Nuclear launch codes

There are many variants of the famed 'nuclear launch codes' that have achieved Cold War Mythos status through movies such as Wargames, Dr. Strangelove, Fail-Safe, Crimson Tide, and others. In reality (as near as can be described) the truth is usually more complex, and not as romantic.

First of all, the actual message sequences themselves that come in to the actual launch stations (the ICBM LCCs, the SSBNs, the bomber bases) are not typically directly used to activate the weapon. They typically are merely means of authentication that verifies an accompanying order to take an unthinkable action. I mean, really, to paraphrase the unknown missileer in the opening sequence of Wargames, 'Before I kill a hundred million people, I wanna get somebody on the fucking phone.'

So. There are codes which are used to physically unlock the weapons, which are (one hopes) disabled through the installation of PALs, or Permissive Action Links. However, typically these codes are prepositioned at the launch site, with access to them blocked through discipline and observation or perhaps another set of codes which would be broadcast. Usually, they are secured in a safe of some sort, to which the crew has access. Although the crew does usually know the combination or have keys to the safe, there is a rule called the Two-Man Rule or the No Lone Zone, which states that no single person is ever left alone within reach of either the arming/firing mechanism or the weapon itself.

Here are the mechanisms of which I am personally aware.

ICBM (Minuteman, MX, etc.)

The sole survivors of the U.S.'s land-based missile forces as the MX missiles are retired, the Minuteman-III and Minuteman-II weapons are deployed in squadrons throughout some of the more rural areas of the U.S. (The MX, what few are deployed, are presently housed inside converted Minuteman launch facilities). In these cases, there are typically three to four-man crews (perhaps pairs sometimes) who are in the hot seat at any given time. This usually means there are two missile crewmen (perhaps more), who in the case of U.S. ICBMs are Air Force officers, in the LCC (Launch Control Center) at all times. In the countless drills that occur, and in the hopefully never-to-arrive moment of truth, a message will arrive electronically inside the LCC through a secured communications link (usually ending up at a teletype). It will contain instructions and authentication codes. The crewmen will verify the authenticity of the message (called an EAM, for Emergency Action Message) using their on-site cryptography - typically, comparing the codes on the message to a set of pre-deployed ones kept in the safe. The safe requires both officers to use keys (which they wear about their necks at all times) in order for it to open.

Once the message has been verified as authentic, the officers begin to carry out whichever preplanned operation the message is directing them to complete. This typically includes bringing their missiles to launch readiness (or, in the case of a drill, performing simulations of doing this) and either executing a predetermined plan at a specific time, or awaiting further instructions.

I do not know the forms of the EAMs or of the verification codes in the safe, and wouldn't write 'em down if I did. :-) So in any case, there are a few sets of codes here. I would surmise that 'The Football' - the locked case carried near the President by a designated officer known as The Bag Man - contains actual formatted EAMs, indexed by op plan. This is because the President is kept as much as possible near communications systems which can inject EAMs directly into the secure communications net to be distributed to the 'end users' - Air Force One contains such systems, as (obviously) do the White House and whatever base of operations the President's security detail is occupying if he is not near the airplane.

Ballistic Missile Submarines

From what submariners have told me, Crimson Tide actually came close in terms of procedure, although much of it was bunk ("we can't prevent them from launching!" - wrong; simply maintaining the submarine at a speed, depth or attitude outside the fairly narrow required conditions for launch would do that ). However, the submarines are a complex problem in that communications with them is typically difficult. As a result, the subs rely even more on short code group messages (EAMs) for technical reasons. The only reasonably reliable means of communicating with a submerged submarine is to use Very Low Frequency (VLF) or Extremely Low Frequency (ELF) radio waves (at least, the only publicly-acknowledged means; satellite-based blue-green lasers are likely under research if not deployed). These means of communicating have such low frequencies that they can only send a few bits of information per second, and require football-field-sized antenna arrays (presently I believe there's one somewhere central, like Wisconsin? ...and a few others scattered around, like at Pearl Harbor and in the Northeast) to transmit.

In any case, there is pressure to use as few characters as possible to make a verifiable message, so the EAM would be sent to the submarine. That's the first code, simply knowing the message format, frequency and identification codes for the particular submarine and time. Once the message is received, it must be authenticated inside the submarine. This requires another twin-lock safe to be opened, with keys kept by two different officers. Once the EAM has been authenticated with the codes within, the captain of the boat will order the directed actions be taken.

In order to launch missiles from a U.S. ballistic missile submarine, the weapons officer (called Weps, in U.S. navy tradition) must remove the trigger mechanism from another safe in the fire control compartment. I do not know if that safe is a two-man deal as well. The launch mechanism is, in fact, as shown in Crimson Tide, a metal pistol grip with a button on it and a telephone-like cord to plug it into the console. Yes, it's painted red - at least the one shown in the Discovery Channel special on boomers was. After the submarine has been brought to firing readiness (which takes concerted action on the part of a great percentage of the crew) then the fire control systems are brought up, the missile doors opened, and the missiles' launch mechanisms and motors armed, and the PALs given their unlock codes. The trigger mechanism actually activates the gas system pyrotechnics which eject the missile from the launch tube. Once it has cleared the tube, its onboard systems fire its motors and off it goes. This brings up another point against Crimson Tide, as submariners have told me - given that the boat had suffered a torpedo hit, one of the damage control procedures against flooding involves shutting down the hydraulic systems which would be used to open the missile doors. I presume this is either to preserve high-pressure hydraulics for countering flooding or other critical damage control operations, or to avoid catastrophic failures.

