Command and Control (30 page)

The SIOP soon became one of the most closely guarded secrets in the United States. But the procedures for authorizing a nuclear strike were kept
even more secret. For years the Joint Chiefs had asked not only for custody of America's nuclear weapons but also for the authority to use them. In December 1956 the military had gained permission to use nuclear weapons in air defense. In February 1959 the military had gained custody of all the thermonuclear weapons stored at Army, Navy, and Air Force facilities. The Atomic Energy Commission retained custody of only those kept at its own storage sites. And in December 1959 the military had finally won the kind of control that it had sought since the end of the Second World War.
Eisenhower agreed to let high-ranking commanders decide whether to use nuclear weapons, during an emergency, when the president couldn't be reached. He had wrestled with the decision, well aware that such advance authorization could allow someone to do “
something foolish down the chain of command” and start an all-out nuclear war. But the alternative would be to let American and NATO forces be overrun and destroyed, if communications with Washington were disrupted.

At first, Eisenhower told the Joint Chiefs that he was “
very fearful of having written papers on this matter.” Later, he agreed to sign a predelegation order, insisting that its existence never be revealed. “
It is in the U.S. interest to maintain the atmosphere that all authority [to use nuclear weapons] stays with the U.S. President without delegation,” he stressed. Eisenhower's order was kept secret from Congress, the American people, and NATO allies. It made sense, as a military tactic. But it also introduced an element of uncertainty to the decision-making process. The SIOP was centralized, inflexible, and mechanistic. The predelegation order was exactly the opposite. It would rely on individual judgments, made in the heat of battle, thousands of miles from the White House. Under certain circumstances, a U.S. commander under attack with conventional weapons would be allowed to respond with nuclear weapons. Eisenhower knew all too well that delegating presidential authority could mean losing control of whether, how, and why a nuclear war would be fought. He understood the contradictions at the heart of America's command-and-control system—but couldn't find a way to resolve them during his last few weeks in office.

C
olonel John T. Moser and his wife had just finished dinner, and they were getting ready to leave the house for a concert, when the phone rang.

There's a problem at Launch Complex 374-7, the controller said. It could be a fire.

Moser told his wife to go without him, put on his uniform, got in his car, and headed to the command post. They lived on the base, and the drive didn't take long. On the way, Moser radioed ahead, telling the controller to assemble the Missile Potential Hazard Team. It was six forty in the evening, about ten minutes after a mysterious white cloud had appeared in the silo.

The command post of the 308th Strategic Missile Wing resembled an executive boardroom, with a long conference table in the middle, communications equipment, and a chalkboard. It could accommodate twenty-five or thirty people. Moser was the wing commander, and when he arrived at the post, it was still largely empty, and the status of the missile, unclear. The sprays were on, dumping water into the silo. Stage 1 fuel pressure was falling, while the oxidizer pressure was rising. Flashing red lights in the control center at 4-7 warned there was a fuel leak, an oxidizer leak, a fire in the silo—three things that couldn't be happening at once. Adding to the confusion, Captain Mazzaro and Lieutenant Childers, the crew commander
and deputy commander at the site, had both called the command post, using separate lines, one mentioning a fuel leak, the other a fire. Now Mazzaro was on the speakerphone, reporting the missile's tank pressures. His crew was going through checklists, trying to make sense of it all.

Moser was a great believer in checklists. After graduating from Franklin & Marshall College in 1955, he'd joined the Strategic Air Command. Two years later he became the navigator of a KC-97 Stratotanker, an aircraft that refueled B-47 bombers midair. The Stratotanker was a propeller plane, and the B-47 a jet, prone to stalling at low speeds.
The two had to rendezvous at a precise location, with the bomber flying behind and slightly below the tanker. At an altitude of eighteen thousand feet, they would connect via a hollow steel boom and fly in unison for twenty minutes, entering a shallow dive so that the tanker could keep up with the bomber. Aerial refueling was a delicate, often dangerous procedure. The crew of the Stratotanker had to coordinate every step carefully, not just with the crew of the B-47 but also with one another. Spontaneous or improvised maneuvers would not be appreciated. Moser later flew as a navigator on KC-135 tankers that refueled B-52s during airborne alerts. The success of these missions depended on checklists. Every move had to be standardized and predictable, as two large jets flew about forty feet apart, linked by a boom, one plane carrying thermonuclear weapons, the other unloading a thousand gallons of jet fuel a minute, day or night, through air turbulence and rough weather.

Colonel Moser asked Mazzaro if the PTS team had done anything in the silo that could have caused the problem. Mazzaro got off the line and returned with an explanation: Airman Powell had dropped a socket into the silo, and the socket had pierced a hole in the stage 1 fuel tank. Mazzaro put the airman on the phone and made him describe what had happened, an unusual decision that violated the chain of command. Hearing the details silenced everyone in the room. Moser realized this was a serious accident that called for an urgent response. He activated the Missile Potential Hazard Net, a conference call that would connect him with SAC headquarters in Omaha, the Ogden Air Logistics Center in Utah, and the headquarters of the Eighth Air Force in Louisiana. But the communications
equipment wasn't working properly, and for the next forty minutes the controller in Little Rock tried to set up the call.

