Automatic nuclear dead man's switch: How should such a device evaluate if a nation is wiped out?

Question

The Context

It's 2015, and I am a nuclear-armed nation in the midst of a 2nd cold war. Fearing nuclear annhilation by my antagonistic neighbours, a computer was developed - to act as the dead man's switch. In case a nuclear first strike wipes out the chain of command/obliterates the populance, this computer should be able to automatically launch an nuclear counterattack.

The Problem

How should the computer evaluate if the nation is under attack or not? Assuming the scientists tasked to design this device are very cautious, and would not want to risk an accidental nuclear war - they would have to have multiple conditions that would need to be fulfilled before an attack is issued.

Several conditions that come to mind include:

• Watchdog servers in different geographic regions. If these minimalist servers fail to ping back with an response, a condition would be met.

• Radiation/overpressure sensors - things to detect an nuclear blast.

• Transponders on surface ships in harbor - if transponders suddenly all go out, an attack can be deduced, etc.

Answer 1

It would be a three step process, in many ways similar to the concept of "secure second-strike-capability".

0: Ensure Secure second-strike capability

Place secure second-strike capabilities in a location that is secure from nuclear attack. Your options are underground bunkers (can be iffy against direct attack), moving underwater, moving over the road network, moving over the countryside, in the air, or in space (that would break some international treaties).

1: Detect nuclear detonation over protected area

Nuclear detonations are extraordinary events, in terms of the physical effects they produce, and as such they can be detected through a large variety of ways.

Forensic seismology: the shock waves emanating from nuclear tests/blasts are quite strong – a 2009 North Korean underground nuclear test registered as a 4.52 on the Richter scale.

Light flash - nuclear blasts are bright. A Network of sensors over the protected area can detect the characteristic nuclear double flash.

Soundwaves Hydroacoustics or Infrasound - nuclear blasts are loud. A Network of sensors over the protected area can detect the telltalle signs.

Radionuclide detection - nuclear blasts are never clean burning, they create a vast amount of short- and long-lived radionuclides that can be picked up in the wind by a network of sensors placed over a protected area.

Satellite surveillance can detect nuclear blasts over a protected area.

2: Evaluate impact damage.

2.a. Evaluate damage to chain of command

Hardened electronic life-sign monitoring ankle bracelets on either the top officials or their body-guards, or manually answerable encoded radio pings can act as keepalives. If a certain high fraction of the chain of command goes dark outside of regular maintenance and simultaneously, the chain of command can be assumed to have been severed. The program will move to the next step, evaluating whether the nuclear wipe-out condition has also been met.

2.b. Evaluate damage to protected area

A series of satellite or even video monitoring feeds can be fed to image analysis software and be used if atomic flashes are detected to assess the level of damage. Moreover, damage to the existing sensor network placed sensibly around high value targets (like urban and industrial agglomerations), damage to weather stations, TV and radio stations, traffic signal infrastructure, CCTV networks, all can be assessed and a damage score calculated. If a critical threshold is passed post-nuclear flash, the nuclear wipe-out condition can be assumed to have been met.

3: Trigger retaliatory counter-measures.

This part is simple. If the nuclear wipe-out conditions are met, deploy all surviving nuclear assets. Rain righteous death upon all enemies, guilty or not.

Answer 2

The computer should first have a large set of sensors, as you suggested. The most important ones would most likely be radiation and temperature sensors, and a really large number of them, spread wide enough and placed in well secured areas (military bases, police stations etc) so they cannot easily be fooled in a large enough number.

Only if a sufficiently large number of signals suggest a massive attack should your dead man's switch come into place: The computer should send an email (or similar) to a largeish number of people, containing a pass phrase. If none or not enough of those emails are replied to after a reasonably long time (say, two days?), or don't contain the correct answer to the pass phrase, the computer should assume that there are not enough people left to prevent a counter-attack and execute it.

This way you should be able to make sure that a false alarm does not trigger a war, and that no single person, or small group of people, can intentionally set the thing off.

[EDIT] To make things clearer: The email (or whatever system is implemented) does not start the coutner-attack. It is a check system to prevent it: The computer basically states: "i am about to counter-attack: give the correct answer to interrupt that". And only if enough correct answers are given, the counter-attack will be cancelled.

