Eric Schlosser - Command and Control

Iklé believed that, at the moment, the risk of accidental war was small. He thought the leadership of both the United States and the Soviet Union would carefully investigate the cause of a single detonation before launching an all-out attack. And he felt confident that America could withstand the loss of a major city without much long-term social or economic upheaval. But an unauthorized detonation in the United States or Western Europe could have “unfortunate political consequences.” It could fuel support for disarmament and neutrality, increase opposition to American bases overseas, weaken the NATO alliance, and facilitate “a peaceful expansion of the Soviet sphere of influence.” Indeed, the military and political benefits to the Soviet Union would be so great that it might be tempted to sabotage an American weapon.

“The U.S. defense posture could be substantially strengthened by nuclear weapon safeguards that would give a nearly absolute guarantee against unauthorized detonations,” Iklé concluded. He urged that more research be conducted on nuclear weapon safety, that new safety mechanisms be added to warheads and bombs, that Air Force personnel be screened more thoroughly for psychiatric problems. And he offered one solution to the problem of unauthorized use that seemed obvious, yet hadn’t been tried: put combination locks on nuclear weapons. That way they could be detonated only by someone who knew the right code. None of these measures, however, could make weapons perfectly safe, and the United States had to be prepared for accidental or unauthorized detonations.

In a subsequent RAND report, Iklé offered suggestions on how to minimize the harm of an accidental nuclear explosion:

If such an accident occurred in a remote area, so that leakage to the press could be prevented, no information ought to be made public…. If the accident has been compromised and public statements become necessary, they should depict the accident as an occurrence which has no bearing on the safety of other weapons. In some circumstances it might be treated as if it had been an experiment…. Internally, of course, information about the accident should not be suppressed.

An official “board of inquiry” should be established, headed by military experts and prominent politicians, as an “important device for temporizing.” Ideally, the board would take a few months to reach any conclusions:

During this delaying period the public information program should provide the news media with all possible news about rehabilitation and relief. There is always a strong and continued interest in such news after a disaster. Within a relatively short time the interest in rehabilitation tends to crowd out reports about destruction and casualties.

If an American bomber launched an unauthorized attack on the Soviet Union, Iklé argued that the United States should “avoid public self-implication and delay the release of any details about the accident.” Then it should begin secret diplomatic negotiations with the Soviets. Amid the tensions of the Cold War, thanks to a military strategy that made the United States and its NATO allies completely dependent on nuclear weapons, Iklé’s thinking reached a perverse but logical conclusion. After the accidental detonation of an atomic bomb, the president might have a strong incentive to tell the Soviet Union the truth — and lie to the American people.

FRED IKLÉ’S REPORTS ON nuclear weapon safety were circulated at the highest levels of the Air Force and the Department of Defense. But his work remained unknown to most weapon designers and midlevel officers. In 1958, Bob Peurifoy was a section supervisor at Sandia, working on the electrical system of the W-49 warhead. Development of the W-49 was considered urgent; lightweight and thermonuclear, the warhead would be mounted atop Atlas, Thor, and Jupiter ballistic missiles. During the rush to bring it into production, Peurifoy was surprised to read some of the language in a preliminary safety study of the W-49. “This warhead, like all other warheads investigated, can be sabotaged, i.e., detonated full-scale,” the Air Force study mentioned, in passing. “Any person with knowledge of the warhead electrical circuits, a handful of equipment, a little time, and the intent, can detonate the warhead.” Peurifoy hadn’t spent much time thinking about nuclear weapon safety; his job at Sandia was making sure that bombs would explode. But the ease with which someone could intentionally set off a W-49 seemed incredible to him. It was unacceptable. And so was the Air Force’s willingness to rely on physical security — armed guards, perimeter fences, etc. — as the only means of preventing an unauthorized detonation.

Peurifoy decided that the warhead should have an internal mechanism to prevent sabotage or human error from detonating it. Plans were already being made to incorporate a trajectory-sensing switch into the new Mark 28 bomb, and Peurifoy thought that the W-49 should contain one, too. The switch responded to changes in gravitational force. It contained an accelerometer — a small weight atop a spring, enclosed in a cylinder. As g-forces increased, the weight pushed against the spring, like a passenger pushed back against the seat of an accelerating car. When the spring fully compressed, an electrical circuit closed, allowing the weapon to be detonated. In the Mark 28 bomb, the switch would be triggered by the sudden jerk of the parachutes opening. Peurifoy wanted to use the strong g-forces of the warhead’s descent to close the circuit. A trajectory-sensing switch would prevent the weapon from going off while airmen handled or serviced it, since the necessary g-forces wouldn’t be present on the ground. A skilled technician could circumvent the switch, but its placement deep within the warhead would make an act of sabotage trickier and more time consuming.

The Army didn’t like Peurifoy’s idea. A switch that operated as the W-49 warhead fell to earth, the Army contended, might somehow make the weapon less reliable. The Army also didn’t like what Sandia engineers called the switch: a “handling safety device” or a “goof-proofer.” Both terms implied that Army personnel were capable of making mistakes. Peurifoy thought that sort of thinking was sheer stupidity. But the Army ran the Jupiter missile program and had the final say on its fuzing and firing system. Under enormous pressure to complete the design of the warhead’s electrical system, Peurifoy said “to hell with it” and simply reversed the direction of the tiny springs. Now the switch would respond to the g-forces of the missile soaring upward — not those of the warhead coming down — and the Army couldn’t complain that its control of the fuzing and firing system was being challenged. To avoid any hurt feelings, Sandia renamed the switch, calling it an “environmental sensing device.”

At Los Alamos, the issue of one-point safety gained renewed attention as SAC began to fly planes with fully assembled weapons. A young physicist, Robert K. Osborne, began to worry that a number of the bombs carried during airborne alerts might not be one-point safe. Among those raising the greatest concern was the Mark 28, a hydrogen bomb with a yield of about 1 megaton. Any problem with the Mark 28 would be a big problem. The Air Force had chosen it not only to become the most widely deployed bomb in the Strategic Air Command, but also to serve as a “tactical” weapon for NATO fighter planes. In December 1957 the Fission Weapon Committee at Los Alamos had struggled to define what “one-point safe” should mean, as a design goal. If the high explosives of a weapon detonated at a single point, some fission was bound to occur in the core before it blew apart — and so “zero yield” was considered unattainable.