By Bruce Blair, March 2015
“A code consisting of eight zeroes has never been used to enable or launch a MM ICBM, as claimed by Dr. Bruce Blair.”
This assertion comes from a U.S. Air Force document specially prepared for the U.S. Congress to rebut my claim to the contrary [1]. In a nutshell, my claim was, and is, that prior to 1977 a panel inside Minuteman underground launch control centers used to electronically ‘unlock’ their silo-based strategic missiles had to be set to eight zeroes – 00000000 – prior to the crews turning keys to fire them. The crews knew this eight-digit code, and knew that the missiles under their command would not accept a key-turn launch command from them without it. Their launch checklists instructed them to double check that the ‘enable’ panel was set to all zeroes before they turned a switch that unlocked (enabled) their missiles.
The unclassified technical manual for Minuteman, effective June 1973, says that “missile enabling prepares the missile for recognition of execute launch commands ... The enable command is initiated at the PROGRAM CONTROL panel ...” [2]. A second panel called the LAUNCH ENABLE PANEL feeds a special code to the PROGRAM CONTROL panel. Here is a grainy picture of it. It shows eight ‘code insert thumbwheel switches’, all set to zeros [3]. As the manual says, “under normal conditions CODE INSERT thumbnail switches will be set at 00000000” [4].
On the right: The new panel with its thumbnail switches set to P7P7P7P7P7P7.
As I and thousands of other older launch crew members can attest, they remained at 00000000 during the (abnormal) firing process as well. As the picture shows, a triangular enable switch sits in the vertical position. During the firing sequence, a crew member simply turned it rightward by 45 degrees, at which point the “secure code for enable command is made available to PROGRAM CONTROL panel for enable command transmission [5].
In their missile launch checklist, Step #5 calls for a crew member to move the enable switch to ENABLE [6]. The checklist contains no reference to an unlock code, and no step for inserting any new codes into the thumbnail switch prior to flipping the enable switch.
What happened in 1977? The Strategic Air Command replaced the old enable panels with new ones requiring the crews, in the event of war, to dial into their thumbwheel switches an enable code transmitted to them in the launch order sent by higher authority. It no longer sufficed just to flip one switch. Real unlock codes needed to be received from an external source and inserted, and then the switch flipped, or else the missiles would ignore any launch signals from the crew. This represented a real change, one that introduced for the first time a technical obstacle to launching missiles without proper authorization.
The revised launch checklist found in the technical manual dated March 1, 1978, refers to unlock codes for the first time in the series going back to 1962. It states that “under normal conditions the CODE INSERT thumbwheel switches will be set at P7P7P7P7P7P7 [7]. Step 16A of this new checklist calls for a crew member to “Insert unlock code in CODE INSERT thumbwheel switches in accordance with SAC directives” [8] prior to flipping the enable panel switch [9].
The Air Force document spun for Congress shows the new panel with its thumbnail switches set to P7P7P7P7P7P7.
Congress is told that the enabling procedure requiring the crews to receive a code prior to launch was in place during the 1970s as well as later decades without so much as hinting at the truth that a critical change in hardware and procedure had been introduced in 1977 to strengthen safeguards against unauthorized launch.
What was behind the change? For many years SAC had wanted to reduce the size of the Minuteman crew force to save money. That meant a shrunken force would have to rotate back to combat alert duty more frequently, and in order to provide a dollop of relief to the overextended crews the Air Force decided to allow the on-duty crew members to nap during their alert shift.
Of course the crews had been sleeping on the job all along, in blatant violation of a critical safety rule known as the two-man rule, which required the presence of two qualified individuals (men or women) looking over each others shoulders whenever they came anywhere near nuclear weapons or their control mechanisms. The Air Force had turned a blind eye to this and innumerable other ‘field procedures’ that compromised nuclear security (the kind of violations that surfaced this past year to the great chagrin and embarrassment of the Pentagon). Now that SAC wanted to permit crew members to snooze on the job, it had to find a technical fix to compensate for relaxing its two-man rule.