Answer 3

For a device like this, a false positive to launch a nuclear attack is absolutely unacceptable.

Your problem is significantly easier than designing a system that detects an imminent attack such as the Able Archer exercises where the US and USSR almost started a nuclear exchange. Detecting an actual attack just requires measuring the destruction of infrastructure.

Sensor Networks

The core idea behind these sensor nets is a large set of continuous loop fiber optic cables that run out from the Dead Man Switch bunker(s) to the various cities across the country. If the loop is broken then the sensor has detected an event that matches the profile of a nuclear attack. This way, instead of attempting to detect whether something no longer exists, we have proof that it does exist, because of the continuous fiber loop, right up until it doesn't. When the sensor 'fires', have it emit a signal indicating "I have fired" then cut the fiber loop by pyrotechnic charge. This gives us an additional layer of assurance that this is not a false positive event. Distribute the fiber runs so that someone with an errant front-loader doesn't trigger nuclear war.

Sensor Types

• Embed fiber into various critical landmarks such as the legislative building(s), major military complexes and major economic buildings. If the building sustains heavy damaged then the loop will be broken.
• Thermobaric sensors to detect the intense heat and pressure of a nuclear attack.
• Radiation sensors to detect the fallout from a nuclear attack.
• Seismic sensors to detect the signature of a nuclear blast in a specific area.
• Optical sensors to detect the flash of a nuclear attack.
• EM sensors to detect the electro-magnetic pulse of a nuclear explosion.
• Radio sensors to detect when radio stations on all bands stop broadcasting.

Spread these sensors out across the country so that if a single sensor fails, it can be isolated and repaired quickly.

Benefits of Fiber Optic Loops

They're incredibly difficult to hack. Breaking the fiber is instantly detectable. There are no electro-magnetic signals to interfere with or snoop on. The light in the fiber can be encrypted with crazy strong quantum cryptography so that it can't be faked, to guard against if the cable was very carefully compromised and an attacker injected light into the fiber to make a tripped sensor appear like it didn't. The very long loops essentially increase the Dead Man Bunker's sensory reach to include the whole country.

Sensor Synthesis

All of these sensor nets must form a consensus that an attack has occurred. Deciding to take action based on data from sometimes faulty information is an example of a consensus problem in computer science. Information scientists can develop a sufficiently strong algorithm to tolerate sensory false positives.

Any one of these sensor types is insufficient to trigger a counter attack. For example, an earthquake may destroy the legislative building but the thermobaric, radiation and flash sensors won't trigger, so no counterattack is executed. If the fiber loops take many different geographic paths then an earthquake is unlikely to take out enough loops to initiate a launch.

The Real Dead Man

All of these sensory networks can only show that an attack has occurred but not if a retaliation is warranted. Removing humans completely from the equation also removes intuition and compassion. The 1983 Nuclear False Alarm was halted because a human was in the loop and he judged, correctly, that the early warning satellites were malfunctioning, not that an attack was underway.

In the Dead Man Bunker(s), there's an adult human who must give the final order to launch the attack based on information the sensors provide.

Timeout Period

Every year, the system will automatically disable itself unless in the days before the expiration date, the system is reauthorized. This prevents a zombie attack by a system that everyone forgot about (I'm not sure how they would forget but it could happen). And it forces the country's leadership to reevaluate whether it wants a deadman switch every year. Popular sentiment may change and the yearly reactivation is a good time to check that.

Answer 4

Easy way: Employ real "dead man":

Get set of highly motivated and patriotic people. Set them in (say) 14 day set of duties.

The duty will be: You are going to be locked in the bunker from outside for 14 days. With food and water reserves for 14 days. Your most important task is: Press a button at random intervals.

If you fail to press a button, nuclear attack is going to be triggered. That's why its called "dead man switch"

The duty of other guys will be simple: Once your duty is done, they have to unlock you from the bunker, refill food and water and lock someone else from the group in the bunker.

If the people from the group live through "ordinary lives" otherwise, you make sure that nuclear attack from your side is triggered only if there is major event happening.

And if you make these groups all around the country, with condition that at least one button in one of these bunkers needs to be pressed, you made sure that you trigger nuclear attack only in case of major events.

It is almost impossible to automate this process in current tech.

