Command and Control

by Eric Schlosser

At a NATO base in Germany, Agnew looked out at the runway and, in his own words, “nearly wet my pants.” The F-84F fighter planes on alert, each carrying a fully assembled Mark 7 bomb, were being guarded by a single American soldier. Agnew walked over and asked the young enlisted man, who carried an old-fashioned, bolt-action rifle, what he’d do if somebody jumped into one of the planes and tried to take off. Would he shoot at the pilot—or the bomb? The soldier had never been told what to do. The wings of the fighters were decorated with the Iron Cross, a symbol that powerfully evoked two world wars. Agnew realized there was little to prevent a German pilot from taking a plane, flying it to the Soviet Union, and dropping an atomic bomb.

The launch authentication officer was the only American at the site. Two keys were required to launch the missiles; one was held by the American, the other by an Italian officer. The keys were often worn on a string around the neck, like a dog tag. Congressman Chet Holifield, the chairman of the joint committee, was amazed to find three ballistic missiles, carrying thermonuclear weapons, in the custody of a single American officer with a handgun. “All [the Italians] have to do is hit him on the head with a blackjack, and they have got his key,” Holifield said, during a closed-door committee hearing after the trip. The Jupiters were located near a forest, without any protective covering, and brightly illuminated at night. They would be sitting ducks for a sniper. “There were three Jupiters setting there in the open—all pointed toward the sky,” Holifield told the committee. “Over $300 million has been spent to set up that little show and it can be knocked out with 3 rifle bullets.”

An incident report noted defects in another Mark 7: During initial inspection after receipt of a War Reserve Mk 7 Mod 5 bomb, it was observed that the safing and arming wires were in reversed locations in the Arm/Safe Retainer assembly, i.e., the arming wires were in the safing wire location and the safing wires were in the arming wire location. Four screws were missing from the assembly.

And a Mark 7 sometimes contained things it shouldn’t. A screwdriver was found inside one of the bombs; an Allen wrench was somehow left inside another.

When Agnew and Cotter showed the committee how the new lock worked, it didn’t. Something was wrong. But none of the senators, congressmen, or committee staff members realized that it wouldn’t unlock, no matter how many times the proper code was entered. The decoder looked impressive, the colored lights flashed, and everyone in the hearing room agreed that it was absolutely essential for national security.

At Sandia, the development of coded, electromechanical locks was begun on a crash basis. Known at first as “Prescribed Action Links,” the locks were given a new name, one that sounded less restrictive, in the hopes of appeasing the military. “Permissive Action Links” sounded more friendly, as did the acronym: PALs.

In response to McNamara’s questions, the Army admitted that its request for thirty-two thousand nuclear weapons might “appear to be unreasonably high

After much back and forth, McNamara decided to build a thousand Minuteman missiles. One Pentagon adviser later explained that it was “a round number

skills. “If you have to go, you want LeMay in the lead bomber,” Kennedy later explained. “But you never want LeMay deciding whether or not you have to go.”

the Soviet Union detonated Tsar Bomba, “the King of Bombs”—the most powerful nuclear weapon ever built. It had a yield of 50 megatons. The mushroom cloud rose about forty miles into the sky, and the fireball could be seen more than six hundred miles from ground zero. The shock waves circled the earth three times with enough force to be detected in New Zealand

LEMAY: I think that a blockade and political talk would be considered by a lot of our friends and neutrals as being a pretty weak response to this. And I’m sure a lot of our own citizens would feel the same way. In other words, you’re in a pretty bad fix at the present time. PRESIDENT KENNEDY: What did you say? LEMAY: You’re in a pretty bad fix. PRESIDENT KENNEDY: You’re in there with me. [Slight laughter, a bit forced.] Personally.

At the height of the Cuban Missile Crisis, urgent messages from the Soviet ambassador in Washington had been encoded by hand and then given to a Western Union messenger who arrived at the embassy on a bicycle. “We at the embassy could only pray,” Ambassador Dobrynin recalled, “that he would take it to the Western Union office without delay and not stop to chat on the way with some girl!”

The three workers—Marvin J. Ehlinger, Hilary F. Huser, and Floyd T. Lutz—noticed the flames, ran out of the igloo, and jumped into a ditch across the road. The sphere burned for about forty-five seconds and then detonated, setting off approximately 123,000 pounds of high explosives in the building. The explosion did not produce a nuclear yield, although the mushroom cloud rising from the blast contained uranium dust. Shop windows were blown out in San Antonio, fourteen miles away. All that remained, where the igloo had once stood, was a crater twenty feet deep. The other igloos at the base were undamaged, the three workers unharmed. They were given the rest of the day off.

