#1207 1962 · Sandia National Laboratories, under Kennedy Administration's NSAM 160 · Nuclear weapons security / defense

Kennedy split every nuclear arming code in two, so no person could arm a weapon alone

问题

Personnel with physical custody of forward-deployed US nuclear weapons could arm one without presidential authorization

背景

By the early Cold War, the United States had stationed thousands of tactical nuclear weapons at NATO bases and other forward positions abroad, physically in the custody of local military commanders and, in some cases, allied foreign forces. Washington had no way to guarantee that every officer with physical access to a weapon, in a crisis or under enemy pressure, would wait for presidential authorization rather than arm and use it on local initiative — and no purely procedural rule or code of discipline could make that guarantee airtight when the stakes were a nuclear detonation.

The Kennedy administration, formalizing work already underway at Sandia National Laboratories, ordered in National Security Action Memorandum 160 (1962) that authorization be built into the physical weapon itself rather than left to trust in the people guarding it. Sandia engineers had been developing electromechanical combination locks since 1960 that could be wired directly into a weapon's arming circuit.

换别人会怎么做

The available levers were personnel-based: screen custodians more carefully, train them more rigorously, and trust the chain of command to prevent unauthorized use — all of which still left a single individual, or a small local group acting in concert, in physical possession of a weapon they alone had every capability needed to arm.

他们看到了什么

No amount of screening removes the risk when one person can act alone. Splitting the code so no individual ever holds it complete made unauthorized use mechanically impossible, not just forbidden.

那一手

Each weapon was fitted with a Permissive Action Link: a combination lock whose code was split so that no single custodian possessed the complete sequence needed to arm it. Arming required two or more authorized individuals to independently enter their separate portions of the code simultaneously — a structural 'two-person rule' built into the hardware, so that even a fully trusted, fully motivated single individual physically holding the weapon still could not use it alone.

为什么管用

By wiring the two-person requirement into the weapon's own arming circuit rather than into a policy document, the safeguard removes judgment from the moment it matters most: there is no rule to break, only a physical action that cannot be completed without a second independent party's simultaneous cooperation. This converts unauthorized use from a discipline failure into a coordination problem between at least two people, which is dramatically harder to arrange, especially under duress or secrecy.

值了多少

PALs were installed across the US arsenal at forward bases through the 1960s; no unauthorized detonation or seizure has been documented.

什么时候会失灵

The mechanism only holds if the split custodians are genuinely independent and cannot collude or be coerced together, and if the lock's code cannot be bypassed by someone with sufficient technical access to the weapon's internals rather than its authorized interface — a sufficiently resourced state-level adversary with physical possession and time could, in principle, attack the lock itself rather than the people guarding the code.

后来呢

Split-knowledge, two-person control became the permanent standard architecture for nuclear weapons custody worldwide, and the concept later directly informed the split-key ideas underlying modern public-key cryptography.

资料来源

[1]How the Presidency Took Control of America's Nuclear ArsenalSmithsonian Magazine, 2018smithsonianmag.com
[2]The U.S. Nuclear Presence in Western Europe, 1954-1962, Part IINational Security Archive, George Washington University, 2020nsarchive.gwu.edu