Proper of Launch: Command and Management Vulnerabilities After a Restricted Nuclear Strike


Editor’s Word: Bruce Blair handed away in July 2020. His co-authors are grateful to his widow, Sally Blair, for permission to publish this text and checklist Bruce as a co-author. 


Think about a quickly escalating battle between Russian and NATO forces. Compensating for Russia’s perceived standard inferiority, Russian commanders execute a restricted nuclear strike — a small variety of low-yield weapons supposed to vary circumstances on the battlefield. The U.S. president, in flip, authorizes a restricted nuclear response simply earlier than being evacuated from the White Home. Whereas dashing towards their helicopter, she or he wonders what Russia’s subsequent transfer will likely be and hopes they won’t must authorize extra nuclear strikes. The issue is they might have unintentionally accomplished so already.

America’s nuclear command and management system focuses on securing nuclear weapons till authentication of a president’s orders. However proper of launch — instantly after the president’s first orders have been executed — the system is primed to permit extra strikes as a substitute of resetting the launch codes or placing the launch keys again of their safes. Because of this, after that first restricted strike the hazard of unauthorized launch is worse in disaster conditions the place controlling escalation is important. No command and management system can reconcile the difference and suppleness required by conflict with the tight management over nuclear weapons that’s very important to stopping unauthorized launches and clearly signaling intentions to restrict fairly than improve the size of battle. So as to keep strong command and management in a disaster, the US ought to place much less reliance on restricted nuclear choices.

Safeguards In opposition to Unauthorized Nuclear Use 

The U.S. nuclear command and management structure focuses on stopping unauthorized use previous to presidential authorization. One of many first boundaries is the permissive motion hyperlink — a code that must be accurately entered earlier than the warhead arms. Permissive motion hyperlinks are supposed to maintain warheads and bombs protected throughout transit and storage, and to stop unauthorized detonation by anybody who manages to get their palms on one. For silo-based and submarine-launched ballistic missiles, permissive motion hyperlinks are unlocked earlier than warheads are fitted onto their supply bus.



Presidential authentication is one other safeguard. To order a nuclear strike, the president must crack open the nuclear biscuit — a laminated card carried by both the president or the president’s army aide — and supply the suitable response to the sequence of letters learn by the obligation officer within the Pentagon’s army command middle. If the codes match, that is taken as proof that the order is coming from the president, or the subsequent surviving member of the chain of command. As soon as authenticated, the president’s chosen choice is transmitted by the Pentagon’s command middle on to the crews concerned in finishing up the order.

Apart from ensuring any launch order comes from the president, there are extra measures supposed to cease unauthorized launch. Right here we consider intercontinental ballistic missiles and submarine-launched ballistic missiles, which comprise over 80 p.c of deployed U.S. strategic nuclear weapons — an extra 450 nuclear warheads might be delivered by dual-capable plane. When the president selects a selected assault choice, the related unlock code is distributed to launch crews. As soon as a submarine or intercontinental ballistic missile crew receives an authenticated order, they unlock safes and examine the codes inside with the one they simply obtained. If the codes match, intercontinental ballistic missile crews then start the method of typing concentrating on coordinates into their computer systems and launching the missiles. On submarines there may be an intermediate step that includes two senior officers retrieving from a protected the important thing wanted to fireplace the missiles.

If the president selects a restricted nuclear choice, a selective unlock code permits crews to fireplace particular missiles at particular targets — and solely these missiles. Though the launch crews all have the keys needed to fireplace extra nuclear weapons, they lack the unlock codes wanted to arm, goal, and fireplace these weapons.

However what if a selected missile fails to fireplace? Or maybe it leaves its launch tube, arrives on the goal, however doesn’t trigger ample harm as a result of the warhead malfunctions or the goal was more durable or extra elusive than calculated? What occurs if — within the two to seven minutes it takes intercontinental ballistic missiles crews (15 to 20 minutes for submarines) to arm, goal, and fireplace their weapons — an necessary however time-sensitive goal turns into accessible? One can think about quite a lot of explanation why the president would possibly discover it prudent to authorize each a nuclear strike after which a back-up or contingency plan. In such circumstances, a number of totally different unlock codes could be despatched to the launch crews, together with directions that may specify when to launch and whether or not or not extra authorization is required.

What Occurs After an Preliminary Launch?

After execution of the preliminary restricted strike licensed by the president, the army would have the unlock codes for chosen extra strikes. The command and management system assumes that subsequent orders adhere to the steerage given by the president. No extra authentication by the president is important.

Contemplate, for instance, right now’s nuclear weapon-equipped submarines. After a missile is fired, they’ll “pause” their launch sequences and resume strikes later with out the necessity to undergo a whole pre-launch guidelines once more. Which means the president’s back-up or contingency plan might be executed with out extra presidential authorization and with little greater than the flip of a key.

