Sunday, Mar. 04, 2001

Practicing For Doomsday

By Douglas C. Waller

The cold war may be over, but dozens of U.S. and Russian subs still lurk under the ocean, poised to attack. It's dangerous work, as Russians discovered last year with the sinking of the Kursk and Americans realized last month with the U.S.S. Greeneville's deadly collision. The Navy operates 18 Trident subs, whose 432 missiles carry enough nuclear warheads to destroy Russia many times over. Time's Douglas Waller was granted the most access any journalist has ever had to chronicle a patrol of one of those Tridents, the U.S.S. Nebraska. His book Big Red: Three Months On Board a Trident Nuclear Submarine (HarperCollins; $27.50) arrives in bookstores this week. In the excerpt below, the crew practices the most complex and momentous operation a Trident can undertake: the launching of nuclear weapons.

Sunday, May 8, 1999, 12:25 P.M.
"Russia is in economic chaos," commander David Volonino announced on the sub's speaker system. "It's out of oil, out of food, and its missiles are on alert. U.S. strategic forces have therefore been put on alert." He felt obliged to provide a scene setter for these missile drills. The brass liked that.

"Set Opsec, condition Alpha," he said over the microphone, then hung it up and returned to his stateroom one level below.

Operational Security Alpha was one of the quietest operating modes the Nebraska had. It was imperative that the sub not be detectable. The defense condition under which the sub now sailed had skyrocketed, from DefCon 5 (the normal peacetime level) to DefCon 2 (the second highest alert level).

"Attention helm and quartermaster," Brent Kinman announced loudly to the planesmen and navigators in the room. "Lieutenant Kinman has the deck and the conn." He hopped down from the conn and walked to the ballast control panel to make sure water was distributed properly in the ballast so the sub would stay level for the missile launch. The Nebraska stays underwater to fire off its missiles, but at a shallow depth.

Kinman began leafing through notebooks to piece together a torpedo-evasion plan to carry out after the launch. Once a Trident fires one of its missiles, the rest of the world knows its exact location. Navy attack subs in the area can protect it only so much. After a launch, a Trident would have to hide from what would be a very angry enemy, whose sonar shack would suddenly have a blast of valuable noise for closing in on the kill.

Kinman could play possum. An enemy torpedo would home in only on a target that was moving. But it takes guts not to run, and the commander would have to make that call, not he. Kinman decided his plan would be to kick the engines into full throttle and sink the Nebraska as deep as he could to get out of there.

In the radio shack forward of the control center, alarms began beeping on the standard information-display consoles as the emergency-action messages (EAMS) from Strategic Command began interrupting routine radio traffic and flashing on the screen. Radio operator Eric Liebrich quickly opened the safe that stored the cryptographic manuals and code books they would need to decipher the EAMS that had begun pouring in.

The Pentagon assumes that in a nuclear crisis its communication centers would come under enemy attack, so it has dozens of ways to send messages to Tridents over scores of independent transmitters based in space, on land, at sea and from airplanes. When the Strategic Command sends out an emergency-action message, it is automatically relayed to all these stations for transmitting to the Tridents. The Nebraska wasn't getting just one EAM. Dozens of them were pouring into the sub. stratcom was bombarding the Trident with the same message.

Liebrich ripped pages off the printer and began decoding the first six groups of scrambled letters. Dan Montgomery, the radio shack's chief, had already arrived and was watching over Liebrich's shoulder as he decoded. It was an EAM for the Nebraska.

Montgomery rushed out of the radio shack and to the conn, where Kinman paced back and forth. The radio chief spoke in a low voice to the lieutenant, then Kinman reached up for the microphone over the conn.

"Alert one, alert one!" Kinman announced on the speaker system, his heart now thumping.

Officers who weren't standing watch dropped paper work on their desks, swallowed one last mouthful of lunch or rolled out of racks to dress quickly. They all sprinted to the control center. Six of them were assigned to decode and process an emergency-action message. Volonino had divided them into three two-man teams. When an alert one was announced, the first two-man team to reach the radio shack began processing the message.

