Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety

by Eric Schlosser

Sheriff Anglin had gone out there to see what was happening, bumped into an Air Force security officer near the fence, and asked him whether there was any need to evacuate. Nope, everything is under control, the security officer had said. The sheriff got on his radio and ordered an evacuation of all the homes within a mile of the launch complex.

The United States does not have an intercontinental missile, otherwise it would also have easily launched a satellite of its own. . . . Now we are capable of directing a rocket to any part of the earth and, if need be, with a hydrogen warhead . . . it is not a mere figure of speech when we say we have organized serial production of intercontinental ballistic rockets . . . let the people abroad know it, I am making no secret of this—that in one year 250 missiles with hydrogen warheads came off the assembly line in the factory we visited. . . . The territory of our country is immense. We have the possibility of dispersing our rocket facilities, of camouflaging them well. . . . Two hundred rockets are sufficient to destroy England, France, and Germany; and three hundred rockets will destroy the United States. At the present time the USSR has so many rockets that mass production has been curtailed and only the newest models are under construction.

Khrushchev had condemned Stalin’s crimes in 1956, released political prisoners, gained a reputation as a reformer, and proposed a ban on nuclear weapons in central Europe. But he’d also ordered Soviet troops to invade Hungary and overthrow its government. More than twenty thousand Hungarian citizens were killed by the Red Army, and hundreds more were later executed. The thought of Khrushchev in command of so many long-range missiles seemed chilling.

During an airborne alert, American bombers would take off and fly within striking distance of the Soviet Union. If the planes failed to receive a “Go” code, they’d turn around at a prearranged spot, circle for hours, and then return to their bases. The plan erred on the side of safety—a breakdown in communications between SAC headquarters and one of the bombers would end its mission without any bombs being dropped. The mission would “fail safe,” an engineering term for components designed to break without causing harm. The fail-safe measures of an airborne alert could reduce the effectiveness of SAC’s nuclear retaliation, once America was at war: bombers that didn’t receive a Go code would circle and then return home, leaving their targets untouched. But the alternative—an airborne alert in which crews were ordered to fly to the Soviet Union and bomb it, unless they received some sort of “Don’t Go” code from headquarters—could easily start a war by mistake. That sort of mission was bound, at some point, to “fail deadly.”

One of the many challenges that the designers of the Titan II faced was how to bring the warhead close to its target. The Titan II’s rocket engines burned for only the first five minutes of flight. They provided a good, strong push, enough to lift the warhead above the earth’s atmosphere. But for the remaining half hour or so of flight, it was propelled by gravity and momentum. Ballistic missiles were extraordinarily complex machines, symbols of the space age featuring thousands of moving parts, and yet their guidance systems were based on seventeenth-century physics and Isaac Newton’s laws of motion. The principles that determined the trajectory of a warhead were the same as those that guided a rock thrown at a window. Accuracy depended on the shape of the projectile, the distance to the target, the aim and strength of the toss.

The short-range V-2 had been the first missile to employ an inertial guidance system, and the Nazi scientists who invented it were recruited by the Army’s Redstone Arsenal after the Second World War. They later helped to give the Jupiter missile an impressive Circular Error Probable—the radius of the circle around a target, in which half the missiles aimed at it would land—of less than a mile. But the longer a missile flew, the more precise its inertial guidance system had to be. Small errors would be magnified with each passing minute. The guidance system had to take into account factors like the eastward rotation of the earth. Not only would the target be moving toward the east as the world turned, but so would the point from which the missile was launched. And at different latitudes, the earth rotates at slightly different speeds. All these factors had to be measured precisely. If the missile’s velocity were miscalculated by just 0.05 percent, the warhead could miss its target by about twenty miles.

The accuracy of a Titan II launch would be determined early in the flight. The sequence of events left no room for error. Fifty-nine seconds after the commander and the deputy commander turned their keys, the Titan II would rise from the silo, slowly at first, almost pausing for a moment above the open door, before shooting upward, trailed by flames. About two and a half minutes after liftoff, at an altitude of roughly 47 miles, the thrust chamber pressure switch would sense that most of the oxidizer in the stage 1 tank had been used. It would shut off the main engine, fire the staging nuts, send stage 1 of the missile plummeting to earth, and ignite the stage 2 engine. About three minutes later, at an altitude of roughly 217 miles, the guidance system would detect that the missile had reached the correct velocity. The computer would shut off the stage 2 engine and fire small vernier engines to make any last-minute changes in speed or direction. The vernier engines would fire for about fifteen seconds. And then the computer would blow the nozzles off them and detonate an explosive squib to free the nose cone from stage 2. The nose cone, holding the warhead, would continue to rise into the sky, as the rest of the missile drifted away.

About fourteen minutes later, the nose cone would reach its apogee, its maximum height, about eight hundred miles above the earth. Then it would start to fall, rapidly gaining speed. It would fall for another sixteen minutes. It would reach a velocity of about twenty-three thousand feet per second, faster than a speeding bullet—a lot faster, as much as ten to twenty times faster. And if everything had occurre...

In addition to creating an accurate guidance system, missile designers had to make sure that a warhead wouldn’t incinerate as it reentered the atmosphere. The friction created by a falling body of that size, at those speeds, would produce surface temperatures of about 15,000 degrees Fahrenheit, hotter than the melting point of any metal. In early versions of the Atlas missile, the nose cone—also called the “reentry vehicle” (RV)—contained a large block of copper that served as a heat sink. The copper absorbed heat and kept it away from the warhead. But the copper also added a lot of weight to the missile. The Titan II employed a different technique. A thick coating of plastic was added to the nose cone, and during reentry, layers of the plastic ablated—they charr...

