Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety

Eric Schlosser, the investigative journalist behind Fast Food Nation, structures this work of narrative nonfiction around two intertwined threads. One is a minute-by-minute account of a 1980 accident at a Titan II nuclear missile silo in rural Arkansas. The other is a broader history of the United States' effort to manage its nuclear arsenal since 1945, tracing the tension between making weapons ready to use and keeping them from going off by mistake.

On the evening of September 18, 1980, two Air Force repairmen entered the silo at Launch Complex 374-7 near Damascus, Arkansas, to perform routine maintenance on a Titan II, the largest intercontinental ballistic missile the United States ever built. The missile stood 103 feet tall and carried a W-53 warhead, a nine-megaton thermonuclear weapon with roughly three times the explosive force of all the bombs dropped during World War II. Its fuel and oxidizer were hypergolic, meaning they ignited instantly on contact. While Senior Airman David Powell used a ratchet to unscrew a pressure cap on the missile, the socket slipped off, fell about 70 feet, ricocheted off the thrust mount, and punctured the stage 1 fuel tank. Fuel began spraying from the hole.

In the underground control center, the missile combat crew, led by Captain Michael Mazzaro and his deputy, Second Lieutenant Allan Childers, struggled to interpret contradictory warning lights indicating fuel vapor, oxidizer vapor, and fire simultaneously. An emergency response team assembled at the Little Rock Air Force Base command post to assess the toxic and explosive hazards, and Lieutenant General Lloyd Leavitt, the vice commander in chief of the Strategic Air Command (SAC), took charge from Omaha. As hours passed, tank pressures moved in dangerous directions: The fuel tank pressure dropped as fuel leaked out, threatening collapse, while the oxidizer tank pressure rose, threatening rupture. If either tank failed, the two propellants would mix and explode. After an initial denial, the crew received permission to evacuate and escaped through a narrow emergency hatch to the surface.

Schlosser pauses the Damascus narrative repeatedly to trace the deeper history behind this crisis. He recounts the Manhattan Project's race to build the first atomic bombs, the in-flight assembly of the uranium bomb Little Boy aboard the B-29 Enola Gay en route to Hiroshima, and the Trinity test of July 1945, which left observers awed and horrified. He traces the postwar debate over civilian versus military control of nuclear weapons and the creation of the Atomic Energy Commission (AEC) in 1946. General Curtis LeMay transformed SAC into a model of lethal efficiency, yet when AEC chairman David Lilienthal visited Los Alamos in 1947, he discovered that the nation's atomic stockpile essentially did not exist: The United States had at most one operable bomb. America's nuclear deterrent was a bluff.

The book charts the escalation of the arms race through the hydrogen bomb. The 1952 Mike test vaporized an entire island; the 1954 Bravo test produced a yield nearly three times larger than expected, spreading lethal radioactive fallout across thousands of square miles. President Eisenhower adopted a strategy of "massive retaliation," making nuclear weapons the foundation of American defense.

Alongside this buildup, Schlosser documents a mounting record of accidents and near-misses. A B-29 carrying a Mark 4 atomic bomb crashed at Fairfield-Suisun Air Force Base, killing 18 people. A Mark 6 bomb fell from a plane onto a family's yard in Mars Bluff, South Carolina, and its high explosives detonated, injuring six people. Bob Peurifoy, an engineer at Sandia National Laboratory, the facility responsible for arming and fuzing American nuclear weapons, began a decades-long campaign to add stronger safety mechanisms to the stockpile. He faced persistent resistance from the Pentagon, which argued that safety devices might reduce wartime reliability.

The Damascus narrative resumes as the crisis deepened. Jeff Kennedy, the best missile mechanic at Little Rock Air Force Base, violated the two-man policy, which prohibited anyone from being alone in sensitive areas, and entered the abandoned complex to obtain direct pressure readings. The numbers confirmed the danger. Kennedy proposed opening the silo door to vent fuel vapors, but General Leavitt refused, unwilling to risk losing control of the warhead. Hours passed as the command post, SAC headquarters, and the missile's manufacturer, Martin Marietta, debated what to do. A checklist was slowly prepared, with each step requiring approval from Omaha.

Schlosser widens the lens to examine the Kennedy administration's discovery of severe command-and-control vulnerabilities. A B-52 carrying two hydrogen bombs crashed near Goldsboro, North Carolina, in January 1961; one bomb's safety mechanisms all failed except a single low-voltage switch in the cockpit. Secretary of Defense Robert McNamara learned that nuclear weapons at NATO bases were poorly guarded, unlocked, and vulnerable to theft. Los Alamos physicist Harold Agnew brought a prototype electromechanical lock, called a Permissive Action Link, to Washington, and President Kennedy ordered these locks installed over fierce military opposition. The Cuban Missile Crisis of October 1962 brought the superpowers closer to nuclear war than publicly acknowledged; the Soviet Union had almost 100 tactical nuclear weapons in Cuba that would have been used against an American invasion.

In the early morning hours of September 19, Senior Airman David Livingston, who had told fellow crew members he had a premonition that someone would die, walked alone to the silo exhaust vent to test vapor levels; his detector immediately registered its maximum reading. Kennedy and Livingston then attempted to reenter the complex but retreated after readings exceeded 21,000 parts per million of fuel vapor. As Livingston paused on the stairs to flip a ventilation fan switch at a sergeant's instruction, the Titan II exploded. The blast tore apart the silo, hurled the massive silo door more than 200 yards, and launched the missile's second stage, carrying the warhead, into the air.

Kennedy, thrown 150 feet with a broken leg, dragged himself along the perimeter fence, heard Livingston crying for help but could not reach him, and eventually found a radio. Security officers drove back to the complex and found Livingston near the access portal with an abdominal wound. Livingston was helicoptered to Little Rock, where he died the following day from pulmonary edema caused by oxidizer exposure. He was 22 years old.

An Accident Response Group, a team from Sandia and Los Alamos, arrived to inspect the recovered warhead. Peurifoy found that the reentry vehicle, the warhead's outer casing housing its electrical power source, had been stripped away by the explosion, eliminating the energy necessary for detonation. The Air Force blamed the accident on the dropped socket and called the Titan II "a perfectly safe system to operate." Kennedy and other crew members received Airman's Medals for Heroism but also faced disciplinary action; several left the Air Force shortly afterward.

In the book's final chapters, Schlosser traces the last years of the Cold War arms race and the gradual adoption of the safety reforms Peurifoy championed for decades. False alarms at the North American Aerospace Defense Command (NORAD), caused by a training tape and a defective 46-cent computer chip, brought the United States to the brink of nuclear retaliation. The Drell Panel on Nuclear Weapons Safety confirmed in 1990 that America's arsenal was not as safe as it should be. General George Lee Butler, the last head of SAC, reviewed the Single Integrated Operational Plan (SIOP), the nation's nuclear war plan, target by target and eliminated about 75 percent of them. The Strategic Air Command was disbanded in June 1992.

The site of Launch Complex 374-7 has since been returned to farmland, with only patches of concrete and bent metal to suggest what once lay beneath the ground. Thousands of nuclear warheads remain hidden in silos and submarines worldwide. Drawing on sociologist Charles Perrow's "normal accident" theory, Schlosser argues that tightly coupled, complex systems like nuclear arsenals are inherently prone to catastrophic failures that cannot be eliminated through better management alone. The absence of a catastrophic nuclear detonation, the book suggests, reflects not the adequacy of safety systems but the limits of good fortune.