#1207 1962 · Sandia National Laboratories, under Kennedy Administration's NSAM 160 · Nuclear weapons security / defense
Kennedy split every nuclear arming code in two, so no person could arm a weapon alone
the problem
Personnel with physical custody of forward-deployed US nuclear weapons could arm one without presidential authorization
background
By the early Cold War, the United States had stationed thousands of tactical nuclear weapons at NATO bases and other forward positions abroad, physically in the custody of local military commanders and, in some cases, allied foreign forces. Washington had no way to guarantee that every officer with physical access to a weapon, in a crisis or under enemy pressure, would wait for presidential authorization rather than arm and use it on local initiative — and no purely procedural rule or code of discipline could make that guarantee airtight when the stakes were a nuclear detonation.
The Kennedy administration, formalizing work already underway at Sandia National Laboratories, ordered in National Security Action Memorandum 160 (1962) that authorization be built into the physical weapon itself rather than left to trust in the people guarding it. Sandia engineers had been developing electromechanical combination locks since 1960 that could be wired directly into a weapon's arming circuit.
what everyone would do
The available levers were personnel-based: screen custodians more carefully, train them more rigorously, and trust the chain of command to prevent unauthorized use — all of which still left a single individual, or a small local group acting in concert, in physical possession of a weapon they alone had every capability needed to arm.
what they saw
No amount of screening removes the risk when one person can act alone. Splitting the code so no individual ever holds it complete made unauthorized use mechanically impossible, not just forbidden.
the move
Each weapon was fitted with a Permissive Action Link: a combination lock whose code was split so that no single custodian possessed the complete sequence needed to arm it. Arming required two or more authorized individuals to independently enter their separate portions of the code simultaneously — a structural 'two-person rule' built into the hardware, so that even a fully trusted, fully motivated single individual physically holding the weapon still could not use it alone.
why it works
By wiring the two-person requirement into the weapon's own arming circuit rather than into a policy document, the safeguard removes judgment from the moment it matters most: there is no rule to break, only a physical action that cannot be completed without a second independent party's simultaneous cooperation. This converts unauthorized use from a discipline failure into a coordination problem between at least two people, which is dramatically harder to arrange, especially under duress or secrecy.
the payoff
PALs were installed across the US arsenal at forward bases through the 1960s; no unauthorized detonation or seizure has been documented.
where it breaks
The mechanism only holds if the split custodians are genuinely independent and cannot collude or be coerced together, and if the lock's code cannot be bypassed by someone with sufficient technical access to the weapon's internals rather than its authorized interface — a sufficiently resourced state-level adversary with physical possession and time could, in principle, attack the lock itself rather than the people guarding the code.
what came after
Split-knowledge, two-person control became the permanent standard architecture for nuclear weapons custody worldwide, and the concept later directly informed the split-key ideas underlying modern public-key cryptography.
references
- [1]How the Presidency Took Control of America's Nuclear ArsenalSmithsonian Magazine, 2018smithsonianmag.com
- [2]The U.S. Nuclear Presence in Western Europe, 1954-1962, Part IINational Security Archive, George Washington University, 2020nsarchive.gwu.edu