Launch Under Attack: A Sword of Damocles
On Jan. 10, 1984, a guidance computer in a U.S. Minuteman-III missile suffered a glitch. As a result, operators in the nearby command center received a message that the missile, aimed at Russia, was entering its launch sequence all on its own. It carried three nuclear warheads. Security forces scrambled to park a truck on top of the silo lid in an attempt to prevent the missile from launching. While the officer in charge later disclaimed that there was a real risk, the truck-parking procedure was in place because the risk of inadvertent launch was understood to be nonzero. This begs the question: Are Russian missiles guaranteed never to launch themselves? Are their missileers perfectly reliable? If the answer is no, then why does the United States maintain a policy that risks starting a nuclear war in the event something goes wrong?
Since the 1960s, the United States has deployed nuclear-tipped ballistic missiles in concrete silos. Barring an almost direct hit, the silo is designed to protect the missile from the crushing overpressure of nuclear explosions so that it can be used for retaliation. In addition to this physical protection, the United States maintains a posture it calls “launch under attack,” a doctrine that permits U.S. missiles to be loosed from their shelters after “multiple, independent sensors” detect an incoming attack from an adversary. The notional purpose of this policy is to provide extra assurance that U.S. silo-based missiles will not be destroyed, silo protections notwithstanding.
Launch under attack proponents argue that this posture improves strategic stability. We argue it does the opposite. A better description of the policy would be “launch on warning.” While multiple sensors are used, those sensors cannot discern whether the warheads on incoming missiles are armed. Because the posture forces a decision before these missiles land, it leaves the president somewhere between zero and 20 minutes to guess at whether the electronic warning messages received constitute an actual attack. This is scant time and an imperfect basis for definitively committing to a civilization-ending nuclear war.
Such a gamble might be deemed necessary if the United States were at risk of losing its weapons from a first strike — a nuclear Pearl Harbor, as the policy’s proponents like to say — but this is not a reality. We argue from published data about missile accuracies and silo hardness that silos will work, and U.S. missiles will survive. In fact, because of a technical twist, the U.S. deterrent force may be stronger after the attack than before it, when measured as weapons available per target. This implies that launch under attack does not provide any additional deterrent against a first strike.
At the same time, there are many historical examples of early-warning systems generating false alarms or computer-generated messages pretending to be actual warnings. When combined with a launch-on-warning posture, these glitches create real risks of accidental war. It is thus not surprising that four-star generals George Lee Butler, Eugene E. Habiger, and James Cartwright — all of whom served as commander of U.S. Strategic Command — have argued forcefully that the United States should abandon its launch under attack policy. Both Presidents George W. Bush and Barack Obama called for severely reducing or eliminating the capacity, stating that it created unacceptable risks. As a candidate, President Bush also argued that the United States should not wait for Russia to reciprocate “because it is in our best interest and the best interest of the world” to act unilaterally. However, U.S. policy remains unchanged.
President Joe Biden’s 2022 Nuclear Posture Review released in October maintains the status quo, but it also confesses that the policy is not needed, stating: “…while the United States maintains the capability to launch nuclear forces under conditions of an ongoing nuclear attack, it does not rely on a launch-under-attack policy to ensure a credible response. Rather, U.S. nuclear forces are postured to withstand an initial attack.” Our simulations support this finding. Even under the most pessimistic assumptions, about 100-200 missiles are expected to survive in their silos — more than enough to inflict severe damage on an adversary.
Silo Survivability Simulations
The scenarios investigated in our work were based on the assertion made in the 2018 Nuclear Posture Review that “To destroy U.S. ICBMs [silo-based missiles] on the ground, an adversary would need to launch a precisely coordinated attack with hundreds of high-yield and accurate warheads. This is an insurmountable challenge for any potential adversary today, with the exception of Russia.”
Following this view, we developed four attack scenarios in which Russia targets each of the 400 U.S. silos with one warhead, two warheads, three warheads, and finally all of its deployed ballistic missiles (in silos, on road-mobile launchers, and on submarines). We used probabilistic computer simulations of missile accuracy and blast effects to estimate the number of silos that would survive the attack, and ran 10,000 simulations for each attack scenario. (Details of missile accuracy and warhead yields are available in supplemental information). Most Russian ballistic missiles carry multiple warheads on independently targeted reentry vehicles, which imposes constraints on a Russian attack because there is a physical limit to how far apart the individual warheads carried by the same missile can be targeted. Our simulations target the individual warheads to optimize their performance.
The findings for each of the four attack profiles are shown in Figure 1. In each case, we assumed unrealistically high performance for Russia’s weapons. Our findings therefore overestimated the damage Russia could do to U.S. nuclear forces. Specifically, our calculations assumed Russian missiles would suffer no launch failures, duds, navigation errors, flight-control errors, or any other failure that would prevent them from reaching their targets. We also assumed zero fratricide, which is to say Russia’s nuclear detonations would not disrupt other incoming Russian warheads. The smallest attack left the United States with 205 ± 9 missiles, which is just over half of the existing force. The largest attack left 102 ± 9 missiles. In addition to these silo-based missiles, the United States would still retain about 1,000 nuclear warheads deployed on submarine-based missiles, and hundreds more to be delivered by bombers.
