Stanley Kubrick’s 1964 film Dr. Strangelove depicts a deranged American general who exploits an emergency provision of the nuclear command system to launch an unauthorized attack on the Soviet Union. Intended to ensure that American nuclear forces can respond even if national command authorities are incapacitated, the provision becomes General Jack D. Ripper’s means of initiating nuclear war.
The resulting crisis exposes a second vulnerability. The bombers are instructed to disregard communications lacking the proper authentication code, a safeguard against enemy interference and fraudulent orders. But this protection also prevents legitimate authorities from recalling the aircraft until the code can be recovered. Procedures designed to ensure the execution of nuclear orders interfere with those intended to prevent their mistaken execution.
General Ripper uses delegated authority to launch a nuclear attack in the film “Dr. Strangelove.”
Kubrick’s satire illustrates a fundamental problem of nuclear command: safeguards against one kind of failure can create vulnerabilities to another. Arrangements that ensure the execution of authorized orders may compromise the ability to prevent unauthorized use. The reliability of individual safeguards does not establish the safety of the system as a whole.
More than six decades later, this problem remains unresolved. Nuclear weapons are controlled through elaborate arrangements involving political authorities, military commanders, communications networks, warning systems, and authentication procedures. These arrangements must accommodate emergencies, disrupted communications, uncertain information, and extreme time pressure. Yet many of their most consequential details remain classified, while their performance under the full range of possible crises cannot be comprehensively evaluated.
What Does Fail-Safe Mean for Nuclear Weapons?
In engineering, a fail-safe system is designed to respond to malfunctions or abnormal conditions in ways that minimize harm. An elevator brake engages when power is lost. A railway signal defaults to stop when its control circuit fails. Such arrangements do not eliminate every possible accident, but they establish a preferred condition when normal control is disrupted.
Nuclear weapons present a difficult safety engineering problem because there is no universally safe default condition. A system designed to prevent unauthorized nuclear use must ensure that weapons cannot be employed without valid authorization. Yet a system designed to guarantee nuclear retaliation must ensure that authorized orders can be executed even under extreme circumstances, including the destruction of command facilities, disruption of communications, or death of political leaders.
These requirements create the always/never dilemma: nuclear weapons must always function when legitimately ordered to do so, but must never function without legitimate authorization. Safeguards that prevent unauthorized use may obstruct legitimate orders, while arrangements that preserve the ability to launch under emergency conditions may create opportunities for unauthorized or mistaken employment.
The dilemma cannot be resolved simply by adding safeguards. Additional controls introduce procedures, equipment, communications dependencies, and decision points that may themselves become sources of failure. Redundancy, emergency delegation, and automation can mitigate particular vulnerabilities while introducing others.
Nor does valid authorization establish that nuclear employment is justified. A national leader may issue an authenticated order based on erroneous warnings, mistaken assessments of an adversary’s intentions, or impaired judgment. A command system could execute such an order flawlessly while producing a catastrophic outcome. Procedural reliability and strategic safety are not equivalent.
Nuclear command arrangements combine technical systems, human decision-makers, military doctrine, and political authority under adversarial conditions. Their components may function as designed while their interactions produce unforeseen consequences. The reliability of individual procedures therefore cannot establish that the complete system will prevent catastrophic nuclear employment under the full range of emergencies it may encounter.
Nuclear War Near-Misses
The historical record provides ample reason to question confidence in nuclear command safeguards. Since the beginning of the nuclear era, military forces have experienced false warnings, communications failures, mistaken threat assessments, and confrontations in which nuclear weapons might have been employed without their political leaders’ knowledge or intention. Particularly troubling are incidents in which catastrophe was avoided through decisions or circumstances that could have been different.
During the Cuban Missile Crisis of October 1962, the Soviet submarine B-59 was operating near Cuba while American naval forces attempted to force it to surface. The submarine had lost reliable communications with Moscow, and its crew endured extreme heat and mounting uncertainty about whether war had begun. Unknown to the Americans, B-59 carried a nuclear-armed torpedo.On October 27, American naval forces dropped small explosive signaling charges near the submarine. Its commander, Valentin Savitsky, reportedly considered using the nuclear torpedo, believing that hostilities might already have commenced. Vasily Arkhipov, the senior brigade officer aboard, opposed nuclear employment, and the submarine eventually surfaced without firing. Accounts differ about the precise sequence of decisions and the authorization required, but the essential danger is clear: a nuclear weapon might have been employed by officers operating with incomplete information and without timely guidance from their government.
