5 ms·

British nukes were only protected by bike locks

48 points by petewarden 17y ago

MrSartorial 17y ago
Wow, that's really interesting. I think that Britain is firmly in the wrong on this one. That places a lot of trust in a lot of individuals hands, which I don't necessarily have a problem with because of a number of psychological factors related to their employment in the army, but that doesn't discount someone infiltrating the systems and activating the missiles.
- jules 17y ago
  I imagine that someone can go crazy when living in a sub for a long period of time.
  - SapphireSun 17y ago
    Especially if they do not have a friendly port to return to anymore.
- cstross 17y ago
  Rubbish. The US Navy's SSBNs work the same way. A second strike deterrent force by definition has to have decentralized launch authority. The backstop is that no single officer can launch the missiles, it takes joint action -- and the officers are carefully screened before being put in that position. One rogue sub officer? Maybe. Enough of them to overpower the rest of the crew and carry out an unauthorized launch? Very unlikely, and begs the question of why.
joubert 17y ago
That's nothing. In the US, we fly nuclear warheads across states. http://www.msnbc.msn.com/id/20427730/ http://www.msnbc.msn.com/id/20427730/
- GrandMasterBirt 17y ago
  That's fine, as long as the warheads could not be detonated it does not matter where they go. The point is that you can arm a British nuke in 98 with a bicycle lock key and no tamper-proof mechanism was there. So if you got a warhead detonation was easy. In the US having a warhead is pointless, you need the codes or the bomb is worthless.
  - joubert 17y ago
    You're 100% correct. According to the news reports at the time the transport was characterized as being a "mistake", i.e. human error. I don't know the intricacy of warhead arming etc., but another article on CNN talks about codes being handled insecurely: http://www.cnn.com/2008/US/07/24/missile.error/ http://www.cnn.com/2008/US/07/24/missile.error/
bensummers 17y ago
Comments here http://www.schneier.com/blog/archives/2007/11/british_nuclear.html http://www.schneier.com/blog/archives/2007/11/british_nuclea... suggest the US just used 111111 as their code. (citation needed)
- jackfoxy 17y ago
  And on this blog is the thoughtful reply "It shouldn't be hard to arm a nuke. It should be hard to get access to it. If you stole one any competant EE could rewire the whole thing to do what he needs anyway. Those inclined to steal a nuke would have this know-how; they wouldn't be your average bank robber or shoe-bomber terrorist. Posted by: Savik at November 21, 2007 2:34 PM" Maybe back in the day a competent EE could rewire, but the modern arming mechanisms are ultra-sophisticated.
  - dfox 17y ago
    ultr-sophisticated, but still any locking mechanism on nuke can be overcomed by sufficiently motivated adversary. And anyone who can steal the nuke is sufficiently motivated, no matter how ultra-sophisticated your lock is. Edit: and overcoming any kind of locking mechanism on nuke is certainly cheaper than building one yourself. What most people seem to forget is that problem with building nuclear weapons lies with logistics, not technical expertise.
    - jackfoxy 17y ago
      Agreed. All the locking mechanisms and codes are to prevent accidental and non-authorized triggering. After that you have to depend on guys with guns for security.
- pvg 17y ago
  It was reportedly 00000000, the source for this is a former US missile launch officer of some sort named Bruce Blair. Google him and the zeros, plenty of references, although I don't know if it's ever been confirmed by documents.
- wrs 17y ago
mattmaroon 17y ago
It's been known widely for some time that on every British nuclear-armed sub, there's a safe, and in that safe another safe, and in that second safe a note from the Prime Minister commanding the sub on what to do in the event that the motherland should be wiped out in an attack while they were away. That would mean it is impossible that they need some sort of special code, as if they did, that code would have to be accessible to them already, and then what is the point?
- joubert 17y ago
  Ira Glass did an insert on this bizarre 007-esque practice in last week's This American Life podcast.
  - stratomorph 17y ago
    The "007" thing makes sense from the standpoint of preventing rogue launches. It's not intended to prevent the missiles from being launched without command authorization. Instead, no single person has all the information needed to launch, so there must be at least two people in on it.
    - joubert 17y ago
      It is bizarre because what is the point in having a secret instruction to a submarine captain when his home country is completely and utterly destroyed by nukes. Consider that everyone that could possibly benefit from such an instruction are no longer in existence.
      - rw 17y ago
        http://en.wikipedia.org/wiki/Mutual_assured_destruction http://en.wikipedia.org/wiki/Mutual_assured_destruction http://en.wikipedia.org/wiki/Fail-deadly http://en.wikipedia.org/wiki/Fail-deadly http://en.wikipedia.org/wiki/Dead_Hand_(nuclear_war) http://en.wikipedia.org/wiki/Dead_Hand_(nuclear_war)
        17y ago
arethuza 17y ago
For anyone interested in this kind of stuff I can recommend this book: http://www.amazon.co.uk/Secret-State-Whitehall-Cold-War/dp/0141008350 http://www.amazon.co.uk/Secret-State-Whitehall-Cold-War/dp/0... The story of how the government planned to communicate with the V bomber fleet is wonderful...
Eliezer 17y ago
> However, the Royal Navy argued that its officers could be trusted and: "It would be invidious to suggest... that senior Service officers may, in difficult circumstances, act in defiance of their clear orders." Even by the standards of a world gone mad, these people are #@!%ing lunatics.
swixmix 17y ago
Summary: British submarines can launch missiles. From the article: "..nuclear bombs were armed by turning a bicycle lock key. There was no other security on the bomb itself." By the way, it's a freaking submarine. Perspective: I lock a gun's trigger with a bike lock, and then place it in a safe. The safe is inside a bank vault. If I do manage to steal the gun, then I can pick the lock and use it. If I do manage to steal the arming key, then I can convince the crew to launch the missile. Would you like to play a game? edit: Grammar
- cstross 17y ago
  Yawn. The W177's were secured with bike locks ... inside a reinforced concrete bunker surrounded by razor wire and patrolled by armed guards with orders to use lethal force to stop anyone trying to gain access to them without proper authorization. Just like the USSR's land-based ICBMs didn't have PAL codes -- instead they were guarded by a platoon of KGB troops who didn't know how to launch the missile, but sure knew how to stop the strategic rocket forces' crew from launching the missile without orders. Folks on HN are predisposed to thinking about automating security procedurally, but seem to miss the point that military organizations have been automating security through process carried out by human bodies for centuries, if not millenia; all they need is enough obedient soldiers with guns and orders not to allow [X] to happen without authorization [Y] or their ass is on the line to ensure that the bombs are de facto secure.
  - motters 17y ago
    Well, not necessarily. A rogue commander could probably persuade his subordinates that he was authorized to use the bicycle key. If someone in a position of apparent authority claims that they will accept responsibility, subordinates will usually go along with that.
    - cstross 17y ago
      The WE.177 (http://en.wikipedia.org/wiki/WE.177 http://en.wikipedia.org/wiki/WE.177 -- note corrected designation) was a free-fall H-bomb, carried on Vulcan and then Tornado bombers, and retired by 1998; you can see details of the 'bike lock' security on that wikipedia page. As such, it was stored on RAF bases and there are extensive procedures in place to ensure that a rogue officer can't order a deployment without it coming down the chain of command. (See also "Dr Strangelove".) The WE.177 was not a sub-launched missile. The Royal Navy's Trident D5s (which come from the same maintenance pool as the US Navy's missiles) are; they do not, as far as I know, use bike locks: if they do, so do the USN's D5s.