The small, restricted op-con room, which was connected to the radio shack by another door forward, was now cramped with four officers and Montgomery inside it. The officers spread out code books on a table, which was folded down from the starboard bulkhead. They began unscrambling the rest of the message, reading off the four-letter groups and comparing them with the decryption instructions in the manuals. The decoding had to be done by hand, but the men worked quickly. Most EAMS took less than 10 minutes to decode if the message was intact.

This one wasn't. In wartime, any number of things could garble a message: enemy jamming or attacks on transmitters, rough seas or atmospheric disturbances that break up the reception. The last thing the Navy wants is a Trident captain confused about his orders, so the Nebraska has thick, top-secret manuals with elaborate instructions and contingency plans along with page after page of options matrices for how its officers should deal with garbles. During missile drills, the Strategic Command rarely sends a clean message. Most have missing information or code letters mixed up to test how quickly the crew can resolve errors. After cutting and pasting, the four officers in the op-con room had produced a readable message. This one wasn't yet an order to launch. But the world was becoming more tense. The DefCon level would soon be raised to 1, the highest alert level.

The launching of nuclear weapons is such a monumental act for any human being to take that the U.S. military's high command has left nothing in the procedure to chance. Everything the men now did, every action they took with the missiles, every word they uttered, was scripted. Redundancy was built into every decision they made, no matter how minor it was. Nothing was trusted to memory. There were safes on the sub bulging with confidential manuals with procedures written out for everything the missile technicians could do with the nuclear weapons. The officers had practiced receiving EAMS and simulating missile launches so many times that it came to them as naturally as tying their shoes. But for every missile drill, they still hauled out thick manuals to verify the tasks they had to perform. A technician couldn't remove the cover from a missile-compartment cabinet without reading a checklist on how to unscrew the bolts.

Commander Volonino sat back in his captain's chair and began quietly reviewing top-secret manuals as sailors, chiefs and officers busied themselves around him. Volonino was convinced that they must practice the missile launches with the same intensity they had during the cold war. It was not enough simply to have the Tridents on patrol, he believed. For deterrence to be credible even today, the subs had to maintain their finely tuned capability to fire missiles at a moment's notice.

It was almost impossible for Volonino to comprehend the power placed in his hands. The responsibility would have been as grave if it had given him only one missile with one warhead that could kill 1 million people. But 24 missiles with more than 100 nuclear warheads? Who could ever be emotionally prepared to unleash that kind of megatonnage?

1:35 P.M.
In the op-con room, Lieutenant (J.G.) Chad Thorson and Lieutenant Joe Davis were busy decoding. The message was garbled, so they had to splice to come up with a complete message. It was an order to launch.

Calling out four-letter groups, Thorson and Davis wasted no time decoding the message. Nuclear-control orders, as they were called, always had the same format, with the same four parts. The first part of the message told the Nebraska the war plan that STRATCOM wanted the sub to execute--in other words, how many nuclear weapons it wanted launched and the coordinates of the targets they were supposed to hit. The Pentagon's strategic war plans were flexible and constantly being updated. The President could strike practically any target or combination of targets he wanted. Every conceivable option the generals could dream up was on his menu, from a single surgical strike to limited attacks to all-out nuclear war. The second part of the message spelled out the date and time window the Pentagon wanted the missiles fired. The strategic war plans were carefully choreographed. Exact times were prescribed for atomic bombs falling on targets. The war planners didn't want the Nebraska's warheads exploding over an area outside the window and frying Air Force B-2 bombers swooping in at the same time to drop their nuclear payload.

The last two parts of the message assured both Volonino and the President of the U.S. that the two men could trust each other. They contained the combination to a safe and the codes for the cookies, the nickname for a key part of the exercise.

The combination was a recent innovation. While the firing of intercontinental ballistic missiles from land could always be controlled by a higher headquarters with electromechanical interlocks, a Trident submarine doesn't come with a 5,000-mile extension cord. To fire the Navy's nuclear weapons, a radio message has to be sent to a Trident, and then that sub, on its own, launches the missiles. No one has ever been completely comfortable with this arrangement, however, so over the years, elaborate safeguards have been put in place to keep a rogue sub from launching missiles without an order from the President.

