Defense: Dr. Strangelaunch

Who really controls the weapons in Russia and the other nuclear republics?

Stalled in traffic on San Francisco's teeming Bayshore Freeway, I couldn't help but notice the faded, decade-old bumper sticker on the car ahead of me: "Nuke the Whales!" Prophetic, I thought, now that the United States is aiming its nuclear-tipped missiles away from Russia and pointing them at the world's oceans. The Russians have given their word that they're doing the same, all in the name of reduced tensions and a new world order.

Unfortunately, you can't tell by looking whether a missile is aimed at a city or a sea-going mammal. There's also no way of verifying the Russians' longstanding claim that their nuclear-weapon firing procedures are just like ours. These two facts–troubling in the most restive of times–are extremely disturbing given recent developments indicating that the Russians are simultaneously bulking up on nuclear weapons and prevaricating about their nuclear fail-safe programs.

A number of recent statements and ongoing activities suggest reasons for concern:

• Last November, Russian Defense Minister Pavel S. Grachev rescinded Mikhail S. Gorbachev's pledge never to be the first to use nuclear weapons. Grachev's announcement came, interestingly enough, right on the heels of the Clinton administration's own "no first use" vow.

• In August 1992, Russia passed a law keeping foreigners out of areas where weapons of mass destruction are developed. And the 100,000 Russian nuclear-weapons experts living in the 10 closed cities where the weapons are built have been barred from traveling abroad.

• Despite a severe economic crisis, Russia continues to modernize its offensive nuclear forces. Road-mobile SS-25 missiles roll off the assembly line in an effort to reach the START II-mandated limit of 1,100 mobile ICBMs. The United States-led coalition forces' quick success in the Gulf War over Iraq's Soviet-supplied air defenses, tanks, and jet fighters did not escape the attention of the Russian high command. While coalition air power knocked out all of Iraq's fixed-base Scud missiles, it failed to destroy a single mobile Scud launcher. The easiest way to offset the West's technological advantage in conventional arms is to maintain a potent nuclear arsenal, with much of it mobile.

• Although the vast Soviet navy remains anchored in the Black Sea, nuclearfiring boomer submarines continue their silent sea patrols. Russian subs that can strike U.S. cities with as little as eight minutes' warning remain on station off both our Atlantic and Pacific coasts. Construction continues on underground command centers in the Ural Mountains containing upgraded communication systems that can transmit a launch order to submerged submarines.

• At a recent talk sponsored by Stanford's Center for International Security and Arms Control, Victor Nefedov, 1970 graduate of Leningrad University and a one-time designer of Soviet missile warheads, extolled the economics of atomic bombs. "Even though the Cold War is over, Russia will continue to defend itself with nuclear weapons," explained Nefedov. "In terms of cost per pound of explosive yield, nuclear weapons are much less expensive than conventional weapons."

Other recent events, such as the ballot-box success of nationalist hard-liner Vladimir Zhirinovsky and the arrest of Kremlin mole Aldrich H. Ames, don't inspire confidence in the stability and credibility of post-Soviet Russia. Neither does the anti-West slant of Moscow's recent return to international politics. First, Russia successfully derailed NATO membership for former captive states in Eastern Europe. Then it suddenly deployed 400 soldiers to Bosnia-Herzegovina, severely limiting NATO's options in silencing Serbian artillery. Should this move toward regaining superpower status continue or should civil war erupt in one of the four nuclear republics–Kazakhstan, Ukraine, Belarus, and Russia–the question of who really controls the former Soviet Union's 27,000 nuclear weapons will be of even greater concern.

Western governments have virtually no firsthand knowledge of Russian nuclear-weapon launch controls. The only thing they know for sure is that they don't really know that much–a good enough starting point for a philosophical dialogue perhaps, but a frightening prospect for policy makers. What little knowledge has been verified tends to confirm the worst-case scenario of Russia as not fully in control of its own nuclear arsenal.

It turns out, for instance, that the positive control procedures of the United States and Russia aren't as similar as once thought. While the United States has made accidental nuclear strikes more and more difficult by complicating the launch sequence, Russia has delegated that authority among various competing political forces and invested its safety in a beyond-the-grave automatic firing mechanism.