48 points by petewarden 17y ago

Wow, that's really interesting. I think that Britain is firmly in the wrong on this one. That places a lot of trust in a lot of individuals hands, which I don't necessarily have a problem with because of a number of psychological factors related to their employment in the army, but that doesn't discount someone infiltrating the systems and activating the missiles.

jules 17y ago
I imagine that someone can go crazy when living in a sub for a long period of time.
- SapphireSun 17y ago
  Especially if they do not have a friendly port to return to anymore.
cstross 17y ago
Rubbish. The US Navy's SSBNs work the same way. A second strike deterrent force by definition has to have decentralized launch authority. The backstop is that no single officer can launch the missiles, it takes joint action -- and the officers are carefully screened before being put in that position. One rogue sub officer? Maybe. Enough of them to overpower the rest of the crew and carry out an unauthorized launch? Very unlikely, and begs the question of why.

joubert 17y ago

That's nothing. In the US, we fly nuclear warheads across states. http://www.msnbc.msn.com/id/20427730/ http://www.msnbc.msn.com/id/20427730/

GrandMasterBirt 17y ago
That's fine, as long as the warheads could not be detonated it does not matter where they go. The point is that you can arm a British nuke in 98 with a bicycle lock key and no tamper-proof mechanism was there. So if you got a warhead detonation was easy. In the US having a warhead is pointless, you need the codes or the bomb is worthless.
- joubert 17y ago
  You're 100% correct. According to the news reports at the time the transport was characterized as being a "mistake", i.e. human error. I don't know the intricacy of warhead arming etc., but another article on CNN talks about codes being handled insecurely: http://www.cnn.com/2008/US/07/24/missile.error/ http://www.cnn.com/2008/US/07/24/missile.error/

bensummers 17y ago

Comments here http://www.schneier.com/blog/archives/2007/11/british_nuclear.html http://www.schneier.com/blog/archives/2007/11/british_nuclea... suggest the US just used 111111 as their code. (citation needed)