Dodson had forgotten to bring a fuse puller, so he used a screwdriver instead. After removing each fuse, he’d put it back into place. You could hear the difference between a good fuse and one that had burned out. When a good fuse was inserted, it made a clicking sound. One of the fuses didn’t make that “click.” Dodson pulled it out again with the screwdriver, put it back, and heard a different kind of sound—a loud explosion. The two airmen ran out of the launch duct and called the control center. Half an hour later, a Missile Potential Hazard Team ordered them to reenter the silo. They found it full of thick, gray smoke. One of the retrorockets atop the Minuteman had fired. The reentry vehicle, containing a W-56 thermonuclear weapon, had lifted a few inches into the air, flipped over, fallen nose first from the missile, bounced off the wall, hit the second-stage engine, and landed at the bottom of the silo. The warhead wasn’t damaged, although its arming and fuzing package was torn off during the seventy-five-foot drop. An investigation later found that the retrorocket had been set off by a fault in an electrical connector—and by Dodson’s screwdriver.

Teller used Livermore’s new core but added a mechanical safing device to it. A strip of cadmium tape coated with boron was placed in the center of the core. Cadmium and boron absorb neutrons, and the presence of the tape would stop a chain reaction, making a nuclear detonation impossible. During the warhead’s arming sequence, the tape would be pulled out by a little motor before the core imploded. It seemed like a clever solution to the one-point safety problem—until a routine examination of the warheads in 1963 found that the tape corroded inside the cores. When the tape corroded, it got stuck. And the little motor didn’t have enough torque to pull the tape out. Livermore’s mechanical safing device had made the warheads too safe. A former director of the Navy’s Strategic Systems Project Office Reentry Body Coordinating Committee explained the problem: there was “almost zero confidence that the warhead would work as intended.” A large proportion of W-47 warheads, perhaps 75 percent or more, wouldn’t detonate after being launched.

On March 15, the crew of the Alvin spotted the bomb, wrapped in a parachute, at a depth of roughly half a mile. Nine days later, while it was being pulled from the sea, the line snapped—and the bomb disappeared again. The search resumed, another week passed, and Alvin found the bomb a second time. Aside from a small dent on the nose, it looked fine. The second attempt to recover it went smoothly.

The radioactive waste from Thule filled 147 freight cars.

a crucial piece of one bomb was still missing, most likely the enriched uranium spark plug necessary for a thermonuclear blast. It was never found—and the search later inspired erroneous claims that an entire hydrogen bomb had been lost beneath the ice.

The Navy tested many of its weapons by placing them, unarmed, on the deck of an aircraft carrier, turning on all the ship’s radars and communications equipment, and waiting to see if anything happened.

The drug use at Homestead was suspected after a fully armed Russian MiG-17 fighter plane, flown by a Cuban defector, landed there unchallenged, while Air Force One was parked on a nearby runway.

One of the submarine tenders that docked at the base, the USS Canopus, often carried nuclear warheads and ballistic missiles. The widespread marijuana use among its crew earned the ship a local nickname: the USS Cannabis.

Four SAC pilots stationed at Castle Air Force Base near Merced, California, were arrested with marijuana and LSD. The police who raided their house, located off the base, said that it resembled “a hippie type pad with a picture of Ho Chi Minh on the wall.”

The bus separated from the missile and released each warhead over a different target, delivering them one after another, like a school bus dropping off children after school.

As the minutes passed without the arrival of Soviet warheads, it became clear that the United States wasn’t under attack. The cause of the false alarm was soon discovered. A technician had put the wrong tape into one of NORAD’s computers. The tape was part of a training exercise—a war game that simulated a Soviet attack on the United States.

This time technicians found the problem: a defective computer chip in a communications device. NORAD had dedicated lines that connected the computers inside Cheyenne Mountain to their counterparts at SAC headquarters, the Pentagon, and Site R. Day and night, NORAD sent test messages to ensure that those lines were working. The test message was a warning of a missile attack—with zeros always inserted in the space showing the number of missiles that had been launched. The faulty computer chip had randomly put the number 2 in that space, suggesting that 2 missiles, 220 missiles, or 2,200 missiles had been launched. The defective chip was replaced, at a cost of forty-six cents. And a new test message was written for NORAD’s dedicated lines. It did not mention any missiles.

During the late 1970s, a coded switch was finally placed in the control center of every SAC ballistic missile. It unlocked the missile, not the warhead. And as a final act of defiance, SAC demonstrated the importance of code management to the usefulness of any coded switch. The combination necessary to launch the missiles was the same at every Minuteman site: 00000000.

