views on nuclear war were nothing short of terrifying: “At the end of the war,” he told a group of pointy-heads at RAND, “if there are two Americans and one Russian, we win!” Indeed, Power’s plans for all-out nuclear war were so hideous that General David Shoup, the commandant of the Marine Corps, objected to them in 1962, an incident I wrote about here.
So I had no trouble believing that Power would defy McNamara, but I wondered why no one had ever really talked about this. Blair responded:
The younger generations of launch officers can hardly believe that unlock codes were once unnecessary…For us at the time, it was hardly a memorable fact in part because junior officers like me had no knowledge of the context (i.e., the McNamara-Power dispute).
The “unlock codes” actually were part of the “arming” of the missiles during the launch sequence. Three commands were involved in firing: target, arm, and launch. Today, without the codes, the crews can’t transmit the “enable” command arming the missiles (which remain subject to environmental sensing criteria in flight before they finally fuze and detonate), and missiles that haven’t been armed will not accept the launch signal.
While I was reading up and trying to get smarter on this, someone suggested I take a look at a small book published in 2008 by a retired Pentagon official named John H. Rubel.
Rubel talks about the creation and design of the Minuteman system in 1959, and claims that it was deliberately designed to remove the President’s ability to exercise operational control over a nuclear war once it started by making it impossible for the Commander-in-Chief to do anything except launch everything we had at once.
This sounds crazy, but it made sense in the Bizarro world of nuclear planning at the time, and it’s no crazier than the standing order that existed (until Lyndon Johnson quietly rescinded it) for U.S. forces to nuke the daylights out of everybody if a war broke out and the President went missing.
Here’s Rubel’s description of the Minuteman launch procedure as it was briefed by the system’s program manager in 1959. “Let’s say,” Rubel asked him, “that a launch message reaches a launch control center?”
He began to describe how a launch control center [an “LCC”] was laid out; it’s under the ground; it’s hardened [against blast pressure] to 300 PSI; it’s a small room with control panels and switches and dials and things like that; there are two men down there. Easch of these men has a key that fits into a key-operated switch. Between these two men is a sheet of bulletproof glass. If each man is standing close enough to his panel to actuate his switch, he is separated by that that bulletproof glass from the other man so he couldn’t intimidate the other man, at that moment at least, by threatening to shoot him.
If each of these two men inserts his key on command and turns the switch within two seconds of the other one, then the launch control center will be deemed to have “voted” to launch. If at least two of out of the five launch control centers [totalling 50 missiles] have voted to launch within some short period of time, then the missiles will be launched. That’s the kind of explanation he gave.
So, okay, two guys, two keys, a required code, and guns. What could go wrong? Even if both guys went nuts, no one could do anything, right?
Well, maybe. It turns out that under certain conditions — like, the Soviets jumped us and wiped everybody out — there was a mechanism by which one LCC could launch its weapons, and some of this may have influenced later lore about “zero” that might have confused people (including me) regarding Blair’s already scary account.
Each LCC had a clock in it that could act as a second “launch vote” if all the others were wiped out in a first strike. That clock was set to run on emergency power, and had a minimum setting of 58 minutes and a maximum of six hours (which is as long as the backup power would last). If the two guys in the capsule voted to launch, and nobody countermanded that decision within one to six hours, the clock itself would be the second vote and all remaining missiles would go.
Sounds clever, except that at one point Rubel asked a USAF colonel to verify that detail for him, and the officer said that actually, the clocks could be set to zero minutes, meaning that if the power were knocked out, two guys could start Armageddon using the backup system and a clock set to zero. [Note Blair’s comment on this issue below, including the fact that the bulletproof glass idea probably didn’t get off the ground and certainly wasn’t there by the 1970s.]
(By the way, Rubel says he has no idea why they had guns. Other missile officers, however, have told me that sidearms used to be issued with the idea that they were the “last line of defense” against an intrusion into the launch area, although no one really worried too much about Ivan rappelling down the ladders. Remember, the missiles and the LCCs are actually quite far from each other. The notion that the officers sit with the bombs is only in the movies. In any case, the guns are now gone.)
It was in the midst of all this Strangelovian nuttery that McNamara wanted an extra code, a set of numbers that would have to come from higher authority that would turn the system on so that it could armed in the first place. The Air Force, clearly worried to death about sudden Soviet attack, wanted no part of the schemes of academic pinheads, and obliged by giving the Secretary his damn code: 00000000.
General Power retired and died in 1970. Blair left the USAF in 1974, and began “quietly advocating” for enabling this panel. In 1977, someone got around to noticing this problem, and fixed it. There have been changes in procedures since then, but they’re over my pay grade and beyond my level of classification, so I’m not going to pontificate on them because I wouldn’t know what I’m talking about.
So, until someone says this wasn’t so, I believe we should accept Blair’s explanation, and admit that a very important code meant to prevent the accidental or unauthorized launch of U.S. nuclear weapons was, in fact, set to zero/zero/zero/zero/zero/zero/zero/zero until the late 1970s.
I want to thank Dr. Blair, again, for taking the time to correspond with me on this, and I will gladly edit this post should he or others point out any other details it might need.
But so far as I am concerned, I accept the story as I’ve now heard it from Dr. Blair, and that’s ground truth until someone has evidence to the contrary.