jackfoxy 17y ago
And on this blog is the thoughtful reply "It shouldn't be hard to arm a nuke. It should be hard to get access to it. If you stole one any competant EE could rewire the whole thing to do what he needs anyway. Those inclined to steal a nuke would have this know-how; they wouldn't be your average bank robber or shoe-bomber terrorist. Posted by: Savik at November 21, 2007 2:34 PM" Maybe back in the day a competent EE could rewire, but the modern arming mechanisms are ultra-sophisticated.
- dfox 17y ago
  ultr-sophisticated, but still any locking mechanism on nuke can be overcomed by sufficiently motivated adversary. And anyone who can steal the nuke is sufficiently motivated, no matter how ultra-sophisticated your lock is. Edit: and overcoming any kind of locking mechanism on nuke is certainly cheaper than building one yourself. What most people seem to forget is that problem with building nuclear weapons lies with logistics, not technical expertise.
  - jackfoxy 17y ago
    Agreed. All the locking mechanisms and codes are to prevent accidental and non-authorized triggering. After that you have to depend on guys with guns for security.
pvg 17y ago
It was reportedly 00000000, the source for this is a former US missile launch officer of some sort named Bruce Blair. Google him and the zeros, plenty of references, although I don't know if it's ever been confirmed by documents.
wrs 17y ago

mattmaroon 17y ago

It's been known widely for some time that on every British nuclear-armed sub, there's a safe, and in that safe another safe, and in that second safe a note from the Prime Minister commanding the sub on what to do in the event that the motherland should be wiped out in an attack while they were away. That would mean it is impossible that they need some sort of special code, as if they did, that code would have to be accessible to them already, and then what is the point?

joubert 17y ago
Ira Glass did an insert on this bizarre 007-esque practice in last week's This American Life podcast.
- stratomorph 17y ago
  The "007" thing makes sense from the standpoint of preventing rogue launches. It's not intended to prevent the missiles from being launched without command authorization. Instead, no single person has all the information needed to launch, so there must be at least two people in on it.
  - joubert 17y ago
    It is bizarre because what is the point in having a secret instruction to a submarine captain when his home country is completely and utterly destroyed by nukes. Consider that everyone that could possibly benefit from such an instruction are no longer in existence.
    - rw 17y ago
      http://en.wikipedia.org/wiki/Mutual_assured_destruction http://en.wikipedia.org/wiki/Mutual_assured_destruction http://en.wikipedia.org/wiki/Fail-deadly http://en.wikipedia.org/wiki/Fail-deadly http://en.wikipedia.org/wiki/Dead_Hand_(nuclear_war) http://en.wikipedia.org/wiki/Dead_Hand_(nuclear_war)
      - 17y ago

arethuza 17y ago

For anyone interested in this kind of stuff I can recommend this book: http://www.amazon.co.uk/Secret-State-Whitehall-Cold-War/dp/0141008350 http://www.amazon.co.uk/Secret-State-Whitehall-Cold-War/dp/0... The story of how the government planned to communicate with the V bomber fleet is wonderful...

Eliezer 17y ago

> However, the Royal Navy argued that its officers could be trusted and: "It would be invidious to suggest... that senior Service officers may, in difficult circumstances, act in defiance of their clear orders." Even by the standards of a world gone mad, these people are #@!%ing lunatics.

swixmix 17y ago

Summary: British submarines can launch missiles. From the article: "..nuclear bombs were armed by turning a bicycle lock key. There was no other security on the bomb itself." By the way, it's a freaking submarine. Perspective: I lock a gun's trigger with a bike lock, and then place it in a safe. The safe is inside a bank vault. If I do manage to steal the gun, then I can pick the lock and use it. If I do manage to steal the arming key, then I can convince the crew to launch the missile. Would you like to play a game? edit: Grammar

cstross 17y ago
Yawn. The W177's were secured with bike locks ... inside a reinforced concrete bunker surrounded by razor wire and patrolled by armed guards with orders to use lethal force to stop anyone trying to gain access to them without proper authorization. Just like the USSR's land-based ICBMs didn't have PAL codes -- instead they were guarded by a platoon of KGB troops who didn't know how to launch the missile, but sure knew how to stop the strategic rocket forces' crew from launching the missile without orders. Folks on HN are predisposed to thinking about automating security procedurally, but seem to miss the point that military organizations have been automating security through process carried out by human bodies for centuries, if not millenia; all they need is enough obedient soldiers with guns and orders not to allow [X] to happen without authorization [Y] or their ass is on the line to ensure that the bombs are de facto secure.
- motters 17y ago
  Well, not necessarily. A rogue commander could probably persuade his subordinates that he was authorized to use the bicycle key. If someone in a position of apparent authority claims that they will accept responsibility, subordinates will usually go along with that.
  - cstross 17y ago
    The WE.177 (http://en.wikipedia.org/wiki/WE.177 http://en.wikipedia.org/wiki/WE.177 -- note corrected designation) was a free-fall H-bomb, carried on Vulcan and then Tornado bombers, and retired by 1998; you can see details of the 'bike lock' security on that wikipedia page. As such, it was stored on RAF bases and there are extensive procedures in place to ensure that a rogue officer can't order a deployment without it coming down the chain of command. (See also "Dr Strangelove".) The WE.177 was not a sub-launched missile. The Royal Navy's Trident D5s (which come from the same maintenance pool as the US Navy's missiles) are; they do not, as far as I know, use bike locks: if they do, so do the USN's D5s.