The declassified 1977 SAC history gives a clear explanation of this effort, nicknamed Rivet Save, that the 2014 Air Force document sent to Congress chooses to omit in favor of pure obfuscation.
“The Rivet Save program required two modifications of launch control center (LCC) equipment to prevent unauthorized launch of the nuclear-armed Minuteman ICBM while one crew member slept. First, SAC needed to eliminate the LCC’s independent launch capability by removing the launch enable code from the LCC. Then, SAC would install a re-modeled LCC Launch Enable Control Group (LECG) panel which could enable the missile, only after receiving the SIOP [author’s note: this acronym refers to the strategic war plan and execution procedures] unlock code. This code was not present in the LCC but would be sent to the missile crew in an emergency action message (EAM) authorizing missile launch” [10]. (Such nuclear strike orders which include the unlock code are the length of a tweet!).
The Air Force misled the Congress. It dodges the truth with regularity, and, hiding behind a thick wall of secrecy, gets away with it. In the case of Minuteman safety and security, Air Force’s dissembling goes all the way back to 1962 when the missile was first deployed (during the Cuban missile crisis).
A recent book recounts the Air Force’s assertion in 1962 that Minuteman safety was perfect [11].
Soothing rhetoric, perhaps, but the 1962 Minuteman crew member manual warns [12]:
“If the VRSA [author’s note: this is a missile malfunction reporting system] report indicates a programmer launch acceptance alarm, the level of safety provided to prevent inadvertent launch is seriously degraded. Approximately half of the conditions required for launch have been satisfied and a single error or additional malfunction could initiate a countdown sequence. The following action should be accomplished immediately in the event of programmer launch acceptance alarm: ... Calibration of the missile will prevent inadvertent launch for a period of approximately two hours and forty minutes ...”
Less than three hours until doomsday, by SAC’s own admission. Then what? SAC had nothing else up its sleeve other than rushing a security team to the silo, parking its truck on top of the silo lid with the gearbox in neutral, and praying it would fall into the silo and crush the missile when the lid blew sideways prior to lift-off. (This truck trick was performed a number of panicky moments during the Cold War for a variety of reasons including spurious indications at the underground launch centers indicating an inadvertent launch in progress.)
The Air Force will dismiss this as ancient history, but consider a list of so-called “Dull Sword” incidents involving Air Force nuclear weapons for 2009-2013 pried loose through a Freedom of Information Act request. This bill of goods lists nearly 1,500 reportable incidents. They involved everything from mechanical failures of weapons or the equipment used in handling them, to lapses of security, to violations of nuclear weapon safety rules – intentional violations in some instances.
The Air Force loses credibility and respect when it presents false or misleading information on its nuclear fail-safe procedures. Congress should take down names, repudiate the dissembling, and set the record straight.
Notes
[1] The full document and accompanying article by Dan Lamothe is available at foreignpolicy.com.
[2] Weapon System Operation Instructions, Technical Manual T.O. 21M-LGM30F-1-2, June 21, 1969, Change 34, June 13, 1973, p. 2-12, Para. 2-84.
[3] Ibid., p. 1-81, Figure 1-38.
[4] Ibid., p. 3-5, Para. 3-33A.
[5] Ibid., p. 1-82, Figure 1-38.
[6] Ibid., p. 3-64, Para. 3-67.
[7] Minuteman Weapon System Operation Instructions, Technical Manual T.O. 21M-LGM30G-1-10, Nov. 21, 1975, Change 14, March 1, 1978, p. 3-6, Para. 3-22.
[8] Ibid., p. 3-98.
[9] Watch a crew member perform this procedure: youtu.be/jlPEBROvR9w?t=512.
[10] History of Strategic Air Command, 1 January – 31 December, 1977, Volume I, Narrative, Office of the Historian, HQs SAC, August 25, 1978, p. 392.
[11] Eric Schlosser, Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety (New York: Penguin Books, 2013).
[12] Weapon System Operational Checklist, Technical Manual T.O. 21-SM80A-CL-1-1, May 1, 1962, Changed Dec. 30, 1962, p. 35.