In response to a secret order from President Bush, the nation's nuclear weapons laboratories are developing technology to make the weapons virtually impossible to use if they fall into the wrong hands.
The security system will be part of a new generation of nuclear weapons, approved formally last week by a special panel of the Defense and Energy departments.
A nuclear bomb equipped with such safeguards could theoretically be left on the streets of Los Angeles or Manhattan and terrorists would be unable, even given months of tinkering, to detonate it. Scientists say they are working on technology that would destroy every component inside -- including the plutonium and uranium -- if anyone tampered with it.
But the 3-year-old effort, known as National Security Presidential Directive 28, has drawn strong criticism from many nuclear weapons experts, who doubt that absolute safeguards are necessary or even possible. Instead, they say, the federal government should fix known security weaknesses at bomb labs and factories.
The nation has 6,000 nuclear warheads, on missiles and in military depots in places as disparate as Texas, North Dakota and Europe. They all have electronic locks or other safeguards, known as use controls, that pose a tough challenge to terrorists.
But the new plan aims for a dramatic improvement.
The big leap would involve the self-destruction of the weapon without dispersing radioactivity or causing an explosion. The new system would be able to destroy the electronic and mechanical components and to render the plutonium and uranium materials unusable in any crude improvised device.
How? That's secret. But one possibility is that the bomb would contain a powerful acid or other chemical that would poison the uranium and plutonium. The resulting sludge theoretically could be reprocessed, but only in a highly specialized chemical-processing factory.
And, the thinking goes, terrorists who had access to such a factory probably wouldn't need to steal a bomb.
The nation's two nuclear weapons laboratories -- Lawrence Livermore in California and Los Alamos in New Mexico -- are competing to design the new generation of bomb, known as the reliable replacement warhead. The Nuclear Weapons Council, a panel of top Defense and Energy officials, could select a winner as soon as this week.
The use controls on nuclear weapons are among the most secret parts of a very secret enterprise. Scientists call them the "inner workings of the bank vault door."
The national security order Bush signed in 2003 -- the contents of which have not been made public -- has only a single unclassified sentence: the instruction that the labs make it impossible for terrorists to detonate a bomb without its "remanufacture." That clause allows for the remote possibility that terrorists could take the remnants and reassemble them into a new weapon.
"It is essential that we make sure our weapons are impossible for terrorists to use," said Bruce Goodwin, chief of nuclear weapons design at Livermore. The weapons produced during the Cold War, he said, were not designed for an age of terrorism.
"There was no motivation for the Red Army to send in a suicide squad to steal an American weapon," Goodwin said. "They had plenty of their own. There is tremendous incentive to certain people who don't have nuclear weapons to terrorize this nation by stealing one."
Before Sept. 11, security experts had not considered the prospect of a nuclear weapons scientist leading a suicide squad to seize and detonate a U.S. nuclear weapon.
But critics say a terrorist seizing a U.S. bomb is the least likely form of future nuclear terrorism. A more probable scenario, they say, is the theft of highly enriched uranium or plutonium that could be fashioned into a crude nuclear device, or the smuggling of a complete nuclear bomb into the U.S.
"The real threat is the uranium and plutonium materials that are spread across the country in totally inappropriate places and inadequate facilities," said Danielle Brian, executive director of the Project on Government Oversight, a Washington group that has long criticized security at Energy Department sites. "So, rather than fixing the problem they have, they are trying to fix a problem they don't have."
The Energy Department stores weapons-grade materials at many sites, including Livermore, Los Alamos, the Y-12 plant in Tennessee, the Nevada Test Site north of Las Vegas and the Pantex plant in Amarillo, Texas. The department is trying to upgrade protection, but some of its sites fail to meet post-Sept. 11 security standards.
"The secret to avoiding an unauthorized nuclear detonation is maintaining custody of the weapon," said Bob Peurifoy, a retired vice president at Sandia National Laboratory who helped to pioneer use controls during the Cold War. "If a terrorist gains possession of a nuclear weapon because of some fault in custody, I assure you that sooner or later there will be a nuclear detonation."
Although a U.S. nuclear weapon has never been stolen, the U.S. has accidentally lost custody of some. Bombs were dropped or destroyed in a 1961 accident in Goldsboro, N.C.; a 1966 accident in Palomares, Spain; a 1968 accident in Thule, Greenland; and a 1980 accident in Damascus, Ark. Those were recovered, but others have been lost at sea.
Philip Coyle, a former deputy director of the Livermore lab, worries that even the best U.S. technology might not be truly tamper-proof.
