hasn’t checked in, but his deputy said he was en route to Andrews, along with the director of the FBI.”
“I want you and Secretary Goff airborne ASAP, General, as soon as you arrive at Andrews,” the president said. “As soon as both of you are on board, lift off. Don’t wait for stragglers.”
“Understood, sir.”
“What’s the bad news, General?”
“The bad news, sir,” Venti said grimly, “is that we’re going to get clobbered, and there’s nothing we can do about it except watch — and wait for the casualty counts to come in.”
Their day had started at seven-thirty the previous morning. Captain Bruce Ellerby and Second Lieutenant Christine Johnson, his assistant crew commander, met at the 742nd Missile Squadron to review tech-order changes and alert notes. They wore royal blue Air Force fatigues with white name tapes and insignia, along with squadron scarves.
After a series of briefings to the entire oncoming crews, including launch-facility status, intelligence, weather, and standardization/evaluation reports, the crews piled their tech orders, manuals, and other bags into assigned vans and headed out to their assigned launch-control facilities. Both Ellerby and Johnson were taking correspondence classes while on alert, so they brought backpacks filled with books: Ellerby was working on his master’s degree in aviation-maintenance management from Embry-Riddle Aeronautical University, while Johnson was working on both Squadron Officer School and her master’s degree in computer science from the University of North Dakota.
After dropping off another crew, Ellerby and Johnson made their way to their facility and checked in with the security-forces commander around noon. A security-alert team was sent out to check ID cards and access badges, and the van was allowed to approach the launch-control facility. The crew checked in with the “House Mouse,” the noncommissioned officer who controlled access to the facility, to get the security and operational status of the site, and then placed a lunch order with the cook. By then the House Mouse had checked in with the offgoing crew, received verification of crew change and code words, then opened the elevator-shaft access door for the ongoing crew.
Despite its being only an eight-story ride, it took four minutes for the elevator to reach the bottom. Their first task after reaching the subterranean level was to manually pump open the locking pins securing the ten-ton outer blast door leading to the launch-control electrical bay. Despite being heavy, the door was so well balanced on its hinges that it was easy for Ellerby and Johnson to pull it open. Once inside, the crew completed their preflight checks of the high-voltage electrical systems, switching panels, generators, and batteries, which would supply electrical power to the launch-control facility in case city power was disrupted. Once the checklist was complete, the crew closed the big door and pumped the locks back in.
Meanwhile, the offgoing crew in the launch-control capsule was pumping open the blast door to the capsule. By the time Ellerby and Johnson were finished, the door was open, and they walked across a narrow tunnel leading to the launch-control capsule, an egg-shaped room suspended from the ceiling by enormous spring shock absorbers designed to protect the crew from the blast effects of all but a direct hit by a nuclear weapon.
The offgoing crew commander briefed the ongoing crew on the status of the facility and on any scheduled maintenance or security-team inspections that were to be performed on the facility itself or any of the ten primary and ten secondary missiles under their supervision. The final task was for the offgoing crew to remove their combination locks from the red safe above the deputy commander’s launch console and cut off the tamper-evident truck seals securing the safe. The oncoming crew checked the authentication documents and launch keys, logged the new seal numbers, then closed, locked, and safety-sealed the safe. With the changeover complete, the offgoing crew turned over their sidearms to the new crew and departed. A final one hundred pumps on the handle, and the capsule was closed. After a check-in with the squadron’s other four launch-control facilities and assessment of equipment status, the twenty-four-hour alert tour began.
Normally, pulling alert in a missile launch-control facility meant hours and hours of boredom, punctuated by a few hours of busywork and a few minutes of excitement. This tour was anything but normal. After a fairly quiet day and early evening, the communications system became more and more active as the evening wore on, with several communications and status-report queries from wing and Twentieth Air Force headquarters. Tensions were obviously high. The crews were fully aware of the events that had taken place in Central Asia in recent weeks and months, and of the overall heightened degree of distrust and suspicion of the Russians.
The tension exploded early the next morning with a loud, rapid
The first indication that this was not going to be a normal day: The message decoded as an “Actual” message, not an “Exercise,” and although they had received several “Actual” messages already that shift, getting another so early in the morning was not normal. “I decode the message as a Message Eleven,” Ellerby announced.
“I concur,” Johnson said, her mouth turning instantly dry. She stood up and removed her lock and the truck seal from the red safe while Ellerby joined her. He removed the proper authentication card from the outer compartment. “Card Bravo-Echo.”
“Checks,” she said. He snapped open the foil card and tore off the top, exposing a combination of six letters and numbers underneath the foil, then laid it down on the message book. The characters were exactly as Johnson had copied.
“Authenticators match and are in exact sequence,” Ellerby said.
“I concur,” Johnson said, her heart pounding now.
This time both crew members did everything together, slowly and carefully. They decoded the rest of the message, entering the proper date-time group and instructions on another page in the message book. When they were finished, they looked at each other — and realized they were about to do something neither one of them had ever done except in a simulator.
Ellerby removed his lock from the red safe, cut off the second truck seal, and opened the main compartment. He handed Johnson a key and three more authenticator cards, then took a key and his cards back to his console. The two consoles were fifteen feet apart, separated to avoid any one person from touching the other’s console — especially the switch into which the launch keys were inserted. Meanwhile, Johnson looped the launch key over her neck, strapped herself into her steel seat with a four-point harness, and tightened the straps.
Both crew members began running their checklists as directed in the emergency action message: They notified the other launch-control facilities in the squadron that they had copied and authenticated a valid message; they began the power-up and data-transfer and alignment sequence; and they alerted the aboveground security and maintenance crews that they had received a launch-alert message. The crew was in a hair-trigger readiness state, waiting for the next message.
The next message arrived a few moments later, with retargeting information. On day-to-day alert, the Minuteman III missiles at Minot and elsewhere had “open-ocean” coordinates programmed into the missiles, so in case of an accidental or terrorist launch, the warheads would not hit any real targets. Now real targets had to be entered back into each missile’s warhead. It did not take long to do, but it was scary for the crew members to realize that they had taken the next step toward actually firing their missiles in anger. If the missiles left their silos now, they would strike their assigned targets minutes later — there was no abort, no recall, and no retargeting while in flight.
After the retargeting was completed, there was nothing to do but sit back and wait to copy and authenticate an execution message, which would direct them to complete their launch checklist. The final step was to insert their launch keys into the launch switch and perform simultaneous key turns, which would enter a launch vote into the time-shared master computer. Successful key turns by at least two launch-control capsules with no INHIBIT commands from any other squadron LCCs was necessary to launch the missiles; three successful key turns in the squadron would send a launch command, no matter how many other INHIBIT commands were entered. The master computer would then decide when each missile would launch, automatically holding some missiles while others