• Seismic detectors can trigger "nuclear attack" event also in case of normal event (like volcano erruption)
• Networks can go down, electricity can have outage (especially if you check for wide areas)
• The detector itself can go false alarm.

Yes, most of the systems can go to really really accurate settings of 99.99999999985% probability that the nuclear war alarm is actually real and happening.

However, if you replace computer with motivated people, you can go 100% and for cheaper price

And to me, in cases of triggering nuclear war, this counts

Answer 5

Interestingly enough, the physical details of the implementation are relatively unimportant. If it ever actually triggers, it's already failed.

Consider the MAD doctrine:

The MAD doctrine assumes that each side has enough nuclear weaponry to destroy the other side and that either side, if attacked for any reason by the other, would retaliate without fail with equal or greater force. The expected result is an immediate irreversible escalation of hostilities resulting in both combatants' mutual, total and assured destruction.

In other words, by the time this system activates you've already lost. The only benefit to having it trigger is you cause your opponent to also lose, which is kind of iffy in my opinion.

Therefore, the primary goal of your system is not to accurately detect that your nation is destroyed. The point of your system is to act as a deterrent, and for that you need to do two things:

1. Secure it, so it can't be disabled or hijacked. Bury and harden it in shelters so it can't be taken out with a first strike.
2. Make it very, very obvious that it exists. Deterrents don't work if your opponents don't' know about them. So this can't be a secret system, it needs to be very in-their-face, lots of press. Leak at least some of the top level details, make sure they know its there and that it's real.

Answer 6

Such a system has existed in Russia/USSR for decades. Google "Dead Hand"; there is a decent Wikipedia article on it. Horrifying.

Answer 7

You want to have a very high certainty that the system is:

• going to react accordingly to what you intended.
• arbitrarily not likely to be triggered after a false alarm.
• reliable and valid.
• arbitrarily not likely to be revealed to the world so its utility is corrupted.

Human and dead man trigger

The solution here is what was said in an earlier response: you just lock people in a basement with no other purpose than pushing a button at regular intervals. This seems nice because it's a direct reflect of what would happen in the countries near by. If no one pushes the button then it's almost certain that a disastrous event happened which prevented humans to come pushing the button... or is it? I mean, after all humans are humans. Especially if you select untrained regular people to be your "dead-men" you're facing a big problem. People are easily corrupted, manipulated and they are likely to leak out secret information that would help some enemies to prevent the automatic strike back to occur.

Let's imagine the following scenario: one of the people involved into the "dead man" process leaks out crucial information about how it works. This information are eventually revealed to an unfriendly country. This enemy send some people at different locations to infiltrate your system in order to be able to replicate its signal. The enemy finally unleash its nuclear power then simulate the signals until he finds out a way to permanently disable the threat.

This is mere one (and maybe not the most clever) among all the possibilities one could imagine to break in your system.

Automated processes

One could think of an automated process as highly reliable because it lacks human common flaws and does not feel anything. It just does its job and that's all but there are several limitations to a machine doing this kind of job. First of all it highly depends on the implementation of the machine by the creators. Since you said they are very cautious one could assume they would not make much mistakes but still... they would make a few at least.

Making a few mistakes could lead to a systematic bias in the system which could lead to a catastrophic result.

An automated process lacks the human intelligence which would allow someone to decide that the launch of nuclear missile has been triggered by error and has to be cancelled. If the sensors which are saying to the central system whether a attack has been made or not is deficient and works in a bad way the central system has no way to figure it out. This is therefore very dangerous and I doubt seriously that such an automated implementation would be chosen by very smart scientists.

Plus, no matter how secure your system is, it can still be infiltrated and corrupted to react in a way you didn't expect. For example an enemy could trigger your secret auto-defensive system intentionally in order to build himself a very nice reason to strike you back and destroy you without being bothered by any other countries.

EDIT: To answer the "mail solution" in an answer below (because it raises an interesting problem).

To solve the problem of false alarm one could say:

• Send mail to people and wait for response.
• Put some people in a confined box and wait for signals.
• etc.

But those are just some implementations of an abstract conceptual solution to a more general problem: how do I check the existence of something?

No matter how clever this system is, this is just a ping. So... how can I be certain that what I see is what it is? How can I be certain that the answer comes from where I think it comes? How can I be certain that I waited long enough?

Any signals can be rerouted, modified, blocked, etc.