Members of the hazard team were now filling the command post, officers and enlisted men who'd spent years working with the Titan II and its propellants. The missile wing's chief of safety sat at the conference table, along with the head of its technical engineering branch, a bioenvironmental engineer, an electrical engineer, and the K crew. The “K” stood for “on-call,” and the four-man crew—a commander, a deputy commander, a missile facilities technician, and a missile systems analyst—served as back-up to the launch crew at 4-7. The K crew could help interpret the data coming from the site, pore through the
Dash-1
and other operating manuals, offer a second opinion. The skills of everyone in the room focused on the question of how to save the missile. SAC didn't have a checklist for the problem they now faced, and so they would have to write one.

Moser needed all the technical assistance he could get. He was new to the job, having been in Little Rock for about three months. During that brief time, he'd come to be regarded as smart, fair, and open minded—as someone who was willing to listen. For a SAC wing commander, he was well liked. But Moser didn't know very much about Titan II missiles. He'd previously served as deputy director of missile maintenance at SAC headquarters and as the commander of missile maintenance at Whiteman Air Force Base in Missouri. Those assignments, however, had required an extensive knowledge of Minuteman missiles—a completely different weapon system. The Minuteman used solid fuel, not liquid propellants. It was smaller than a Titan II, with a less powerful warhead. And each Minuteman complex had ten missiles, not one, with silos dispersed as far as seventeen miles from the launch control center. A Minuteman crew could go months without visiting a silo. The Titan II was the only ballistic missile in the American arsenal that relied on liquid fuel and a combat crew living down the hall. It was a rare, exotic “bird.” Of the more than one thousand long-range missiles that SAC controlled, only fifty-four were Titan IIs.

Moser didn't pretend to be an expert on the Titan II and, from his first day in Little Rock, had shown an eagerness to learn. Three or four
mornings a week, he attended predeparture briefings for the launch crews and the PTS teams. He vowed to spend time at every launch complex, before the end of the year. But some of the complexes were a long way from Little Rock, and he still hadn't visited them all.

•   •   •

W
HEN
C
OLONEL
J
AMES
L. M
ORRIS
arrived at the command post, around 7
P.M.
, he already knew what had happened at the silo. Morris was the deputy commander for maintenance, and about half an hour earlier, he'd overheard Captain Mazzaro on the radio, sounding excited about something. Morris told job control to call 4-7 and ask Charles Heineman, the head of PTS Team A, what was going on there. Heineman said that Powell had dropped a socket into the silo and poked a hole in the missile. He said that Powell saw a lot of fuel vapor, but no fire. Morris absorbed the news, told job control to track down Jeff Kennedy, and ordered the dispatcher not to contact the launch complex again.

Within an hour of the accident, the pressure in the stage 1 fuel tank had dropped by about 80 percent. A vacuum was forming inside it, as fuel poured out. If the pressure continued to drop, the tank might collapse. After Jeff Kennedy joined Morris in the command post, Colonel Moser briefed them on the situation and instructed them to head to 4-7 by helicopter. Morris would serve as the on-site commander, and Kennedy would help him find out what was happening, whether there was a fire, and what needed to be done. Before leaving Little Rock, Kennedy asked job control to call the launch complex and tell them to get a RFHCO suit ready for him. We've been ordered not to call the complex, the dispatcher said, bring your own. Kennedy didn't have time to gather the necessary gear—a helmet, a fresh air pack, a RFHCO suit the right size—and left the base without it.

The hazard team had come up with a plan: PTS technicians would reenter the silo, vent the stage 1 fuel tank, equalize the pressure, and prevent the missile from collapsing. Time was of the essence, and the reentry had to be done as soon as possible. The PTS men topside had RFHCOs and air packs and a full set of equipment in their trucks. Ideally, they'd go into the
complex. But nobody knew where they were. After leaving the complex, they'd probably driven beyond the range of the radios in their helmets. And their trucks didn't have radios that could contact the base. If they wanted to speak with the command post, they'd have to drive to Damascus and use a pay phone, or call from a nearby house.

The PTS crew that had taken refuge in the control center would have to do the job, wearing the RFHCOs left behind in the blast lock. Because their socket was now lying somewhere at the bottom of the silo, they'd have to remove the pressure cap on the stage 1 fuel tank with pliers. And if that didn't work, they might have to push open the tank's poppet valve with a broom handle.