The hotline connecting Washington and Moscow, established in 1963, was judged a giant step on the road to nuclear sanity because, it was then believed, only the presidents of the two superpowers could authorize a nuclear attack. That comforting myth was shattered in 1991, when, during an attempted coup, insurgents seized a briefcase containing nuclear launch codes at Mikhail Gorbachev's Crimean dacha.

Not to worry, we were told. A second set of codes is required to launch Russian rockets, and it belongs to the minister of defense. But if that report is correct, the consequences are even more alarming. The existence of a second set of release codes may well indicate that either the military or political leadership has authority to commit nuclear weapons.

Later, when Western leaders wondered aloud about who controlled the weapons deployed in potentially rebellious nuclear republics, yet another version of positive control procedures surfaced. Aides to Boris Yeltsin revealed the existence of multiple keys requiring both the central government and the leadership of the four nuclear republics to collaborate on a launch decision. This committee approach pushes the outer limits of credibility. Reaction time is the key to survival in the launch-or-lose reality of a nuclear exchange. Since a missile can fly halfway around the world in 30 minutes, there simply isn't time for conference calls and political deliberations when a country's very existence is at stake. There's no way a nuclear power can rely on a committee approach to nuclear launches.

The most recent revelation, and the most troubling, is acknowledgment of a doomsday machine capable of automatically launching nuclear missiles if a preemptive attack by the United States incapacitates the Russian high command. This "dead man's throttle" shocked Western leaders and brought back memories of the novel Fail Safe, in which Strategic Air Command bombers were unleashed on Moscow because of a computer glitch. The U.S. Congress has always insisted on a man-in-the-loop policy for commitment of both tactical and strategic nuclear weapons. Devolution of command from humans to mechanical devices, as in the case of Russia's doomsday machine, is the stuff of science fiction, not of responsible superpowers. Especially in a country where almost nothing works as it is supposed to, computer-controlled nuclear firing machines are a terrifying concept.

We know a lot more about the U.S. system, though parts of it remain shrouded in secrecy. Perhaps the best perspective comes not from politicians or top Pentagon brass but from crew members entrusted with day-to-day operations of nuclear bombers and missiles. Those who serve on the front lines of Armageddon can testify that positive control safeguards have become progressively more stringent for U.S. systems. When I commanded a Minuteman ICBM combat crew in South Dakota from 1966 to 1970, safety resided primarily with the crews themselves rather than mechanical devices. Positive control was no better or no worse than the integrity of the people entrusted with superweapons. Unauthorized launch was a physical possibility, and we knew it.

For example, if two on-alert crews in the same Minuteman squadron of 50 missiles and five manned launch-control centers conspired to launch their missiles, no one could have stopped them. The other crews could counter the launch order of a single renegade crew with an inhibit command, but once two launch votes were registered, the missiles would enter terminal countdown and head for their targets.

We idled away the years obediently waiting for an order only the president could send. Here, too, the system was based on trust. We had no way of knowing whether an execution message–a series of scrambled letters and numbers we were trained to decode–actually came from the president. The launch execution message had to contain a "go code" we believed resided as a complete set only in a top-secret cache known as the "football," which the president alone could access.

The go code, like the pirate's map in Robert Louis Stevenson's Treasure Island, was split into halves before being distributed to field units. Each control center had either the "A" or the "B" half. Had we received a strike order, each crew would have unlocked a small red safe and broke open a sealed envelope with half the code. If it matched the message, the crew would contact its counterpart who had the other half. If both pieces were valid, it was World War III.

In the late 1970s, technology permitted the incorporation of mechanical safeguards called "permissive action links" that were placed between crew members and nuclear-weapon systems. As it stands now, no missile will respond to a launch command unless a double-digit PAL code is first dialed into a cipher lock and then electronically transmitted to the silo. Of course, the unlock code is top secret and closely held. If the president releases the go code, a subordinate military command post adds the PAL combination to the message before it is transmitted. While this new safeguard reduces the probability of an unauthorized launch during peacetime, it adds potentially overwhelming constraints to performing a wartime retaliation mission.