Let's do this with an Artificial Intelligence?

So what to do? Since we have human which are not reliable but flexible, cheap and "intelligent enough" to make proper decisions. Machine are reliable but the threat of a systematic bias, mechanical flaws or bugs is very likely and would result in an uncontrolled launch of nuclear missile.

One could think of artificial intelligence in order to have the best of the two worlds, a very docile and unbreakable mind which could "evaluate" a good behaviour in any unpredicted situation... this machine could also verify its own integrity and fix any bias and bugs it would find. Like a learning machine would do. We give this AI the goal : "fire a strike back if someone attacks us". And we let it implements the most optimised solution.

This is an even worse idea. This goal could be subject to perverse instantiation : the machine will not do what we had in mind.

Conclusion

My conclusion is that building a weapon which can decide to kill on its own is a pretty bad idea unless you find a way to be certain that the system is safe. Then whatever the system you chose, it will work since you designed it to be unbreakable. They way does not matter because I think this is not achievable with hard-science level of rigour.

Conclusion (bis)

Just assume your system works :) for example you can say that in your world, your sensors are overwhelmingly reliable. You can push the probability as far as you want by checking into your system with arbitrarily good precision.

Answer 8

First Warning

The computer receives input from existing nuclear tracking systems. This allows it to identify potential launches around the world. It makes a note of each launch, the type of weapon launched, and the country it was launched from. Monitor ground systems dedicated to detecting radiation; I don't know how many cities already have these, but install more of them in major population centers.

Second Warning

For each launch, the computer performs calculations to approximate the weapon's trajectory. If a weapon is destroyed prior to reaching a target, that data point is discarded. If a weapon's calculated path puts it inside the country's borders, issue an alert message to people of authority and any defense system already in place. Continue tracking of all non-discarded data points in real time to be certain a missile hasn't changed course.

For each ground detection of radiation, issue an alert message to people of authority. There's no way to know where ground devices originate from, so the computer takes no additional action at this point.

Retaliation

If a launched missile detonates inside the country's borders at an altitude that can cause harm, initiate a launch sequence on your own missiles and send an alert message to people in authority. Authority figures have a certain amount of time, say, thirty minutes, to abort the sequence. The computer requires an 80% concurrence to stop its own launch sequence.

For ground detonations, there's nothing the computer can do. We don't want to retaliate against every nation that has nuclear capability, especially if a rogue power obtained a nuclear device. Human operators can force the computer to start a launch, but it sends a request for confirmation from authority figures and requires an 80% concurrence before it can start.

Last Resort

Monitor the Internet. Within an hour of any nuclear strike anywhere in the world, it's going to hit every news feed on the Internet. If the detonation occurred inside your country and someone takes credit for the launch, or the news identifies the assailant (again, 80% concurrence among all news feeds), the computer initiates a launch sequence and sends an alert message to authority figures. An 80% concurrence from authority figures within the time limit (30 minutes) forces the computer to abort the launch.

Risks

• Sabotage of detection systems
• Loss of connection to detection systems
• Interception of alert messages
• Improper alert responses
• Loss of Internet connection (recommend using satellite link)

Answer 9

Monitor the internet.

If every reputable news website in the world suddenly has "Country X nuked!" as the headline and worldwide social media explodes over the topic (with your own country being surpisingly silent about it) and nobody cancels the started countdown, unleash hell.

Only counter is to shut down the entire internet. At which point, most of civilization is going to start falling apart anyway, so it doesn't matter anymore.

(You could add "the internet suddenly disappears" to the list of things that start the nuke countdown, of course.)

Answer 10

By the time the nukes have landed, it's too late: the first strike has already hit all (or at least most of) your missile silos. You have nothing to shoot back with.

For this reason, most actual nuclear defense systems attempt to detect the delivery mechanism: the Ballistic Missile. You could look for the large IR signature of a missile launch, or use sophisticated radars to detect the missile body. Also, potentially correlate with known/suspected/possible launch sites. Finally, provide a message to the user.

The user then has a few minutes (missile time of flight) to decide if it is a real attack or not before retaliating. This the done by a person: no sane government would leave this to a computer program.

Bonus points for this system: if you detect the missile in flight, it may also be possible to shoot it down. It functions both as MAD and as missile defense.