The B-59 episode was not unique. American and Soviet warning systems subsequently produced false indications of nuclear attack, while military exercises and scientific activities generated uncertainty about adversaries’ intentions. The accompanying table summarizes six incidents involving different combinations of technical malfunction, communications difficulties, institutional procedures, and human judgment.
These incidents were not equally close calls, nor can we establish that different decisions would necessarily have produced nuclear war. Additional safeguards might have intervened. Nevertheless, favorable outcomes were not guaranteed by the existence of nuclear command arrangements. Some depended on human judgments under uncertainty; others on independent information becoming available before consequential decisions were taken.
Technical and human failures are often inseparable. A malfunction becomes dangerous when erroneous information enters a decision process, while functioning equipment can produce information that is misunderstood or assigned incorrect strategic significance. Military procedures and organizational expectations influence how such information is interpreted.
Nuclear authorities can reasonably point to these episodes as instances in which safeguards or human judgment prevented disaster. But they also demonstrate that dangerous failure pathways exist and that favorable outcomes have sometimes depended on contingent circumstances. Survival establishes that nuclear command systems have endured the emergencies they have encountered. It does not establish how reliably they would perform under different circumstances.
The Irreducible Vulnerability of Command Authority
Nuclear command systems must answer a deceptively simple question: who has the authority to order the use of nuclear weapons? Identifying the authorized decision-maker does not establish that the decision will be correct, that the authority will remain available during emergencies, or that a legitimate order can be reliably distinguished from an unauthorized one.
The United States provides a revealing example. The president possesses sole authority to direct the employment of American nuclear weapons, subject to applicable law. Military officers must carry out lawful orders, and established procedures authenticate and transmit instructions to nuclear forces. These arrangements are intended to prevent unauthorized employment while ensuring that legitimate orders can be executed promptly.
Yet presidential authority concentrates consequential decisions in a fallible individual. An authenticated order may originate from a president acting on erroneous information, misunderstanding an adversary’s intentions, or exercising impaired judgment. Military officers must reject unlawful orders, but legality is not equivalent to strategic rationality. Nor can constitutional procedures for removing an incapacitated president be relied upon during a crisis unfolding within minutes. The president is the final decision-maker, but not necessarily the final safeguard against catastrophe.
Delegation presents a different problem. Nuclear forces must remain capable of responding when political leaders are unreachable or command facilities have been destroyed. During the Cold War, American presidents authorized contingency arrangements permitting subordinate commanders to employ nuclear weapons under specified emergency circumstances. Such delegation preserves command continuity but introduces decision-makers who may possess incomplete information or misunderstand whether the conditions for nuclear employment have been satisfied. The B-59 incident illustrates the danger of consequential decisions being made without reliable knowledge of the broader strategic situation.
The United States maintains an airborne command center, the E-4B Nightwatch, designed to preserve national command capabilities if ground facilities are destroyed or disabled. Equipped with extensive communications systems, the aircraft can serve as an emergency command post for national leadership. Such arrangements improve the survivability of command authority, but they cannot ensure that surviving decision-makers on the aircraft possess accurate information or exercise sound judgment. Preserving the ability to issue nuclear orders is not equivalent to ensuring that those orders will be correct.
E-4B Nightwatch airborne command center – Command continuity does not guarantee command correctness.
Additional layers of approval offer no complete solution. Multiple decision-makers may provide independent scrutiny, but they also introduce delays, communications dependencies, and uncertainty about authority during emergencies. Fragmented command structures may leave surviving officials with conflicting information or incompatible interpretations of their responsibilities.
Automation likewise redistributes rather than eliminates vulnerability. Systems may detect threats, authenticate information, and transmit orders with reduced human intervention. But consequential judgments become embedded in algorithms, operating rules, and assumptions about circumstances the designers may not have anticipated. A system can execute its programmed instructions flawlessly while producing disastrous results.