The additional minutes spent decoding and transmitting the unlock codes give an attacker a much greater opportunity to destroy U.S. missiles in their silos during a sneak attack. And if a single digit in the PAL cipher is out of order, no crew, even after receiving presidential authorization, can successfully initiate a counterattack. Many crews–all of whom are volunteers who meet demanding physical and psychological standards–think the additional safeguards are unnecessary for two basic reasons.

First, they see the PAL code as an attack on their personal and professional integrity. As much as anyone–in fact, perhaps more than anyone–they have an interest in avoiding accidental war. When I commanded my Minuteman crew, for instance, I knew that any action I took to launch missiles would result in an immediate counterattack obliterating the military base where my wife and daughters lived. Stationed 50 feet underground, with my only escape a narrow elevator shaft, I could, at best, expect to be buried alive minutes after any war I started began. From intelligence briefs, I knew full well that more than one Soviet missile had my launch-control center's coordinates programmed into its targeting program.

The second reservation comes from military knowledge. The primary targets in a nuclear World War III are enemy communications systems capable of transmitting execution commands. With no U.S. doomsday machine, if the Russians destroyed the redundant links between National Command Authority and bomber and missile crews, they could pull off a nuclear Pearl Harbor unscathed. Because of this capability, every second is particularly critical in a missile war. The lengthy PAL number sequence adds complexity and time to the retaliation process, handing an aggressor nation an advantage as it seeks out and tries to destroy communication nodes.

Despite all the technological protocols and all the arcane cryptography, the peacetime safety of nuclear weapons depends more on the integrity of the operators and their loyalty to their government than on mechanical devices and secret codes. Any code can be compromised, any mechanical device circumvented. That is precisely why the West watches anxiously as Ukraine and Russia spar over control of nuclear missiles based outside of Russia.

Will the operators support Moscow or Kiev in a showdown? Imagine a similar situation in the United States: The governor of North Dakota suddenly secedes from the country. He declares control over Minot and Grand Forks Air Force Bases, instantaneously making North Dakota the world's third largest nuclear power. But does he really control the 300 ICBMs stationed on North Dakota soil? He can't release the go code because it remains with the U.S. president. Conceivably, scientists at a state university, given enough time, could disable the PAL ciphers. Still, the renegade governor has to earn the launch crews' loyalty before he can truly command the missiles. Could that really happen in our society, where allegiance to the federal government is stronger than allegiance to an individual state? Not likely. In the former Soviet Union? That's anybody's guess.

Russia's doomsday machine underscores a major philosophical difference in superpower approaches to nuclear control. After a prolonged break in communications between the rocket forces and Moscow, several designated missiles would launch automatically. Once airborne, they would relay a coded launch order directly to more than 1,500 silos, bypassing the crews and causing a huge nuclear salvo against the United States.

The United States has developed a somewhat similar technique, called the Emergency Rocket Communications System, whose existence was declassified after the Berlin Wall fell. Like the Russian doomsday machine, ERCS uses missiles to relay a launch order during a crisis. There are important differences, however. ERCS is not automatic. If normal command links are severed between National Command Authority and missile crews during a nuclear war, a U.S. flying command post relays the launch order to a Minuteman missile configured with a radio transmitter rather than a warhead.

When launched, the ERCS missile flies an elevated trajectory over the United States, relaying the president's war plan and launch order to crews isolated from normal communications channels. The ERCS functions as a reserve communications system and cannot launch a missile. Even in the darkest moments of a nuclear exchange, people–as opposed to machines–retain command over U.S. retaliatory forces.

This is as it should be. Nuclear sanity resides more in the stability of governments and the integrity of operational crews than in mechanical controls. But until Russia and the other nuclear republics demonstrate that they have full control over the world's largest nuclear arsenal, it will be difficult to dissipate fully Cold War tensions.

Michael R. Boldrick is a retired Air Force colonel who writes on arms-control and strategic-warfare issues.