There are additionally incentives for the president to authorize greater than a small variety of contingency strikes. Any president would additionally take into consideration doable retaliation or escalation after that first restricted nuclear strike. Contemplate once more the situation by which Russia’s purported escalate to de-escalate doctrine is in operation: Within the fog of an ongoing skirmish in Europe that has escalated to restricted nuclear use, the president would possibly moderately be satisfied that it’s best to depart the White Home and transfer to a safer facility. Involved about communications issues, the president authorizes a restricted strike, but in addition extra future choices within the occasion that the disaster escalates whereas they’re aboard a helicopter headed for Andrews Air Power Base. Maybe there are considerations about assaults on different U.S. authorities leaders, making it necessary for the president to depart behind contingency plans till continuity of presidency might be verified. What occurs if the North American Aerospace Protection Command detects an incoming strike that can destroy U.S. intercontinental ballistic missiles except they’re launched, however communications hyperlinks are briefly down, garbled, or disabled? Frightened about potential communications breakdowns, the president would possibly pre-authorize extra strikes.

One other complication is the necessity to protect flexibility in order that the remaining nuclear weapons might be allotted to future targets. When a selected strike choice is chosen, the nuclear weapons which are left are adjusted to cowl remaining targets. Consider operational nuclear weapons as a part of a dynamic matrix. New targets seem or the most effective weapon for a selected goal could have already got been launched. Some weapons are withheld ought to different adversaries wish to take benefit in a disaster. After a restricted nuclear strike, there are quite a few explanation why the remaining operational weapons may need to be reallocated to totally different targets.

As a result of concentrating on is dynamic and crises unsure, the president has a number of incentives to authenticate the common unlock code. Simply because the adjectives recommend, this code would enable intercontinental ballistic missile and submarine crews to launch all of their nuclear weapons. The intent is to offer flexibility to the Pentagon and U.S. Strategic Command to problem extra launch orders if the president can’t be discovered, weapons don’t operate, Russia out of the blue escalates, or one other nation (e.g., China) decides to enter the fray. However the common unlock code, which might concurrently be broadcast to all launch crews and command posts, additionally creates alternatives for unauthorized launch.

The common unlock code would give Strategic Command and the Pentagon’s command middle the power to transmit orders for added strikes even when they weren’t licensed by the president. The identical is true for launch crews. Reduce off from the chain of command resulting from communications disruption, or garbled follow-on messages, a submarine crew would be capable of unleash a salvo of missiles with out extra authorization. For intercontinental ballistic missiles, ten folks management a squadron of 50 missiles. However it takes solely two such “votes” to launch a nuclear strike.

We’re not suggesting that the nuclear weapons chain of command is harboring potential Dr. Strangeloves, simply ready to launch the doomsday machine in retaliation for “the worldwide Communist conspiracy to sap and impurify all of our valuable bodily fluids.” However the common unlock code does present a number of totally different actors with the discretion to launch extra nuclear strikes with out the authorization of the president or the president’s successor.

What occurs if there’s a pause in hostilities or the president decides to rule out additional use of nuclear weapons? In such circumstances, the weapons stay topic to unauthorized launch till the unlock codes might be modified. This requires new launch codes to be issued by the Nationwide Safety Company and the codes, together with related gear, to be bodily transported to every missile base and submarine. At intercontinental ballistic missile bases, such code modifications typically take a full day and require many routine actions to be suspended. It takes longer for submarines, a few of which can take days and even weeks to return to port.

Command and Management Protocols Aren’t Ready for Restricted Nuclear Conflict

U.S. nuclear command and management protocols have uncared for to maintain tempo with methods that decision for restricted nuclear conflict or restricted nuclear strikes. Furthermore, it’s tough and maybe unattainable to create a system of command and management that eliminates the hazard of unauthorized launch whereas additionally enabling the flexibleness generally required by the tempo and fog of conflict. Ordering the primary use of a nuclear weapon might simply result in an exponential improve within the threat of unauthorized actions, whether or not resulting from nefarious intent or easy miscommunication. This hazard is at its worst throughout exactly these conditions the place deterrence assumes actions are fastidiously calibrated and decision-makers securely in management.

The nuclear weapon command and management system must be versatile sufficient to accommodate the uncertainties and dynamic circumstances that at all times include conflict, and that permeate efforts to maintain restricted conflict from escalating. The command and management system also needs to be invulnerable to unauthorized launch. However each circumstances can’t be glad on the similar time. As a consequence, the one method to make sure that nuclear weapons are solely used as prescribed by the president is to scale back reliance on restricted nuclear strikes. To this finish, the US ought to acknowledge that the only real goal of nuclear weapons should be deterrence of existential threats, not preventing for restricted goals.




Bruce G. Blair was the writer of quite a few books on nuclear weapons command and management and the founding father of World Zero, in addition to a member of Princeton College’s Program on Science and World Safety. 

Sebastien Philippe is an engineer and affiliate analysis scholar with Princeton College’s Program on Science and World Safety. His technical work lies on the intersection of nuclear science, physics, and cryptography. He was a Stanton Nuclear Safety Postdoctoral Fellow at Harvard’s Belfer Heart, and beforehand served as a strategic nuclear weapon system security and safety engineer. 

Sharon Ok. Weiner, affiliate professor of worldwide relations on the College of Worldwide Service, American College, has obtained quite a few awards for her analysis on nuclear weapons points, together with a Council on Overseas Relations Worldwide Affairs Fellowship and a Carnegie Fellowship. Her authorities expertise consists of each homes of Congress, the Joint Employees, and the Workplace of Administration and Finances.

Picture: U.S. Air Power (Picture by Senior Airman Aubree Owens)

Supply hyperlink


Please enter your comment!
Please enter your name here