Every arrangement for exercising nuclear authority must ultimately convert a consequential determination into an executable order. Centralization, delegation, multiple authorization, and automation redistribute the vulnerabilities associated with that determination without eliminating them. There is always a last car on the train. Somewhere in the command structure, an individual or mechanism must make a final decision. The fundamental danger is therefore not confined to disobedience or circumvention of safeguards. A rigorously organized command system, operated by disciplined personnel following established procedures, can still produce an erroneous decision based on incorrect information or bad judgment.
Pathways to Unauthorized Nuclear Use
The vulnerability of nuclear command authority extends beyond mistaken decisions by legitimate leaders. Nuclear weapons might also be employed through actions that circumvent, exploit, or disrupt the arrangements intended to maintain political control. The question is whether the entire chain of custody, authorization, communication, and execution can reliably prevent nuclear employment contrary to the intentions of national authorities.
One pathway is the abuse of delegated authority. Emergency provisions may permit subordinate commanders to act when communications with national leadership have been severed or specified conditions appear to have been met. A commander who mistakenly believes a nuclear attack has begun might regard nuclear employment as authorized under standing instructions, even though national leaders would reject that decision. The action could comply with established procedures while violating their political purpose.
Another pathway is the fragmentation of command authority. A major attack, cyber intrusion, or communications disruption could impair the networks and organizational hierarchies through which nuclear orders are transmitted and authenticated. Different command centers might receive conflicting information, lose contact with superior authorities, or disagree about whether emergency provisions have become operative. Disciplined organizations could act on incompatible understandings of the situation.
Compromised authentication presents a related vulnerability. Procedures intended to distinguish legitimate instructions from fraudulent ones depend on the integrity of personnel, equipment, communications, and information. An adversary or insider capable of compromising part of this process might introduce false instructions or interfere with the verification of legitimate orders. Authentication safeguards reduce this danger without establishing that every possible means of circumventing them has been eliminated.
Physical custody introduces another dimension. Nuclear weapons must be manufactured, stored, transported, maintained, and prepared for employment. These activities involve personnel operating at varying distances from national political authority. Security procedures and technical controls are intended to prevent theft, sabotage, or unauthorized employment, but insider conspiracy, coercion, or loss of effective control remain conceivable. Their technical feasibility differs among weapons systems and nuclear powers, and much of the relevant information is classified.
These potential failure mechanisms do not establish that existing nuclear command systems are defective or readily susceptible to unauthorized use. Their significance is that safeguards must protect against a wide range of circumstances, including combinations of technical failures, human errors, and disrupted communications that cannot be comprehensively tested. The probability that these safeguards might fail cannot be reliably determined from publicly available evidence.
Moreover, preventing unauthorized nuclear use does not eliminate the danger of catastrophic mistakes. A weapon might be launched without legitimate authorization, under a mistaken interpretation of delegated authority, or pursuant to a valid order based on false information. These are different pathways to the same potentially disastrous outcome: nuclear employment that national leaders did not intend or would not have authorized had they understood the circumstances.
Effective political control therefore requires more than preventing disobedience or fraudulent orders. It requires maintaining legitimate authority, reliable information, and sound decision-making under conditions of extreme uncertainty, disrupted communications, and potentially irreversible consequences.
The Secret Architecture of Nuclear Command
The reliability of nuclear command arrangements is difficult to evaluate because their most consequential operating procedures are closely guarded secrets. Governments disclose broad doctrines and identify command authorities, but the details governing emergency delegation, authentication, communications failures, and nuclear employment remain largely inaccessible to independent examination.
Secrecy serves legitimate military purposes. An adversary who understood the operation of a nuclear command system might identify opportunities to disrupt communications, compromise authentication, or disable retaliatory forces. Yet secrecy creates an unavoidable problem of accountability. The public is asked to trust safeguards whose effectiveness it cannot independently assess.
Historical evidence demonstrates that fundamental features of nuclear command authority may remain concealed for decades. During the Eisenhower administration, the United States established arrangements permitting designated commanders to employ nuclear weapons under specified emergency conditions when national leadership could not be reached. These advance authorizations were intended to preserve retaliatory capability following an attack that disrupted or destroyed the national command structure.
