US Air Force officials tell The Associated Press that twice this year, officers entrusted with the launch keys to nuclear-tipped missiles have been caught leaving open a blast door.
That door is intended to help prevent a terrorist or other intruder from entering the officers' underground command post and potentially compromising secret launch codes.
Transgressions such as this are rarely revealed publicly. But officials say they have happened, undetected, many more times than in the cases of the four officers who were given administrative punishments this year.
The blast door violations are another sign of serious trouble in the handling of the nation's nuclear arsenal. The AP has discovered a series of problems within the ICBM force, including a failed safety inspection, the temporary sidelining of launch officers deemed unfit for duty and the abrupt firing last week of the two-star general in charge.
The problems, including low morale, underscore the challenges of keeping safe such a deadly force that is constantly on alert but is unlikely ever to be used.
The crews who operate the missiles are trained to follow rules without fail, including the prohibition against having the blast door open when only one crew member is awake, because the costs of a mistake are so high.
The officers, known as missileers, are custodians of keys that could launch nuclear hell.
The warheads on the business ends of their missiles are capable of a nuclear yield many times that of the atomic bombs dropped on Japan in 1945.
"The only way that you can have a crew member be in 'rest status' is if that blast door is shut and there is no possibility of anyone accessing the launch control center,'' said Lt. Gen. James Kowalski, the commander of Air Force Global Strike Command. He is responsible for the entire force of 450 Minuteman 3 missiles, plus the Air Force's nuclear-capable bombers.
The written Air Force instruction on ICBM weapon safety, last updated in June 1996, says, "One crewmember at a time may sleep on duty, but both must be awake and capable of detecting an unauthorised act if ... the Launch Control Center blast door is open'' or if someone other than the crew is present.
The blast door is not the first line of defense. An intruder intent on taking control of a missile command post would first face many layers of security before encountering the blast door, which when closed is secured by 12 hydraulically operated steel pins. The door is at the base of an elevator shaft. Entry to that elevator is controlled from an above-ground building. ICBM missile fields are monitored with security cameras and patrolled regularly by armed Air Force guards.
Each underground launch centre, known as a capsule for its pill-like shape, monitors and operates 10 Minuteman 3 missiles.
The missiles stand in reinforced concrete silos and are linked to the control center by buried communications cables. The ICBMs are split evenly among "wings'' based in North Dakota, Wyoming and Montana. Each wing is divided into three squadrons, each responsible for 50 missiles.
In neither of the two reported violations was security of the crews' missiles compromised, the Air Force said in response to questions from the AP, "due to the multiple safeguards and other protections in place.'' But these were clear-cut violations of what the Air Force calls "weapon system safety rules'' meant to be strictly enforced in keeping with the potentially catastrophic, consequences of a breach of nuclear security.
In the two episodes confirmed by the Air Force, the multi-tonne concrete-and-steel door that seals the entrance to the underground launch control centre was deliberately left open while one of two crew members inside napped.
One officer lied about a violation but later admitted to it.
Sleep breaks are allowed during a 24-hour shift, known as an "alert.'' But a written rule says the door meant to keep others out and to protect the crew from the blast effects of a direct nuclear strike must be closed if one is napping.
In an extensive interview last week at his headquarters at Barksdale Air Force Base, Louisiana, Kowalski declined to say whether he was aware that ICBM launch crew members had violated the blast door rule on multiple occasions.
"I'm not aware of it being any different than it's ever been before,'' he said. "And if it had happened out there in the past and was tolerated, it is not tolerated now. So my sense of this is, if we know they're doing it they'll be disciplined for it.''
It is clear that Air Force commanders do, in fact, know these violations are happening.
One of the officers punished for a blast door violation in April at the 91st Missile Wing at Minot Air Force Base, North Dakota, admitted during questioning by superiors to having done it other times without getting caught.
Both officers involved in that case were given what the military calls non-judicial punishment under the Uniform Code of Military Justice, rather than court martialed. One was ordered to forfeit $2,246 in pay for two months and received a letter of reprimand, according to Lt. Col. John Sheets, spokesman for Air Force Global Strike Command. The other launch officer, who admitted to having committed the same violation "a few'' times previously, was given a letter of admonishment, Sheets said.
Kowalski said the crews know better.
"This is not a training problem. This is some people out there are having a problem with discipline,'' he said.
The other confirmed blast door violation happened in May at Malmstrom Air Force Base, Montana. In that case a person who entered the capsule to do maintenance work realized that the deputy crew commander was asleep with the door open and reported the
violation to superiors. Upon questioning, the deputy crew commander initially denied the accusation but later confessed and said her crew commander had encouraged her to lie, Sheets said.
The crew commander received a letter of reprimand and was ordered to forfeit $3,045 in pay for two months, Sheets said. The deputy crew commander was given a letter of reprimand. Punishment of that sort does not require the officer to leave the service but usually is a significant obstacle to promotion and could mean an early end to his or her career.
The AP was tipped off to the Malmstrom episode shortly after it happened by an official who felt strongly that it should be made public and that it reflected a more deeply rooted disciplinary problem inside the ICBM force. The AP learned of the Minot violation through an internal Air Force email. The AP confirmed both incidents with several other Air Force officials.
Sheets said the Minot and Malmstrom violations were the only blast door disciplinary cases in at least two years.
The willingness of some launch officers to leave the blast door open at times reflects a mindset far removed from the Cold War days when the U.S. lived in fear of a nuclear strike by the Soviet Union. It was that fear that provided the original rationale for placing ICBMs in reinforced underground silos and the launch control officers in buried capsules so that in the event of an attack the officers might survive to launch a counterattack.
Today the fear of such an attack has all but disappeared and, with it, the appeal of strictly following the blast door rule.