Figure 1: Results of simulated attacks on U.S. missile silos by Russian deployed ballistic missiles 1-, 2- and 3-warheads per silo, as well as all ballistic missiles (214 silos targeted at 3-to-1 and 186 silos targeted 4-to-1). Error bars are 95 percent confidence intervals.
Under the brinkmanship construct, the ability to deter Russia’s first strike rests on its assessment of both the probability that the United States would decide to retaliate as well as the damage inflicted by that retaliation. With respect to a decision to retaliate, adding launch under attack would not change anything. If the attack were genuine, the United States would respond. Launch under attack does make a decision to use weapons more probable, but only for the subset of cases where the early warning system gave a false alarm — exactly those cases where such a decision would be in error.
That leaves the question of whether the retaliation that the United States could inflict after riding out an attack is comparable to that under launch under attack. Leaving aside U.S. submarines, the number of silo-based missiles remaining would in all cases be sufficient to execute the planned catastrophic damage to Russia’s war-making ability.
First, consider the case where the United States launched all of its silo-based missiles on warning of an incoming, large-scale attack. The Russian arsenal accounts for 138 “counterforce” targets (126 silos, seven mobile missile bases, three nuclear bomber bases, and two nuclear missile submarine bases). To compensate for imperfect accuracy and reliability, each aim point would likely be covered by multiple warheads, as evidenced by declassified Cold War plans. Geographically large targets, like bases, often have multiple aim points. Assuming two warheads per aim point, and that bases have two aim points each while silos have just one, the counterforce targets alone require 300 of the 400 available U.S. silo-based missiles. This would leave 100 weapons for the remaining non-missile counterforce targets, leadership targets, and strategic elements of Russia’s war-making capability such as industry.
Now consider the case after an all-out Russian attack in which the United States did not launch its missile on warning. The 300 counter-missile targets are no longer meaningful targets, since Russia used those weapons in its attack. The other types of targets remain, but now the United States can be expected to have, in the worst case, 102 warheads for these targets where the initial plan designated 100. The situation for the United States is nearly the same regardless of whether the land-based missiles were launched on warning of an incoming attack or not. The remaining U.S. land-based missile force would therefore be adequate to perform its original mission. Moreover, the hundreds of additional submarine- and bomber-based weapons would continue to provide an excellent deterrent against other adversaries or any rebuilt Russian force.
The Counterargument
Given these findings — which we assume are known to military planners — as well as longstanding criticism from former presidents and Strategic Command commanders, the perpetuation of the launch under attack option is curious. The last five Nuclear Posture Reviews have defended the policy using largely identical language:
From the 2002 Nuclear Posture Review: “U.S. forces are not on ‘hair trigger’ alert and rigorous safeguards exist to ensure the highest levels of nuclear weapons safety, security, reliability, and command and control. Multiple, stringent procedural and technical safeguards are in place to guard against U.S. accidental and unauthorized launch. ”
20 years later, the 2022 Nuclear Posture Review provides basically the same defense: “U.S. intercontinental ballistic missiles (ICBMs) are not on ‘hair trigger’ alert. These forces are on day-to-day alert, a posture that contributes to strategic stability. Forces on day-to-day alert are subject to multiple layers of control, and the United States maintains rigorous procedural and technical safeguards to prevent misinformed, accidental, or unauthorized launch.”
Unfortunately, these defenses are naive to the kinds of failures that can emerge in complex systems.
The United States uses “dual phenomenology” to assess missile launches prior to launching a retaliatory strike. As the name suggests, it depends on two independent sensor systems to provide warning of incoming ballistic missiles: The Space Based-Infrared System satellites detect missile launches, and the Upgraded Early Warning Radars track incoming missiles. To fulfill the requirements of dual phenomenology, an incoming missile must be detected by both satellite and radar. While this is a useful safeguard, it does not provide any assurance that the incoming missile carries a nuclear weapon or that those weapons are armed. For instance, missile flight tests are conducted unarmed, and Russia has conducted flight tests from Dombarovsky, which also hosts some of Russia’s silo-based missile forces. An accidental launch from that field may be an unarmed missile. There are other scenarios as well.
Once sensor information is received and evaluated, the alert is advanced up the chain of command through multiple “conferences” until it reaches the president. These conferences are intended to avoid mistakes. However, the whole process leaves only a few minutes to make critical decisions. The president would have at most 20 minutes for incoming land-based missiles and as little as zero minutes for Russian submarine-based missiles based near the United States to decide whether to retaliate. Particularly for Russia’s submarine-based missiles, this timeline is extremely tight, which puts immense pressure on all involved — all without knowing the intent, character, or payload of the incoming missiles. Even if these procedures constitute “rigorous procedural and technical safeguards,” the fact remains that sensors provide unacceptably incomplete information on which to base nuclear war.