The Navy built its Tridents so no one person could fire the missiles by himself, not even a captain. It took four sets of keys to unlock electronic and mechanical devices throughout the Nebraska before any of its missiles could leave their tubes. Volonino kept the first set in the safe in his stateroom: 24 firing-unit keys strung on 2-ft.-long olive-drab lanyards. The keys were inserted into the gas generators attached to the 24 missile tubes to arm them for launch. Fred Freeland, the Nebraska's weapons officer, had the second key, called the tactical-mode key, which he kept in a safe in the second-level missile-control center. Only he knew the safe's combination. Before a firing, Freeland had to stick that key, painted green, into the missile-control center's launcher panel and turn it in order to electronically line up the sub's firing computers for a launch. The third key was actually a trigger, which Freeland also kept locked in his safe and which he had to squeeze in the missile-control center to blast the missiles out of their tubes.

The fourth key, a purple one, was called the captain's indicator-panel key, or CIP key. The commander would insert it into a large gray metal box in the command and control center just forward of the conn. The CIP key was one of the last that had to be turned to complete electronic circuits and activate the weapons system.

In the Nebraska's missile-control center, behind where Freeland stood during a launch, sat three heavy safes, painted tan, stacked one on top of the other. On the front of each safe were two combination locks, and inside each safe were stored copies of the CIP key. The safes were guarded in the missile center 24 hours a day by two sailors, and an alarm sounded throughout the sub when someone tried to open them.

No one on board had the combination to these safes. Those numbers came in the third part of the emergency-action message that Thorson and Davis translated. The final electronic link needed to launch the missile would come from shore.

The fourth element of the message contained a row of randomly arranged numbers and letters for the Sealed Authenticator System code, one of the most closely held secrets in the U.S. government. A Trident has to have some way of being absolutely sure that the launch order radioed to it is legitimate. The crew has to be confident that the emergency-action message actually comes from the President, that a hostile country or a rogue American general or simply an impostor hasn't broken into the defense-communications network and transmitted a phony order to start World War III. The Sealed Authenticator System code is the final step a Trident would take to verify that the order is for real.

The supersecret National Security Agency produces the sas codes. Agency machines stamp the same computer-generated code of randomly arranged letters and numbers on two plastic cards. The machine then seals each card in a shiny metal foil. The code cards are nicknamed sas cookies because they look like wafer bars wrapped in tinfoil. The machine was specially built to do all the stamping and sealing itself, so no human eyes ever see the numbers and letters printed on the cards.

One of the sealed cards is placed aboard the Trident. Its twin, with the identical numbers and letters, is kept by the Strategic Command. When stratcom's generals drafted the emergency-action message to launch nuclear weapons, they would break open the sealed card and print its authentication code in the order. At the other end, the Trident captain could break open the card he had and compare the code on it with the arrangement of numbers and letters in the message. If the two codes matched, the captain could be certain that he had a valid launch order.

Thorson and Davis finished deciphering the message. If this had been a real launch, they would have opened a safe above a crypto vault along the room's port bulkhead, which stored the sas cookies. The sealed authentication codes were delivered to the Nebraska under tight security. Even if a spy managed to steal one, it wouldn't do him much good. Each cookie is specially manufactured so that if someone unwrapped one to copy its code, the card could not be resealed and put back into the batch. The Nebraska also kept boxes full of the cards on board. If terrorists hijacked a batch of the cards on land, the Navy would simply send out a radio message to the sub to use other boxes with cards.

The SAS safe was actually two safes in one. The outer door, with a combination lock to it, opened to an inner door with another combination lock. Behind the second door were stacked the cookies. Thorson had the combination for one of the locks; Davis had the combination for the other.

Thorson and Davis took the emergency-action message to the conn. Lieutenant Commander Alan Boyd, Volonino's executive officer, summoned the two young officers forward. This EAM was "a valid nuclear-control order that authorizes the release of three of Nebraska's missiles." Thorson read off the target coordinates. The sub was being ordered to begin with a limited nuclear strike.

"I concur," Davis said after reading the message.

"I concur, Captain," Boyd said next. The control room was silent except for the four men at the conn, who talked in low voices. Volonino and Boyd had top-secret manuals, binders and code books opened and spread out over the lip of the railing.