An Air Force investigation discovered the cause of the fire in engine number five: someone had forgotten to screw a nut onto the fuel strainer. The missing nut was smaller than a penny.

During both accidents, the telescoping arms broke, dropping the rotary launcher and the SRAMs about five feet to the ground. At least two warheads and half a dozen missiles were damaged. A manufacturing defect or corrosion seemed the most likely explanation for the collapse of the telescoping arms. But an Air Force investigation later found a different cause: maintenance crews had been goofing around with the load carts, out of sheer boredom, and using them to lift B-52 bombers off the ground.

At Carswell Air Force Base, someone on a loading crew had ignored a tech order and pulled a handle too hard in the cockpit of a B-52. Instead of opening the bomb bay doors, he’d inadvertently released a B-61 hydrogen bomb.

EOD technicians sat on nuclear weapons, casually leaned against them, used them as tables during lunch breaks.

one of Arnold’s commanders was too cocky and nonchalant. He once removed a dummy weapon from a storage bunker in broad daylight, put it into the back of his pickup truck, covered it with a tarp, drove right past security, and disassembled it in front of his girlfriend. Arnold thought the move was stupid and irresponsible, as well as a major breach of security. Inside the bunker, the dummy weapons were stored beside the real ones.

An investigation later found that the missile launches spotted by the Soviet satellite were actually rays of sunlight reflected off clouds

According to a Pentagon report, at one point during the fighting, unable to contact the Navy for fire support, “a frustrated Army officer used his AT&T credit card on an ordinary pay telephone to call Ft. Bragg, NC [the headquarters of the 82nd Airborne Division] to have them relay his request.”

At Pershing II bases in West Germany, crews would install the warhead, erect the missile, remove the pin that locked the missile onto its launcher, run the countdown until one second before launch—and then stop the exercise. The countdown would be controlled by a computer. Stevens felt uncomfortable with the idea; in fact, he thought it was crazy. A software glitch could launch a Pershing II missile. And the Army’s software, written in 1980, was unlikely to be bug free.

As part of that administrative process, Butler decided to look at every single target in the SIOP, and for weeks he carefully scrutinized the thousands of desired ground zeros. He found bridges and railways and roads in the middle of nowhere targeted with multiple warheads, to assure their destruction. Hundreds of nuclear warheads would hit Moscow—dozens of them aimed at a single radar installation outside the city.

In the early minutes of the accident, workers didn’t realize that the valves on the emergency coolant pipes had mistakenly been shut—one of the indicator lights on the control panel was hidden by a repair tag. Perrow soon learned that similar mistakes had occurred during the operation of other nuclear power plants. At a reactor in Virginia, a worker cleaning the floor got his shirt caught on the handle of a circuit breaker on the wall. He pulled the shirt off it, tripped the circuit breaker, and shut down the reactor for four days.

A lightbulb slipped out of the hand of a worker at a reactor in California. The bulb hit the control panel, caused a short circuit, turned off sensors, and made the temperature of the core change so rapidly that a meltdown could have occurred.

After studying a wide range of “trivial events in nontrivial systems,” Perrow concluded that human error wasn’t responsible for these accidents. The real problem lay deeply embedded within the technological systems, and it was impossible to solve: “Our ability to organize ...

a Mark 28 bomb emitting strange sounds, for reasons that were never discovered.

In August 2006 the nose-cone fuze assemblies of four Minuteman III missiles were inadvertently shipped from Hill Air Force Base in Utah to Taiwan. Workers at the Defense Logistics Agency thought they were helicopter batteries. The top secret nuclear-weapon fuzes sat in unopened boxes for two years, until Taiwanese officials discovered the error.

On August 29, 2007, six cruise missiles armed with nuclear warheads were mistakenly loaded onto a B-52 bomber named Doom 99 at Minot Air Force Base in North Dakota. The plane sat on the tarmac at Minot overnight without any armed guards, took off the next morning, flew almost fifteen hundred miles to Barksdale Air Force Base in Louisiana—violating the safety rule that prohibits nuclear weapons from being transported by air over the United States—landed at Barksdale, and sat on the tarmac there for nine hours, unguarded, until a maintenance crew noticed the warheads. For a day and a half, nobody in the Air Force realized that half a dozen thermonuclear weapons were missing.

Right now thousands of missiles are hidden away, literally out of sight, topped with warheads and ready to go, awaiting the right electrical signal. They are a collective death wish, barely suppressed. Every one of them is an accident waiting to happen, a potential act of mass murder. They are out there, waiting, soulless and mechanical, sustained by our denial—and they work.