Answer 11

I'm surprised nobody mentioned the 1964 movie "Dr. Strangelove: or How I Learned to Stop Worrying and Love the Bomb." They actually dealt with this exact problem, and just how badly it goes when you try to do what you are trying to do. And, spoiler:

They couldn't find a way to fix the mess it made

Fundamentally, your goal is to remove humans from the control loop for weapons designed to end humanity. Phrased that way, you can see why it is particularly difficult to make it safe. What you are trying to create would be considered to be an afront to humanity.

If you had to do it it: it would include:

• 1,000+ duplicate computers all over the US, all analyzing the same data. No action can be taken without a supermajority. Remember, these are computers in a post-nuclear fallout type era. Faults happen. Even the slightest possibility that a computer fault could occur should be watched with extreme suspicion. Literally everything is in the balance

• As part of the interface, the computers should use Rivest's "how to share a secret" system or something similar to ensure not only are the computers instructed to not fire without a supermajority, but they actually lack the ability to unlock the launch codes without it. Of course, because that's just an algorithm, this should not be the only safeguard.

  • The conditions for a launch should be immaculately discussed. We are literally talking about a lose-lose case for all of humanity, written down into the memory banks of a computer. For example, how long does the chain of command need to be interrupted? What probability do the computers need to see in their statistical analyses before concluding that the chain is interrupted. If the president is out of communication, do they wait longer than if the entire chain is destroyed? These are humanity-sized questions that you're going to have your scientists answer. Answer them wrong, and a terrorist who acquires a nuclear weapon suddenly goes from being able to threaten a city to threatening all of humanity, and you are the one who empowered them.

  • Room for error. You are not only putting the entire fate of humanity in your hands, you're putting it in the hands of the enemy (as seen in Dr. Strangelove). If your foes make a mistake, and try to correct it, are you going to obliterate humanity over it?

With all of this in mind, there is a reason that many argue that no nation should have nuclear arms. Even some nuclear arms are potentially too dangerous to entrust to the humans in charge, much less entrusting armageddon for the human race to a computer.

If you look at our weapons, we have a human in the loop on most of our firearms. Even Phalanx, which is mostly automated, has a kill switch with a human behind it. Removing that human element from nukes is considered a bad idea.

If you want to see how it has been done, research the Titan Missile Silos. They are an example of what a cold war era US, utterly fearful of the USSR, considered "acceptable safety." Its actually quite extraordinary how many safeguards they managed to integrate.

Answer 12

There's a lot of talk about sensors here, but I'm going to take a different approach: How would you (a human) determine that the nation has been wiped out and that you should launch your counter-offensive?

Suppose a mass attack had taken place and that you had somehow survived. How would you know? Look outside? Check television, Internet and other media? Get yourself a radiation detector? On the flip side, how do you know, for example, that it hasn't happened while you were writing this question?

The point is that whatever you do, that's probably what you would want an automated system to do, preferably with less emotion and perhaps with more speed and precision. If you weren't sure if your front garden has been landscaped ala-post-apocolyptic style, you might ask others and try to form a general consensus. You might attempt to gain insight from others with more knowledge than you. In the end, you will make a decision (even if that decision is "I'm not sure").

A downside to all human decision making is that not everyone plays fair. Some will try to deceive you, even if there is no gain for them - but in a decision that is so important (like wiping out several billion humans) you would likely be very careful in your assessment and employ thorough, trusted and redundant checks.

Deliberately no specifics in this answer as there are plenty from others, but if a machine could make a "better" (a very imprecise definition) decision than a human - it would likely result in the end of the human race anyway.

In the spirit of http://isitchristmas.com, I guess you could have http://isitnucleararmigeddon.com which your computer could constantly monitor.

Answer 13

A simpler answer that sidesteps the entire question of sensor detection is to require that it be proactively armed. Completely decapitating nuclear strikes rarely come "out of the blue", but rather, can be expected to come after a period of increased tensions. Take as an example the well-known "DEFCON" system that the US uses. Rather than trying to automatically detect and retaliate to a nuclear strike, one would simply arm the counterstrike system when the DEFCON meter hit a certain value, say, DEFCON 2. The counterstrike system would then start a countdown timer, of say, 2 hours. Every 2 hours, National Command Authority must give the appropriate countersign to the systems computers to reset the timer. Should they fail to do so, the weapons launch.