Daniel Ellsberg of Pentagon Papers fame recent published a book about his days as a nuclear war planner, The Doomsday Machine. Below are just a few of the bits I found interesting. (There were many others, but they were more difficult to excerpt.)
My first summer [at RAND] I worked seventy-hour weeks, devouring secret studies and analyses till late every night, to get up to speed on the problems and the possible solutions. I was looking for clues as to how we could frustrate the Soviet versions of RAND and SAC, and do it in time to avert a nuclear Pearl Harbor. Or postpone it. From the Air Force intelligence estimates I was newly privy to, and the dark view of the Soviets, which my colleagues shared with the whole national security community, I couldn’t believe that the world would long escape nuclear holocaust. Alain Enthoven and I were the youngest members of the department. Neither of us joined the extremely generous retirement plan RAND offered. Neither of us believed, in our late twenties, we had a chance of collecting on it.
Just one of many stories on how unreliable Ellsberg found command and control procedures to be:
To prevent unauthorized action by a single duty officer with access to Execute codes in any particular command post, there was a universal and supposedly ironclad rule that at least two such officers must be on duty at all times, day and night, and they must both be involved in, and agree on, the authentication of an order to execute nuclear war plans from a higher authority and on their decision to relay this order to subordinate commands… One way or another, each post purported to have arrangements so that one officer by himself could neither authenticate orders received nor send out authenticated Execute commands.
But in practice, not. As various duty officers explained to me, oftentimes only one man was on duty in the office. The personnel requirements for having two qualified officers sitting around in every such station at literally every moment of the night were just too stringent to be met. Duty rosters did provide for it, but not for backups when one officer “had” to be elsewhere—to get some food or for a medical emergency, his own or, on some bases, his wife’s. Did that mean that all subordinate commands would be paralyzed, unable to receive authenticated Execute orders, if the one remaining duty officer received what appeared to be an order to commence nuclear operations during that interval?
That couldn’t be permitted, in the eyes of the officers assigned to this duty, each of whom had faced up to the practical possibility of this situation. So each of them had provided for it “unofficially,” in his own mind or usually by agreement with his fellow duty officers. Each, in reality, had the combinations to both safes, after all, or some arrangement for acquiring them. If there was only one safe, each officer would, in reality, know the full combination to it. One officer would hold both envelopes when the other had to be away. Where there were more elaborate safeguards, the officers had always spent some of their idle hours late at night figuring out how to circumvent them, “if necessary.” They had always succeeded in doing so. I found this in every post I visited.