The growing public anxiety about accidental war prompted a spirited defense of America’s command-and-control system. Sidney Hook, a prominent conservative intellectual, wrote a short book dismissing the fears spread by Cold War fiction. “The probability of a mechanical failure in the defense system,” Hook wrote in The Fail-Safe Fallacy, “is now being held at so low a level that no accurate quantitative estimate of the probability… can be made.” Senator Paul H. Douglas, a Democrat from Illinois praised the book and condemned the misconception that America’s nuclear deterrent was a grave danger to mankind, not “the Communist determination to dominate the world.” And Roswell L. Gilpatric, one of McNamara’s closest advisers, assured readers of the New York Times that any malfunction in the command-and-control system would make it “‘fail safe,’ not unsafe.” Gilpatric also suggested that permissive action links would thwart the sort of unauthorized attack depicted in Dr. Strangelove.
In fact, there was nothing to stop the crew of a B-52 from dropping its hydrogen bombs on Moscow — except, perhaps, Soviet air defenses. The Go code was simply an order from SAC headquarters to launch an attack; bombers on airborne alert didn’t have any technological means to stop a renegade crew. General Power had waged a successful bureaucratic battle against the installation of permissive action links in SAC’s weapons. All of its bombs and warheads were still unlocked, as were those of the Navy. The effort to prevent the unauthorized use of nuclear weapons remained largely administrative. In 1962, SAC had created a Human Reliability Program to screen airmen and officers for psychological problems, drug use, and alcohol abuse. And a version of the two-man rule was introduced in its bombers. A second arming switch was added to the cockpit. In order to use a nuclear weapon, both the ready/safe switch and the new “war/peace switch” had to be activated by two different crew members. Despite these measures, an unauthorized attack on the Soviet Union was still possible. But the discipline, training, and esprit de corps of SAC’s bomber crews made it unlikely.
As a plot device in novels and films, an airborne alert gone wrong could provide suspense. A stray bomber would need at least an hour to reach its target, enough time to tell a good story. But one of the real advantages of SAC’s bombers was that their crews could be contacted by radio and told to abort their missions, if the Go code had somehow been sent by mistake. Ballistic missiles posed a far greater risk of unauthorized or accidental use. Once they were launched, there was no calling them back. Missiles being flight-tested usually had a command destruct mechanism — explosives attached to the airframe that could be set off by remote control, destroying the missile if it flew off course. SAC refused to add that capability to operational missiles, out of a concern that the Soviets might find a way to detonate them all, midflight. And for similar reasons, SAC opposed any system that required a code to enable the launch of Minuteman missiles. “The very existence of the lock capability,” General Power argued, “would create a fail-disable potential for knowledgeable agents to ‘dud’ the entire Minuteman force.”
After examining the launch procedures proposed for the Minuteman, John H. Rubel — who supervised strategic weapon research and development at the Pentagon — didn’t worry about the missiles being duds. He worried about an entire squadron of them being launched by a pair of rogue officers. A Minuteman squadron consisted of fifty missiles, overseen by five crews housed underground at separate locations. Only two of the crews were necessary to launch the missiles — making it more difficult for the Soviet Union to disable a squadron by attacking its control centers. When both of the officers in two different centers turned their keys and “voted” for a launch, all of the squadron’s missiles would lift off. There was no way to fire just a few of them: it was all or nothing. And a launch order couldn’t be rescinded. After the keys were turned, fifty missiles would leave their silos, either simultaneously or in a “ripple order,” one after another.