Declassified documents establish that Eisenhower approved formal predelegation instructions in 1959, following earlier decisions concerning emergency nuclear employment. The Kennedy administration retained these arrangements, and the Johnson administration subsequently revised them. Their existence remained largely outside public scrutiny. Whether comparable emergency provisions exist today, and precisely how they operate, cannot be determined from the available public record.
The United States maintains elaborate continuity-of-government arrangements intended to preserve constitutional authority following a catastrophic attack. Public directives require advance succession planning, emergency delegations, alternate operating facilities, and redundant communications. Yet the operational arrangements governing nuclear command authority when national leadership has been destroyed or cannot be reached remain largely classified. The existence of contingency plans does not establish that legitimate authority could be unambiguously identified, authenticated, and exercised in the confusion following a devastating attack.
Ballistic missile submarines present a particularly demanding command problem. Their strategic value depends on surviving an attack and retaining the ability to retaliate, yet they operate far from national leadership, sometimes with limited or disrupted communications. American submarine commanders do not ordinarily possess independent authority to initiate nuclear attacks. However, the precise technical controls and emergency arrangements governing submarine-launched nuclear weapons are not fully established in public sources. Neither independent launch authority nor its technical impossibility under every emergency condition can be confidently asserted.
Britain provides an instructive contrast. Its prime minister prepares sealed letters of last resort for nuclear submarine commanders, to be consulted if the British government has been destroyed and normal command arrangements have ceased to function. Their contents remain secret. The arrangement explicitly anticipates circumstances in which consequential decisions may have to be made without direction from surviving political authorities.
Other nuclear powers present additional uncertainties. Historical accounts describe Russia’s Perimeter system, developed to preserve retaliatory capability following a devastating attack, but its current operating procedures and degree of automation remain uncertain. China, India, and Pakistan maintain different command structures, while publicly available information provides limited insight into their emergency nuclear authorization arrangements.
North Korea’s 2022 nuclear forces law goes further, prescribing an automatic and immediate nuclear strike under predetermined operational plans if an attack endangers its nuclear command-and-control system. Whether this provision relies on advance delegation, automated procedures, or other mechanisms remains unknown.
Israel represents an extreme case of opacity. Although widely assessed to possess nuclear weapons, Israel neither confirms nor denies their existence. Israel’s ballistic missiles are generally regarded as nuclear-capable, and its submarines have been widely reported as potential platforms for nuclear-armed cruise missiles, although their nuclear capability has not been publicly confirmed.
The absence of public information does not demonstrate that these arrangements are defective. Some may be exceptionally rigorous. But neither does their existence establish adequate protection against catastrophic failure. Even governments possessing detailed knowledge of their own systems cannot independently establish the reliability of those maintained by potential adversaries.
The resulting predicament is straightforward: if nobody knows what a nuclear command organization is doing, nobody outside it can know what it is doing wrong. Secrecy may protect against hostile interference, but it also insulates potential vulnerabilities from independent scrutiny. The public is left with assurances of reliability that cannot be adequately verified, while the consequences of failure are extraordinarily severe.
Artificial Intelligence and the Changing Risk Environment
Artificial intelligence introduces another dimension of uncertainty into nuclear command systems. AI promises to improve threat detection, integrate information from multiple sources, and assist commanders in evaluating complex military situations. These capabilities may reduce existing vulnerabilities while introducing new failure mechanisms into systems whose reliability is already difficult to establish.
Nuclear early-warning systems have long depended on automated technologies. Radar networks, satellites, and computers process information that human operators cannot evaluate unaided. AI could extend this dependence through systems that identify patterns, generate assessments, and recommend responses using processes that may be difficult to interpret or independently verify.
Machine-learning systems can misclassify unfamiliar inputs, produce confident but erroneous conclusions, or respond unpredictably to circumstances outside their training experience. Adversaries may also manipulate the information on which such systems depend. Human supervision does not necessarily resolve these problems. Operators may defer to apparently authoritative machine-generated assessments, a phenomenon known as automation bias, particularly under severe time pressure. Conversely, distrust of automated warnings may cause operators to discount valid indications of danger.