"They make it sound like you could leave a nuclear weapon on the streets of Baghdad and nobody would know what to do with it," Coyle said. "I don't think that is quite the case. People can reverse-engineer many things."
And the military, which has always worried about putting locks on weapons, is concerned that a use-control malfunction could prevent the authorized use of a nuclear weapon.
"The argument against doing more and more of the use controls is that you lose confidence in the weapon," said nuclear weapons expert David Mosher of Rand Corp., a Santa Monica think tank. Such technical concerns could lead the military to ask to resume underground nuclear testing, he said.
But scientists at weapons labs say their goal of "absolute surety" is not only the right policy but is clearly achievable.
"We know how to do it," Goodwin said. "The details from an engineering, physics and chemistry point of view are superb. They are just compelling."
The existing stockpile of nuclear weapons is protected by sophisticated electronic and physical systems, only some of which are acknowledged openly. Not all weapons are equally protected. Some have relatively weak controls, whereas others have very advanced systems.
Bush's order was designed to end this piecemeal approach. All existing systems are to be enhanced and integrated in future weapons. In addition, new technology is to be developed to meet the "impossible" standard.
Until 1962, no locks of any kind existed on U.S. nuclear weapons, including weapons deployed across Europe. President Kennedy issued the first secret directive calling for locks and raised concerns in a then-secret national security directive that a "psychotic individual" in the chain of command could start a nuclear war.
Peurifoy recalled being sent on a secret mission in 1962 to install the first locks on warheads in Turkey -- mechanical combination locks on the arming mechanisms.
As nuclear weapons have spread, so have fears about loose controls abroad. Peurifoy and former Los Alamos director Harold Agnew suggest that the U.S. share some of its know-how with other nations, such as Pakistan and India. But Energy Department and weapons lab officials usually reject these suggestions, saying that the U.S. should not help nuclear-club newcomers to improve their weapons and that declassifying such technology could undermine U.S. systems.
American systems have evolved into sophisticated multistage use controls. Many arming mechanisms have electronic locks -- "permissive action links" -- that require transmission of a code, believed to be a 12-digit sequence, to a chip deep inside the bomb. A wrong code is supposed to lock the bomb's arming mechanism.
At least two other use controls also exist. Modern warheads have environmental sensors to determine whether the bomb is on the expected trajectory to a target. If certain accelerations and barometric pressure changes are not confirmed by the sensors, the arming mechanism is disabled.
The most secret use controls involve the plutonium and uranium that set off the nuclear reaction. They disrupt nuclear fission and fusion by distorting internal components until the proper arming sequence is executed. It is here that an acid or other material would poison fissile materials, making the bomb essentially worthless to a terrorist.
Goodwin, the Livermore designer, said that if a U.S. nuclear weapon fell into the wrong hands, he would want it so thoroughly damaged that every part would have to be rebuilt.
"It is really the key to security," he said.
(BEGIN TEXT OF INFOBOX)
Authorizing an attack
How the U.S. would conduct an authorized nuclear attack:
1. The president carries a card bearing authentication codes at all times, so that if he needs to order a nuclear attack he can confirm his identity on a secure line. A briefcase that accompanies the president contains a secure phone and the top-secret nuclear war plan. The call would go to one of the Defense Department's national military command centers -- in the Pentagon, on an airborne jet or at a military base.
2. The president would select a preset war plan, authorizing military commanders to issue a launch order encrypted in 30 alphanumeric digits. The code would identify its origin, which plan had been selected, a time to begin the attack and an eight-digit code to unlock weapons.
3. When the message arrived in submarines, in launch-control bunkers or at air bases, crews would unlock a safe containing the eight-digit unlock code to verify the legitimacy of the launch order. Land-based missiles are ready to launch in 60 seconds. Submarine-based missiles take longer because their guidance systems must be activated.
4. Two launch officers would use special keys to unlock consoles and simultaneously transmit the same launch orders to the missiles. The orders would identify which war plan had been selected. The targets and their coordinates are already programmed into the missile-guidance computers.
5. After the missiles were launched, the nuclear weapons would arm themselves. Sensors aboard the missile would verify that it was experiencing the expected accelerations. A mechanical safe-arming device, which looks like a Swiss watch, would insert a piece of high explosive into a detonator circuit. The bomb would then be ready to burst above its target.
Sources: Bruce Blair, World Security Institute; Lawrence Livermore and
Los Alamos national laboratories; John Pike, GlobalSecurity.org