Perhaps the biggest risk arises from nonrandom errors, like the one that occurred on Nov. 9, 1979, when North American Aerospace Defense Command received sensor warnings of incoming missiles. The early-warning system showed 250 and then 2,200 missiles incoming from the Soviet Union. The problem was not a technical malfunction: Rather, a training tape was accidentally left in place, and it simulated the information needed to confirm that the launches were authentic.
In addition to human error, there may be common-mode technical failures in electronics or software. Depending on where these occur, they may give the appearance of detections confirmed by redundant sensor systems. For example, on June 3, 1980, a circuit chip failure caused North American Aerospace Defense Command screens to display 200 incoming missiles rather than 000. A similar glitch was responsible for triggering the apparent self-launch of a U.S. missile mentioned at the start of this article.
The only way to be confident that the United States is being attacked with a nuclear weapon is to wait until sensors detect an actual detonation. Unpleasant as that may seem, it bears remembering that whether the United States launches its retaliation before or after the detonation does not change the number of detonations over U.S. soil. Launch under attack cannot reduce U.S. causalities, but it could increase them by unintentionally initiating a nuclear war that didn’t exist. With the stakes so high and missile survivability already adequate, it would be prudent to wait until detonations are confirmed.
A Technical Imperative?
Prior to his becoming Secretary of Defense in 2017, Marine Corps Gen. James Mattis argued that the silo-based missiles were not needed because U.S. submarines were undetectable and would therefore always be capable of retaliation. Proponents of launch under attack now argue that advances in technology could make the submarines at sea vulnerable to attack. While it is true that vulnerable submarines could undermine America’s retaliatory capability, we have shown here that retaliation does not need to hinge on the availability of submarines: Plenty of silo-based missiles will survive. Moreover, there is no evidence that submarines are becoming vulnerable, but if they did, and if Russian forces improved to such a point that enough U.S. silo-based missiles were genuinely at risk, then the Lunch Under Attack policy could always be reinstated.
By contrast, the technical landscape that is actually emerging today suggests it might be time to look beyond Launch Under Attack, because it provides insufficient protection. Increasingly, U.S. adversaries are fielding delivery vehicles that are undetectable by the current suite of sensors, namely cruise missiles and hypersonic vehicles. Without the ability to detect and track all possible delivery vehicles, assured retaliation will require the use of other sources of intelligence beyond the sensors used for dual phenomenology. Thus, the logic of launch on warning, and the technical systems propping up that policy, provides a veil of strong protection but actually falls short of what is now needed.
Similarly, over-reliance on this system leaves the United States under-prepared for detection failures. For example, anti-satellite weapons, including simple ground-based lasers, could disable early-warning satellites. Without satellite detection, the requirements of dual phenomenology could not be fulfilled. It is unclear what would happen at this point. Would the launch under attack policy degenerate to a one-phenomenon launch policy? In that situation, it would take longer for incoming missiles to come within range of the radars, so decision makers would have even less time to evaluate missile threats, on top of needing to assess whether the blinded sensors were caused by a technical malfunction, a hostile act by the attacker, or a third party aiming to introduce confusion. Instead of holding fast to the idea of immediate launch, it is far sounder to build a nuclear capability that can survive a first strike and for which decision-makers are not pressed to make decisions with incomplete information. Fortunately, that condition already exists today, and such a launch policy should be implemented now.
Bottom Line
The United States currently maintains the option to launch under attack so that in the event of first strike by Russia, U.S. silo-based missiles could be launched before they are be destroyed. However, our simulations find that 100-200 silo-based missiles would survive, which would likely leave the United States with more warheads per retaliatory target than before the Russian strike. As such, the United States would suffer no meaningful loss of capability and should update its policy to eliminate the Launch Under Attack option in order to reduce risks of accidental nuclear war caused by technical glitches, human error, or cyber-attack. Revising this policy does not lock the United States into any particular posture: If technologies change, the policy could be reinstated. In the meantime, the United States should strive to deploy a more robust, less provocative, and less dangerous system that is better tuned to emerging threats. There has not yet been a false alarm that prompted an actual nuclear launch, but there’s no need to bet the entire world on the hope it will never happen.
Natalie Montoya is a technical associate at the Laboratory for Nuclear Security and Policy in the Department of Nuclear Science & Engineering at the Massachusetts Institute of Technology. Previously, Natalie was the 2021–2022 James C. Gaither Junior Fellow in the Nuclear Policy Program at the Carnegie Endowment for International Peace.
R. Scott Kemp is associate professor of nuclear science and engineering at the Massachusetts Institute of Technology and director of the Laboratory for Nuclear Security and Policy.
Image: United States Air Force
