The subtitle of Eric Schlosser’s latest work of investigative journalism, “Nuclear Weapons, the Damascus Accident, and the Illusion of Safety,” well captures the increasingly editorial arc of the book. Its centerpoint is a thriller-like recounting of the run-up to a non-nuclear 1980 explosion in Damascus, Arkansas; but the retelling of that event is interleaved with a long-form historical review of the design and implementation of America’s nuclear arsenal in the middle of the twentieth century. By degrees over its half-thousand pages the prose becomes increasingly critical of that history, culminating with the dramatic explosion at Damascus and the state of nuclear weapons in the United States after the end of the Cold War.
Based heavily on primary source documents and original interviews Schlosser himself conducted with weapons scientists and some of those involved in the Damascus accident, I find the actual text to be overlong and meandering. I would have preferred a more condensed and linear exposition, but reasonable people can disagree: Louis Menand wrote in his colorfully titled New Yorker review “Nukes of Hazard” that this suspenseful, achronological, and deeply personal narrative style is “how nonfiction should be written.” What we can agree on is that Schlosser convincingly argues that given the stunning degree of cognitive dissonance, bureaucratic impenetrability, and sheer number of nearly catastrophic nuclear accidents that have happened over the years, it’s truly a wonder that the last large-casualty nuclear event was deliberate, during wartime, and more than 70 years ago.
The Titan II and Damascus
The first thing to notice about this book is the beautiful illustration of a Titan II missile complex on the interior cover. It was very useful for following the detailed play-by-play of the September 19, 1980 accident in Arkansas.
The Titan II, originally designed to have been retired in the early 1970s, was the core of the Soviet deterrent ICBM fleet. It was a liquid fuel missile designed during the Eisenhower administration that was kept underground fully fueled and armed at all times. This was so that the command crew — housed a quarter football field away beyond multiple blast locks designed to survive a Soviet attack as well as a total missile malfunction — could launch the missile almost literally at the press of a button if so ordered. Each site housed just a single missile that could be launched just once, but they were built in clusters across the country just far apart from each other so that no single attack was likely to disable more than a few but crews could still easily rotate between them from a nearby air base.
The accident — a true comedy of errors — happened because a single service team member dropped a socket from a socket wrench down the silo while conducting a routine fuel rotation. Accidents such as these were not uncommon, but this time the socket struck the first stage fuel tank, piercing its thin aluminum skin and causing a fuel leak. The team evacuated the silo, which began to flood with fuel vapors, but didn’t immediately communicate the accident to the control team. Meanwhile, their missile health sensors — routinely ignored to varying degrees because of copious false alarms caused from age and general disrepair — reported that there was simultaneously a fuel leak, an oxidizer leak, and a fire in the silo. That obviously couldn’t be because it would immediately lead to an explosion, which hadn’t happened, but investigating it was impossible. To save time during maintenance, one of the blast doors had been left jammed open to circumvent a failsafe whereby both major blast doors couldn’t be open at the same time, so that meant that fuel had leaked into the hallway linking the silo to the control room and compromised the protection suits stored there. The vent fan couldn’t be turned on because if there were a fire it would feed it. And the team on the surface with spare protection suits had also evacuated and couldn’t be reached on the radio.
Whatever else was true, the control room gauges did report a drop in the fuel pressure and a rise in the oxidizer pressure. That was probably because there was a fuel leak but not an oxidizer leak, so as the fuel escaped the temperature in the silo rose, increasing pressure on the oxidizer. That meant it was a race against time before either the oxidizer tank was crushed and pierced or the weight of the missile itself collapsed the fuel tank which by design required fuel pressure in order to support the upper stages. Under these conditions — an imminent explosion, inoperable blast doors, compromised protection suits, and no above-ground support in range — the air force command in Little Rock ordered a general evacuation of the control room through the escape ladder. An eventual reentry to the silo after support from the base was able to arrive hours later finally ended in disaster when the decision was made (seemingly off the cuff after reasoning that the leak had not yet caused an explosion) to spin up the vent fan and try to clear the toxic fumes. Sparks from the fan ignited the leaked fuel, violently exploding the missile’s upper stage (as well as much of the silo) and hurling the warhead into the air. It landed in a ditch outside the complex grounds and was nearly stepped on in the darkness during the frantic and confused response immediately following the explosion.