"I concur," Volonino finally repeated.

Could someone beat the system? The idea made a great movie plot, but it seemed to him practically impossible for a rogue commander, even one with several conspirators, to launch the weapons without authorization of the President. At least four people on board had to turn keys in different parts of the ship. One of the keys was locked up in a safe, and no one on board had its combination.

Could the crew circumvent the security? Of course they could, Volonino knew. His sailors had hammers, picks and blowtorches, which they could use to break into the safes holding the captain's indicator-panel keys. For that matter, he didn't even need the keys to launch the missiles. His men were skilled technicians who knew practically everything about the Nebraska's electronics. They could drill screws out of cabinets, open them up and hot-wire circuits for the keys like car thieves.

But that would take a lot of people being in on the conspiracy--dozens of them in the missile-control center and the missile compartment and at the conn. At the very least, more than a third of the men on board would have to be involved. And even that might not be enough. There were other sailors scattered throughout the sub who, on their own, could flip a switch or pull a lever to prevent a launch. A rogue captain would have to brainwash practically the entire crew into doing something it knew was seriously wrong. He found it impractical in the extreme.

"Request permission to authenticate the message," Thorson said. Davis and Boyd both concurred, so Volonino ordered: "Very well, authenticate."

"Authenticate, aye," Thorson responded.

Real SAS code cards were expensive and weren't wasted for training drills. So for the simulation, they used a green card with a piece of tape sealed over it, which Thorson now peeled off to read the series of numbers and letters. The alphanumeric code on the green card matched the code in the EAM.

"The message is authentic," Thorson said.

"I concur," Davis said.

"I concur," Boyd said.

"I concur," Volonino said. "The message is authentic."

If the Nebraska were actually ordered to launch nuclear weapons, there would be one more verification step for the commander. This one was a sanity check he had to make in his own mind. No radio net could be 100% safe, and every security system had a weakness. Computer hackers were becoming more ingenious by the day. What if one of them could break into the Pentagon net and somehow broadcast an emergency-action message to a Trident with authentication codes that matched the captain's cookies?

If the world was at peace and an EAM came to a Trident out of the blue, its captain was now under orders to rise to periscope depth and, even though it might put his sub in danger, break communications silence to radio the Strategic Command to find out if it really meant to fire these weapons. The Navy didn't want a Trident captain sitting out in the ocean with his finger on a hair trigger, thinking that he was expected to default to a nuclear war.

Volonino ordered Kinman to prepare the sub for the simulated launch. The lieutenant reached for the overhead microphone. "Man battle stations, missile, for training without guidance with launcher," Kinman's voice boomed over the sub's speaker system. "Simulate spinning up all missiles."

1:40 P.M. Over a loudspeaker in the missile-control center came Volonino's voice: "Set condition one-SQ for training without guidance with launcher. This is the captain. This is an exercise."

At their lowest stage of alert, missiles sat inert in their tubes at a condition level designated as four-SQ. One-SQ brought the rockets to the level of readiness needed for immediate launch.

Freeland repeated the order in the missile-control center: "Set condition one-SQ for training without guidance with launcher." Mark Lyman pushed the "twogle" button on the fire-control console to Freeland's left. That setting--training without guidance with launcher, or TWOGL, as it was marked on the button--would simulate the "spinning up" of the missiles for this drill. The fire-control console ran the computers that rapidly fed millions of bytes of targeting, fusing and start-up instructions into the missiles just before launch. Before blasting off, each missile had to be spun up, which took at least 10 minutes. During that time, the gyroscope inside the missile's inertial-navigation unit was put in motion and aligned so it could begin sensing the rocket's position in the Atlantic and its movement once it launched.

For this exercise, all the missiles would be aimed at a spot in the middle of the Atlantic. For missiles aimed at countries, Freeland had top-secret notebooks full of "footprints"--the euphemism the missile men used for targets that could be destroyed.

"The firing order will be 4, 23 and 10," Freeland announced.

"The firing order will be 4, 23 and 10," the men in the missile-control center repeated like a Greek chorus. The missiles in tubes 4, 23 and 10 would be fired.