During the same week that Kennedy appealed for an end to the arms race at the United Nations, he met with a handful of military advisers at the White House to discuss launching a surprise attack on the Soviet Union. General Thomas Power encouraged him to do it.

American tanks were sent to Checkpoint Charlie as a show of strength. Soviet tanks appeared there at about five in the evening on the twenty-seventh. The British soon deployed two antitank guns to support the Americans, while all the French troops in West Berlin remained safely in their barracks.

McNamara’s remarks were partly aimed at the French, who planned to keep their nuclear weapons outside of NATO’s command structure. By acting alone during a conflict with the Soviet Union, France could threaten the survival of everyone else.

After examining the launch procedures proposed for the Minuteman, John H. Rubel—who supervised strategic weapon research and development at the Pentagon—didn’t worry about the missiles being duds. He worried about an entire squadron of them being launched by a pair of rogue officers. A Minuteman squadron consisted of fifty missiles, overseen by five crews housed underground at separate locations. Only two of the crews were necessary to launch the missiles—making it more difficult for the Soviet Union to disable a squadron by attacking its control centers. When both of the officers in two different centers turned their keys and “voted” for a launch, all of the squadron’s missiles would lift off. There was no way to fire just a few of them: it was all or nothing. And a launch order couldn’t be rescinded. After the keys were turned, fifty missiles would leave their silos, either simultaneously or in a “ripple order,” one after another.

The idealism and optimism that had accompanied Kennedy’s inauguration were long gone. The new strategy was grounded in a sense of futility. It planned to deter a Soviet attack by threatening to wipe out at least “30% of their population, 50% of their industrial capacity, and 150 of their cities.” McNamara’s staff had calculated that the equivalent of 400 megatons, detonated above the Soviet Union, would be enough for the task. Anything more would be overkill. Informed by a reporter that the Soviets were hardening their silos to protect the missiles from an American attack, McNamara said, “Thank God.” The move would improve “crisis stability.” Once the Soviets felt confident that they could retaliate after being attacked, they’d feel much less pressure to strike first. Leaving the cities of the United States and the Soviet Union vulnerable to annihilation, McNamara now thought, would keep them safe. The strategy was soon known as MAD: “mutually assured destruction.”

The plans for a Deep Underground Command Center were scrapped after Kennedy’s death. The bunker had a good chance of surviving multiple hits from Soviet warheads. But its survival would prove meaningless. After an attack the president and his aides would most likely find themselves trapped two thirds of a mile beneath the rubble of the Pentagon, unable to communicate with the rest of the world or even get out of their bunker. The facility would serve primarily as a multimillion-dollar tomb.

Although the human toll would be grim, the authors of the report were optimistic about the impact of nuclear detonations on the environment. “No weight of nuclear attack which is at all probable could induce gross changes in the balance of nature that approach in type or degree the ones that human civilization has already inflicted on the environment,” it said. “These include cutting most of the original forests, tilling the prairies, irrigating the deserts, damming and polluting the streams, eliminating certain species and introducing others, overgrazing hillsides, flooding valleys, and even preventing forest fires.” The implication was that nature might find nuclear warfare a relief.

The reliability of America’s early-warning system attained an existential importance. If the sensors failed to detect a Soviet attack, the order to launch might never be given. But if they issued an attack warning erroneously, millions of people would be killed by mistake.

SAC was far more worried about its weapons being rendered inoperable during wartime than about someone stealing them or using them without proper authorization.

As they neared the complex, a large cylindrical object appeared in the road. Well, damn, there’s the warhead, Green thought. He carefully drove around it.

The sense of powerlessness and dread, the need to take some sort of action and halt the arms race, led to a nuclear version of the Stockholm syndrome. Throughout Western Europe, protesters condemned American missiles that hadn’t yet arrived—not the hundreds of new Soviet missiles already aimed at them.

The sociologist Charles B. Perrow began his research on dangerous technologies in August 1979, after the partial meltdown of the core at the Three Mile Island nuclear power plant. In the early minutes of the accident, workers didn’t realize that the valves on the emergency coolant pipes had mistakenly been shut—one of the indicator lights on the control panel was hidden by a repair tag. Perrow soon learned that similar mistakes had occurred during the operation of other nuclear power plants. At a reactor in Virginia, a worker cleaning the floor got his shirt caught on the handle of a circuit breaker on the wall. He pulled the shirt off it, tripped the circuit breaker, and shut down the reactor for four days. A lightbulb slipped out of the hand of a worker at a reactor in California. The bulb hit the control panel, caused a short circuit, turned off sensors, and made the temperature of the core change so rapidly that a meltdown could have occurred. After studying a wide range of “trivial events in nontrivial systems,” Perrow concluded that human error wasn’t responsible for these accidents. The real problem lay deeply embedded within the technological systems, and it was impossible to solve: “Our ability to organize does not match the inherent hazards of some of our organized activities.” What appeared to be the rare exception, an anomaly, a one-in-a-million accident, was actually to be expected. It was normal.

The instinct to blame the people at the bottom not only protected those at the top, it also obscured an underlying truth. The fallibility of human beings guarantees that no technological system will ever be infallible.

A command-and-control system designed to operate during a surprise attack that could involve thousands of nuclear weapons—and would require urgent presidential decisions within minutes—proved incapable of handling an attack by four hijacked airplanes.

Nuclear weapons have gained allure as a symbol of power and a source of national pride. They also pose a grave threat to any country that possesses them.