Before Colonel Moser could approve the plan and set it in motion, SAC headquarters joined the discussion via speakerphone. It was about quarter to eight, the Missile Potential Hazard Net was finally up and running, and Lieutenant General Lloyd Leavitt, the vice commander in chief of the Strategic Air Command, was on the line.
Leavitt made it clear that, from now on, nothing would be done in the launch control center, the silo, or anywhere else on the complex without his approval. And he would not authorize any specific action until a consensus had been reached that it was the right thing to do.

Leavitt was in his early fifties, short, compact, and self-confident. He'd been a member of the first class to enter West Point after the Second World War. While the heroism of that war was celebrated in popular books and films, his classmates were soon risking their lives in a conflict that was largely ignored by the public. Leavitt became a fighter pilot and flew one hundred combat missions during the Korean War. He routinely encountered enemy planes and antiaircraft fire. During one mission, his F-84 was hit by flak and suffered an electrical failure; Leavitt had to fly 250 miles without flight instruments or a radio, before landing safely at an American base. During another, his plane spun out of control amid a snowstorm; Leavitt had to bail out at eight thousand feet and felt lucky to be found by South Korean troops, not Communist guerrillas. He later flew 152 combat missions in Vietnam. The two conflicts, as well as training flights, took the
lives of many good friends.
Of the 119 West Pointers who graduated from flight school with Leavitt, 7 were killed in Korea, 2 in Vietnam, and 13 in airplane accidents. The odds of being killed on the job, for his classmates, was about one in six.

Some of Leavitt's most dangerous missions occurred during peacetime. From 1957 to 1960, he flew U-2 spy planes. The U-2 was designed to fly long distances and take photographs at an altitude of seventy thousand feet, without being detected or shot down. In order to do so, the plane had to be kept as light as possible. And the small size of the pilot's survival kit imposed certain restrictions. Before leaving on a mission to photograph Soviet airfields and radar sites in Siberia, Leavitt was given a choice: bring a life raft or a warm parka. He wasn't allowed to bring both. Leavitt chose the parka, figuring that if he had to bail out over the Bering Sea, he'd freeze to death—with or without the raft. U-2 pilots flew alone, in a tiny cockpit, wearing cumbersome pressure suits and maintaining complete radio silence, for as long as nine hours. The plane was difficult to fly. It was fragile and stalled easily. Strong g-forces could break it apart midair. To save weight, it had only two sets of landing gear, one in the front and the other in the back. “
Landing the U-2,” Leavitt wrote in his memoir, “was like landing a bicycle at 100 mph.”
Of the thirty-eight U-2 pilots with whom he trained, eight died flying the plane.

The Missile Potential Hazard Net was rarely activated, and the commander of SAC usually led it. But General Richard H. Ellis was out of town—and so Leavitt, the second in command, took his place. Leavitt got on the net from the balcony of SAC's underground command post, overlooking the world map. Although he'd flown B-52s for a year, worked at the Pentagon, commanded an Air Force training center, and served on the staff of a NATO general, Leavitt still had the manner of an old-fashioned fighter pilot: cocky, decisive, self-reliant. He did not, however, have firsthand experience working with Titan II missiles. Nor did Colonel Russell Kennedy, the director of missile maintenance at SAC headquarters, who joined Leavitt on the balcony. They would have to rely on the advice and the expertise of others.

•   •   •

T
HE
PRESENCE
OF
A
WHITE
hazy cloud on the other side of blast door 8 was ominous. Regardless of whether it was fuel vapor or smoke, it shouldn't have been there when Gregory Lester opened the door, hoping to grab the RFHCOs. That meant blast door 9, leading to the cableway and the silo, had somehow been breached. That meant blast door 8 was all that stood between the men in the launch control center and a cloud of toxic, perhaps explosive fumes. The plan to reenter the silo was scrapped. Captain Mazzaro had already asked for permission to evacuate. Now he asked for it again, and Heineman, speaking on behalf of his PTS crew, wholeheartedly backed the request.

At the Little Rock command post, the hazard team debated what to do next. For the moment, their options were limited. The PTS team topside was still missing. Colonel Morris and Jeff Kennedy were en route in the helicopter but hadn't brought along air packs and RFHCOs. Rodney Holder, the missile systems analyst technician at 4-7, was getting ready to power down the missile, so that a stray electrical spark wouldn't ignite fuel vapor in the silo. Once the main circuit breakers were shut off, the men in the control center could do little more than stare at the changing tank pressures on the PTPMU.

The K crew worried about the safety of their counterparts at 4-7. Captain Jackie Wells, a member of the K crew, thought that if the missile collapsed, the fuel vapor that had leaked into the blast lock might ignite and rupture blast door 8. Even if the door held, debris from a large explosion might trap everyone in the control center. The blast doors and the escape hatch were supposed to ensure the crew's survival, even after a nuclear detonation. But a Titan II complex had not yet faced that sort of test, and Wells thought the risks of leaving people in the control center outweighed any potential benefit.