Prepping each missile was only half the job. Getting the tube that it sat in ready for launch was the other half, and just as complicated. Keeping 24 space rockets in a pristine state, ready to launch at any time on a half-hour's notice, was a monumental engineering feat. The buttons, knobs and lights on the launch-control console were divided into rows of 24. They monitored or controlled air pressure and temperature inside each tube, along with the opening and closing of the hatch and access doors for each one. Side panels on the console contained indicators for outside sea pressure and temperature, jettison switches in case a missile caught fire and had to be ejected from the sub, row after row of alarm lights, plus dozens more switches to control hydraulic valves and the pumping of gases into the tubes.

Volonino phoned Freeland with the depth at which the sub would hover for the launch. The men in the missile-control center could feel their room tilt up as the Nebraska rose. Petty Officer Kevin Jany quickly began punching buttons to pump nitrogen gas into the three tubes being used for the launch. He was forcing the nitrogen in to make the pressure inside the tubes equal to the sea pressure outside. The reason Jany had to equalize the pressure was that when the sub's heavy top hatch over each missile tube was opened for the launch, the tube would still be covered with a light blue fiber-glass dome to keep the rocket inside dry. But the fiber glass is relatively flimsy. If Jany didn't equalize the pressure, the weight of the water would crush it and damage the missile.

"Weapons, launcher," Lieutenant Ryan Hardee told Freeland when he saw that Jany had finished. "Launcher ready."

Freeland phoned the missile compartment with the time window the sub had for getting off its first salvo of nukes.

Back at the conn, one level up, Volonino was now satisfied that the first three missiles had the proper targeting instructions entered into them. He had sent Thorson and Davis down to the missile-control center with the combination the emergency-action message had for the CIP key safe. The key was one of the last electrical interlocks needed to fire the missiles. If Volonino stuck it into the captain's indicator panel and turned it, he was giving his permission for the launch.

The two officers, holding the CIP key between them, walked side by side out the missile-control center's entrance into the port passageway. They looked a little ridiculous, both holding the CIP key, walking down the passageway and back up to the conn as if they were in a three-legged race. But everything the crew did with the missiles they did in pairs, for two reasons--to make doubly sure each task was performed correctly and so each man could watch the other for security purposes.

Volonino and Petty Officer Ed Martin stared intently at the digital time readout. The second the launch window opened, Volonino pretended to insert his CIP key into the captain's indicator panel and turn it. He then flipped a training switch on the panel that sent a "training permission to fire" signal to the missile-control center.

"Phone talker, to weapons, the firing window is open," Volonino said. "You have permission to fire."

Freeland held the trigger grip tightly in his right hand and watched the lights on the fire-control console blink from left to right. Lights arranged in two short columns on the right side of the panel were the indicators for the final prepare phase. The bottom light on its second column finally flashed yellow, the signal that the prepare phase for the missile in tube 4 had been completed. Freeland now had just four seconds to squeeze the trigger.

He squeezed it.

In an actual launch, the trigger would send a signal to a gas generator, which is at the base of the missile tube and powered by a solid propellant, to fire. The intense heat from that gas generator's firing instantly flashes water into expanding steam, which forces the missile up and out of the tube. At the same time, plastic explosives laced around the light blue dome covering the top hatch detonate so its fiber glass breaks out into pie sections and doesn't damage the rocket's skin during launch.

As the missile shoots out of the top hatch, it travels up through the water in what amounts to a giant bubble, created by the nitrogen under pressure inside the tube. The missile expels the nitrogen gas as it travels up, preventing water from leaking through the bubble and touching the rocket. Because of the extreme pressure created instantly by the gas generator, the 44-ft.-long missile pops up so fast it completely clears the water. In the next instant, when its gyro senses the missile losing momentum and falling back into the ocean, a signal is sent to the first stage of its rocket to ignite. With a fiery plume on its tail, the D-5 missile is off to space.

FROM THE BOOK BIG RED BY DOUGLAS C. WALLER PUBLISHED BY HARPERCOLLINS PUBLISHERS INC. COPYRIGHT (C) 2001 BY DOUGLAS C. WALLER