Command and Control
That nuclear weapons built and maintained by a government agency might be less than perfectly safe is not itself a shocking idea. More interesting to me were the historical details of how the awesome power of the US nuclear arsenal was developed. Atom bomb testing toward the end of WWII and the attacks on Hiroshima and Nagasaki were horrifying enough to engender a serious push for absolute civilian control of nuclear weapons, but persistent resistance from and a shocking degree of infighting between the navy and the air force rendered those efforts quickly moot. By the early 1950s the military had effective possession and control of nuclear weapons with virtually no discretion reserved to the president on their use. Even NATO had US nukes deployed throughout Europe with its own semi-autonomous launch authorization protocols. The Eisenhower-era plans called essentially for all-out global obliteration if any nuclear weapons were launched and, despite serious effort, the Kennedy and Johnson administrations were unable to wrest operational control.
Two warring camps had quickly emerged: those who wanted to ensure that the bombs always worked as advertised whenever called upon, and those who wanted to ensure that the bombs never worked at all unless called upon. The dichotomy here was due to technical limitations in roughly equal parts between launch authorization and warhead lifecycle: hence the book’s title, Command and Control. There is no shortage of horror stories about nuclear accidents being nearly caused or barely prevented because of a bad fuse or a lazy pilot as well as a heroic maneuver or a battle of diplomatic wits.
These technical challenges were not always surprises and they evolved over time. Here are some highlights:
- Nagasaki replaced Kyoto, a prime initial target for nuclear attack, because War Secretary Henry Stimson “insisted… that [Kyoto] had played too central a role in Japanese art, history, and culture to be wiped out.”
- Louis Slotin, a Los Alamos nuclear scientist, accidentally killed himself through a demonstration gone wrong in 1946 but demanded his demise be filmed for posterity rather than that he be euthanized ahead of what proved to be a grotesque and painful death over nine days.
- To hear Schlosser tell it, the Soviets basically caused the Truman Doctrine by “unsettling” the administration with post-war moves like looting Manchuria, delaying a withdrawal of troops from Iran, demanding Turkish territory, and imposing a puppet government in Poland.
- During the 1950s, bombs and their nuclear cores were separately stored in “igloos” at Air Force bases to prevent accidental detonation. A 1956 test-flight accident without any loaded nukes crashed into a bomb igloo and ripped it wide open. While it was ruled a “miracle” that high explosives didn’t go off, it was also good that the nuclear core igloo wasn’t instead struck because that might have scattered plutonium fallout across the countryside.
- W-47 warheads, widely deployed on Polaris submarines in the 1960s, were found not to be one-point safe, meaning they might go off by accident. They were then retrofitted with neutron absorbing boron tape to prevent core criticality until detonation when a motor would physically remove the tape. But that tape corroded over time and became stuck, and then the motor was too underpowered to remove it. As such, the Navy judged there was “almost zero percent confidence that the warhead would work as intended.” The entire fleet had to be refitted.
- In January 1968 a B-52 on secret nuclear alert crashed and burned on the ice near Thule Air Base in Greenland, north of the arctic circle. The force of the impact detonated the high explosives in all four Mark 28 nuclear bombs on board. Radioactive debris was scattered across three square miles and hundreds worked with only artificial light for months to clean it up. Part of one of the bombs was never found. Mark 28s were certified one-point safe, but an older model in such an accident would have probably caused a nuclear explosion.
- As mentioned, infighting between departments and divisions was endemic. The Navy opposed an Air Force defense plan as a power play to benefit the Navy. The laboratories at Los Alamos and Lawrence Livermore competed for adoption of their own bomb designs. Safety accidents weren’t reported to the laboratory at Sandia to protect the Air Force’s reputation. After being briefed about the Damascus accident, secretary of defense Harold Brown refused to confirm to Walter Mondale whether the missile had been armed until Mondale said “Goddamn it, Harold, I’m the vice president of the United States.”
Schlosser paints the picture of a shockingly disorganized and accident prone nuclear arsenal that at times isn’t safe enough or might even be “too safe.” The very basis of the mutual assured destruction doctrine seems questionable: how likely is it that we couldn’t launch a nuclear strike even if we wanted to? But Schlosser watched the launch of a weather satellite from Titan II missile in 1999 and his closing argument of the book references the anecdote:
Watching the launch, the imaginary became tangible and concrete for me. It rattled me. It pierced a false sense of comfort. Right now, thousands of missiles are hidden away, literally out of sight, topped with warheads and ready to go, awaiting the right electrical signal. They are a collective death wish, barely suppressed. Every one of them is an accident waiting to happen, a potential act of mass murder. They are out there, waiting, soulless and mechanical, sustained by our denial — and they work.
Published 2013, 611 pages.