AI also creates pressure to accelerate military decision-making. If one nuclear power believes an adversary can detect threats and execute operations more rapidly through automated systems, it may seek comparable capabilities. The resulting compression of decision cycles can reduce opportunities for verification, consultation, and reconsideration. Historical false alarms demonstrate the difficulty of distinguishing genuine attacks from misleading indications. Faster decision-making may increase the consequences of errors while reducing opportunities to correct them.
The danger does not require delegating nuclear launch authority to artificial intelligence. A national leader may retain exclusive authority while relying on AI-generated assessments of an adversary’s actions, intentions, or likely responses. If those assessments are erroneous, the resulting order may be properly authenticated and executed in accordance with established procedures. Human control over the final decision does not guarantee independent control over the information on which it depends.
Nor can the reliability of AI-assisted nuclear command be established merely by demonstrating that individual systems perform well in testing. Their behavior may change under unfamiliar conditions, adversarial manipulation, or interactions with other automated systems. As rival nuclear powers incorporate these technologies into their warning and command arrangements, unforeseen interactions may become increasingly difficult to evaluate.
Artificial intelligence thus intensifies the nuclear command dilemma. It may improve particular safeguards while making the complete system less predictable. Faster decisions are not necessarily better decisions, and more sophisticated information processing does not guarantee sound strategic judgment. The pursuit of technological control may itself introduce new sources of uncertainty into a system in which the consequences of error are unacceptable.
The Escalation Cascade
The consequences of a nuclear command failure need not remain confined to the country in which it occurs. A single unauthorized or mistakenly authorized strike could initiate a series of retaliatory decisions by other nuclear powers, each responding to what its leaders perceive as a deliberate attack. The initiating failure might be accidental, but subsequent escalation could proceed through decision systems functioning as intended.
Consider a nuclear weapon launched without authorization against a military installation in another nuclear-armed country. The attacked government might identify the weapon’s origin and trajectory without knowing whether the strike represented a deliberate national decision, unauthorized action by a subordinate commander, or a malfunction. Its leaders could interpret the attack as the opening move in a larger offensive, particularly if they feared that additional strikes might destroy their retaliatory capabilities.
The danger would be magnified if the initial strike disrupted communications, damaged warning systems, or destroyed command facilities. Military preparations undertaken in response might also appear threatening to other nuclear powers, whose forces could be placed on heightened alert. The consequences could propagate beyond the original confrontation.
Nuclear doctrines can reinforce these pressures. Russia’s revised nuclear doctrine, approved in November 2024, identifies circumstances under which nuclear weapons may be employed in response to attacks against Russia or its allies, including threats to critical military infrastructure and nuclear retaliatory capabilities. Other nuclear powers maintain doctrines allowing varying degrees of discretion concerning retaliation. Such policies do not establish that an unauthorized detonation would automatically provoke a nuclear response, but they demonstrate how an apparent attack could create circumstances in which authorized nuclear employment becomes a contemplated option.
Even a government possessing effective safeguards against unauthorized nuclear use could mistakenly retaliate against an unauthorized strike originating elsewhere. Its command procedures might operate flawlessly while producing catastrophe because the information informing its decisions was incomplete or misleading.
Nor could the initiating government necessarily halt the sequence. Communications might be disrupted, the circumstances of the launch uncertain, and assurances that the attack was unauthorized difficult for the adversary to verify. An acknowledgment of error might itself be interpreted as deception intended to forestall retaliation.
The central danger is that nuclear catastrophe need not result from the simultaneous failure of multiple national command systems. A failure in one could induce authorized responses in others, producing consequences beyond the control of the original participants. No nuclear power can ensure protection against this possibility through its own command safeguards alone.
The Limits of Global Nuclear System Safety Assurance
The vulnerabilities of individual nuclear command systems compound in a larger problem: the reliability of the international nuclear weapons system cannot be established from what is publicly known about its safeguards or from the historical record of their performance.Nine states currently possess nuclear weapons: the United States, Russia, China, France, Britain, India, Pakistan, North Korea, and Israel. Each maintains its own arrangements for authorizing nuclear weapons employment, transmitting orders, controlling weapons, and responding to perceived threats. Their command structures, doctrines, and degrees of transparency differ considerably.