So, in the case of the subs, there are multiple 'codes' which must be used, from EAMs to ID codes on the communications systems to safe combinations and the final PAL unlock. There is some debate at the civilian analyst level as to whether any sort of nuclear launch authority is predelegated to missile boat commanders, so that (for example) if they were unable to contact the U.S. and had a pretty good idea that something bad had happened, they could launch on their own initiative. While on one hand this is a good idea if you're advertising your missile submarines as a highly survivable, secure second-strike platform (because just taking out their commanders and/or communications won't save you - eventually they'll come up and phone home, or try), it is also a potentially bad idea. If your goal is to maintain positive control over the weapons from a central authority, then it might be better to run the risk of being unable to easily get a message to the boats in the event of an attack, especially if you are confident enough in the communications links that you feel no matter what, some sort of message will eventually get through. Of course, it also means that an independent (small) group of men, or a man, has the ability to launch.

The Bombers

Bombers have PALs on their weapons as well (typically missiles of some sort, either SRAMs or ALCMs), and these codes might certainly be transmitted with the EAM. However, the bomber forces typically operate in a fail-safe manner; once they take off from their bases (this is called 'flushing the bombers', as one might flush pheasants or other game birds) they must receive additional verified instructions to continue with their mission. The advantage is two-fold; one, they can be launched as a 'statement of intent' without actually using them, and two, the minimal time of the initial reaction - to launch - allows them a better chance of escaping strikes on their bases.

So, in the case of the bombers, the 'codes' are probably least prevalent, because delivering the weapons (starting with surviving an inbound attack) is so complex, a great deal of positive action is required to even get them into a position to carry out an attack. There are PALs on the weapons themselves; I do not know if those are unlocked on the ground or in the air; I'm sure the actual 'arming' of the bomb occurs in the air, but the links themselves could be done at any point.

Whew. Sick of me yet? Heh. In any case, this is one noder's construction of the U.S.'s present nuclear release procedures - at least, the emergency ones. I'm sure that there are 'normal' channels to activate and transport or release single weapons which do not use such high-stress communications.

One last thing. I have been asked many times what happens if the arming code is not received, or if the fire control system malfunctions and locks out the crew, things like that. I have it on good authority (two LCC crewmen, one bomber navigator and a submariner) that one of the most frequent form of drills is the 'disabled launch' - that is, the crew must overcome an abnormal handicap and still launch their weapon. This typically applies most to the land-based missiles, whose survival time in the event of a war can be measured in minutes if they don't manage to launch before the attack lands. In any case, they are trained and drilled on bypassing the security systems, repairing the systems, and in general doing whatever needs to be done to get the missile off in the event they need to. As such, then, I am confident in saying that (especially during any sort of alert) a small number of people could, in fact, launch weapons.

While the recent lower levels of alert might mean that actual PAL codes have been removed from the launch sites and bomber bases, rendering their unauthorized activation difficult without time and expertise to bypass the PALs, I have no doubt that some of them remain on the submarines. There was a surprisingly public debate within the Navy on the issue of 'de-alerting' and what it meant for submarines; the more conservative officers and analysts held that stronger locking systems on the codes, which would require more time and people to bypass without the access code (which would be transmitted in) would be enough. This way, the submarine would still be self-contained; however, the process of launching would become much more difficult without an EAM, and longer even with one. More radical folk championed the notion of actually removing the codes from the boats altogether, relying on enough warning or 'heightened alert' time before the event to redistribute them, and/or a robust enough communications system to ensure their accurate and safe transmittal during the event.

So, if you happen to find a briefcase with handcuffs on it near the President, be safe and just back away from it, mmmkay?

This information is provided for curiosity's sake only; do not use it to plan a war. Even if I knew the full answers, I wouldn't put 'em here. This is just a sketch of some of the procedures and obstacles that are involved in actually using these things.

Sources:

• Command and Control of Nuclear Forces, by Bruce Blair of the Brookings Institute. A must-read in the C³I field.
• Submarines: Sharks of Steel, The Discovery Channel. A sobering and fascinating look at an alien world.
• Interviews with multiple military personnel, including launch officers from the ICBM and Bomber arms of the triad, and crewmen (not Weps officers) from the submarine forces. No, you can't have their names. No, what they told me wasn't classified.
• Various government documents and analyses available in the open press on the subject of secure and reliable C3I, from sources such as The Rand Corporation, SAIC, Air Force Academy, STRATCOM and others.

This node brought to you by The Knowledge Militia.