And that’s the beauty of the internet.
In my post earlier today (as of this writing, about four hours ago), I approached the issue of whether American ICBM launch codes were all set to 00000000 as part of a passive resistance on the part of the Strategic Air Command to SECDEF Robert McNamara’s demand that the missile force be fitted with Permissive Action Links.
I noted that the only source for this story is Bruce Blair, formerly an Air Force missile officer and now at Princeton. I am reposting his response here as a post in itself, and I thank Dr. Blair for taking the time to add the clarification to his 2004 remarks. (I apologize for somehow getting it into my head that his story was from 1994, instead of 2004; all I can do is blame my editor, who in this case happens to be me.)
I’ll note, however, as I did in my response below, that I still wonder why Blair is the only source for this story. In his response, he essentially repeats what he said in 2004, but with some deeper detail. His key point, however, is that he stands by the assertion that “eight zeroes were the initial and final unlock codes until 1977.”
That’s pretty startling stuff, and since Blair is on the record as saying he saw it with his own eyes, it would be incumbent on doubters to prove it wasn’t true — which I can’t. So until someone can tell me otherwise, I have to assume this really was the case.
Blair notes that other triggers would have to be pulled for a launch to occur, but he emphasizes that as a technical matter, nothing could prevent an unauthorized launch until 1977.
Below is Dr. Blair’s complete response, although it’s clear he does not intend to comment further.
I think you can understand that I’m unable to devote all my time to identifying and correcting the innumerable essays that have distorted, embellished, and re-invented my original article on the ‘secret unlock codes’. The gist of the true story is that eight zeroes were the initial and final unlock codes until 1977. Afterwards, the final unlock codes had to be provided in the launch order received from higher authority. At that point they became a true technical safeguard supplementing, as you note, other procedural safeguards such as the multiple launch vote system (requiring only two crews, not several, to provide two launch votes, at which point the 50 missiles will ignore any vetoes from the other three crews in a given squadron; a single vote from one crew also may suffice, in that it will begin a short-term timer to launch the squadron if no other crews issue a veto).
This introduction of actual codes in 1977 was a very significant enhancement of safeguards. Before then, no technical protection against unauthorized launch existed, and there were a number of scenarios that could plausibly have culminated in the unauthorized launch of the squadron (actually just one crew member acting in collusion with another crew member in a different squadron launch center could have issued the requisite two votes if they were vicious enough to disable their crew mates) and, moreover, in the unauthorized dissemination of an authentic-appearing launch order to the entire strategic force using the launch authorization codes inside the safes of the squadron launch centers. This is no longer plausible unless the unlock codes are somehow compromised (they have an A and a B part that are never supposed to be handled by the same people or even come into proximity physically with each other during periodic code changes of the missiles and the launch centers, but this precaution is violable and sometimes it is violated unintentionally, and other serious compromises have occurred in the past that create scope for, as they say in the vaults, you to become President.
I have not taken a normal security procedure and made it sound a lot more dangerous than it was. The introduction of real codes in 1977 allowed Strategic Command the confidence to begin allowing one of the crew members on alert to sleep in the launch center while the other crew member manned the consoles. (I still believe this is a violation of the two-man rule and is not prudent despite the code safeguard.)
As for the disobedience question, I would merely repeat my original story. McNamara wanted this system installed and wanted the unlock codes provided in the launch order, and the commander of SAC Thomas Power disagreed and went to the mat over it. McNamara thought he had prevailed, but learned from me in 2004 (the date of my article that you wrongly dated 1994) that SAC had set the combination codes to eight zeros and got away with it until 1977. Meanwhile, comparable technical coded switch devices were installed on strategic bombers in the early 1970s (the codes to which would be provided in the launch order), and in Trident submarines in 1997 (the codes to open a safe inside a safe containing the fire control key would also be provided in the launch order). One can surmise that an effort has been made to universalize these codes or otherwise the launch order would be pretty heavily loaded with unlock codes.
Many of the embellishments of this story assume that only the president controls these codes. I’ll repeat one more time for the record: all of the codes needed to authorize, arm, and launch nuclear forces are possessed exclusively by the military. The president (sometime on his person, or sometimes in his military aide’s football, or sometimes they’re misplaced altogether) carries an identification code so that in a nuclear emergency he can give orders to the military and have them accepted as coming from the president (or his successor, if the president elects to provide such ID codes, which is a big ‘if’, since most presidents pre-delegated their launch authority to senior military commanders, who weren’t going to do much more than speed dial to find a successor in any case) regardless of his location and means of communications.
I don’t look forward to the massacre of these words and so forgive me for not bothering to correct all the misinterpretation my words will engender.