The United States, Britain, and France publicly identify their nuclear command authorities. Other nuclear powers disclose varying elements of their command structures and employment doctrines. North Korea has published legislation specifying circumstances under which nuclear weapons may be used, while Israel does not officially acknowledge possessing them. These differences in transparency should not be mistaken for differences in demonstrated reliability. Disclosure does not establish the effectiveness of safeguards, just as secrecy does not establish their inadequacy.
Even within a single country, establishing comprehensive reliability would be extraordinarily difficult. Nuclear command systems must function under circumstances that cannot be fully reproduced in testing: surprise attack, destruction of command facilities, disrupted communications, conflicting intelligence, compromised personnel, and severe time pressure. Components can be tested, procedures rehearsed, and organizations exercised. But their combined behavior under every combination of circumstances cannot be assessed in advance.
The testing problem becomes still more demanding when national systems interact. A false warning in one country may provoke military preparations that another interprets as threatening, generating further responses across an expanding network of nuclear powers. These interactions depend on political judgments, operational doctrines, and adversarial behavior that cannot be reliably predicted or comprehensively simulated. The international system is not merely a collection of national arsenals, but a changing network of relationships among them.
The historical absence of nuclear catastrophe does not establish a statistically meaningful measure of safety. Catastrophic failures are rare events for which the relevant operating conditions are neither uniform nor repeatable. Nuclear arsenals, technologies, doctrines, and political relationships have changed substantially over time. Decades of survival therefore cannot establish the probability of failure under circumstances that have not yet occurred.
The resulting uncertainty is fundamental. Governments cannot comprehensively test the interactions among nuclear command systems, independently verify the safeguards maintained by other powers, or reliably determine the aggregate probability of catastrophic failure. These limitations leave governments unable to demonstrate that the safeguards of the international nuclear system are commensurate with the catastrophic consequences of their possible failure.
Conclusion
Stanley Kubrick’s Dr. Strangelove imagined the destruction of civilization through an improbable sequence of failures involving just two nuclear powers. The catastrophe arose not simply because safeguards failed, but because arrangements intended to ensure nuclear retaliation undermined the ability to prevent its disastrous consequences. Mechanisms designed to guarantee retaliation ultimately defeated the possibility of preventing catastrophic error.
Events outrun decisions in the war room in the film “Dr. Strangelove.”
More than six decades later, the world contains nine nuclear-armed states, each with its own command arrangements and doctrines governing nuclear employment. Their interactions create possibilities for miscalculation, unauthorized action, and cascading retaliation that cannot be comprehensively tested or reliably quantified. Further nuclear proliferation would introduce additional command systems and relationships through which failures might propagate. The danger lies not simply in the number of nuclear weapons, but in the growing complexity of the international system in which they exist.
Nuclear authorities have devoted enormous resources to developing safeguards, maintaining disciplined organizations, and preparing for emergencies. But institutional diligence cannot establish mastery of risks that extend beyond the ability of any organization to observe, test, or control. Nor can the reliability of individual national command systems establish the safety of their interactions.
Nothing short of sweeping, verifiable international agreements establishing common safeguards for nuclear weapons can adequately address these dangers. Such agreements would need to establish verifiable standards for command authority, emergency delegation, crisis communications, and the prevention of unauthorized or mistaken nuclear employment, while accommodating legitimate requirements for operational secrecy.Achieving them may seem unrealistic in today’s contentious international order. But the alternative is to allow the dangers to accumulate as nuclear arsenals, technologies, and command arrangements grow more complex, bringing humanity ever closer to the precipice of global nuclear war, whether by design or accident.
The nuclear powers have survived decades of dangerous encounters without a catastrophic failure of their command arrangements. But survival is not proof of safety. Kubrick’s fictional catastrophe required an extraordinary conjunction of circumstances. The real world offers many possible pathways to nuclear war disaster, and no one can establish that all of them have been reliably closed. This may be the ultimate absurdity of the nuclear era. We are asked to have faith in a system of unknown reliability in which catastrophic failure is unacceptable.
