[Long version] Case study: reducing catastrophic risk from inside the US bureaucracy

This is the longer of two versions of this post; the shorter version is here.

Summary

This post outlines how a small group of focused, committed individuals successfully reduced catastrophic risk from inside the US federal bureaucracy, and considers potential lessons from their experiences.

Before the mid-70s, US nuclear weapons were not rigorously protected against the effects of “abnormal environments” like fires or plane crashes. Meanwhile, there were multiple “near-miss” accidents in exactly those types of environments, some of which came uncomfortably close to catastrophic detonations. Those, in turn, could have plausibly triggered all-out war if misinterpreted as intentional deployments.

Engineers at Sandia National Laboratories did intensive design and development work to address the problem between 1968 and 1972. But it took until 1990 before older weapons that didn’t meet 1968 safety standards were removed from US Quick Reaction Alert.

Why the delay? Stonewalling, evasion, and entrenched interests, both bureaucratic and military. Several of the Sandia engineers, led by Bob Peurifoy, advocated relentlessly for older weapons to be retrofitted or retired and for decision makers to see reason. They continued those efforts for almost two decades despite considerable resistance.

(Acronym sidebar: at this point, I’m introducing an acronym to refer to Bob Peurifoy and his allies: the SEAs (Sandia Engineer-Advocates). I’m not wedded to it, but I’ve found it a useful shorthand when writing and I suspect it might make for a smoother reading experience compared to the alternatives).

Key takeaways

With low-ish confidence in this topic (see Framing and methodology, just below), here are my main takeaways in terms of potential lessons and points of inspiration:

• Peurifoy showed considerable personal agency in assuming the mantle of safety advocate as an engineer and manager at Sandia.
• Relatedly, he and the SEAs (that’s the Sandia Engineer-Advocates, remember) just put in a huge amount of effort: briefing thousands of people, and persisting over a long period despite slow external progress, significant opposition, and—at least in some cases—professional risk.
• They made relatively quick and impactful progress on things over which they had more control: fostering the design of safer weapons at Sandia via research, persuasion, and internal education, and exercising leverage to ensure that the majority of new weapons used those safer designs.
• Peurifoy was an expert weapon designer himself and his excellence enabled him to grow in seniority over time, increasing his internal and external influence.
• When the SEAs eventually got the opportunity to advocate directly to those with power to effect external change, their many years of continued effort meant that they had all the arguments and evidence ready to make their case quickly and effectively.
• The interventions of external allies in the later years, including Senator John Glenn, were important catalysts for the SEAs’ eventual breakthrough. These individuals had credibility and influence, while also being less vulnerable to professional consequences than the SEAs.
• It’s plausible that the SEAs could have achieved earlier or greater success with different approaches to strategy or communications. But they were working in a pretty intractable problem space—it’s likewise plausible that they just had to wait for the Overton window to shift in order to make their breakthrough (and that their advocacy may have contributed to that shift in part).

Framing and methodology

This is a low-ish confidence post. It’s the result of a few weeks’ research into most of the readily available sources; I’m not a trained journalist or historian, I’ve never worked for a government or a large bureaucracy, and I’m not an expert in nuclear weapons or any other content area covered here. Most of the main players are now dead, and many primary sources are still classified or otherwise hard to access. So it seems pretty likely that I’ve missed or misrepresented some key information.

Eric Schlosser’s Command and Control (2013) was my main entry point to this topic (and I highly recommend it). I’ve referenced it extensively below and followed as many trails as I had time for from Schlosser’s citations. In the case of a few quotes I’ve used here, Schlosser doesn’t provide an explicit citation for a claim or event description. He spent a lot of time interviewing Bob Peurifoy and Bill Stevens when researching the book (as well as others)—in most of these cases, the contextual implication is that Schlosser is paraphrasing events or perspectives as his interviewees described them. I’ve tried to note where this is the case in the footnotes, but I’ve probably missed some. (Bill Stevens died in 2016, and Bob Peurifoy in 2017).

I interviewed three individuals who were directly or closely involved with events: Gordon Moe, Barbara Peurifoy, and Stan Spray. Bob Peurifoy published a short personal account of his experiences in a chapter of The Nuclear Enterprise. There’s also a collection of his personal papers at the Hoover Institute—I wasn’t able to visit this in person, but I did get copies of a few of the documents (referenced in the relevant footnotes). Gordon Moe also put together a Tribute document to Bob Peurifoy, which includes some of his writing and correspondence.

Timeline of some key events

(Not exhaustive, just for quick reference/visualization. Details and citations in main body of post.)^[1]

Problem space: US weapons safety and accidents up to 1968

1968 was a landmark year in US nuclear weapon safety, with new safety standards issued and Sandia Labs setting up its first Nuclear Safety Department. I’ll expand on those and related events in the next section; before that, I’ll summarize prior context and key events to give a sense of the landscape in which the SEAs were working.

Control of, and attitudes towards, nuclear weapons

The issue of civilian versus military control over nuclear weapons was as old as the weapons themselves. The Army had overseen the Manhattan Project from 1942 to 1946, before the 1946 Atomic Energy Act established civilian control of weapon development, giving executive management to the Atomic Energy Commission (AEC) with congressional oversight from the Joint Committee on Atomic Energy (JCAE). But, Eric Schlosser writes:

David E. Lilienthal, the head of the Atomic Energy Commission, faced unrelenting pressure, from his first day in office, to hand over America’s nuclear arsenal to the military. The Joint Chiefs of Staff repeatedly asserted that the nation’s most powerful weapons should be kept securely in the custody of officers who might one day have to use them.^[2]

The AEC initially had physical possession of weapons but Schlosser notes that, by 1950,

that custody, required by the Atomic Energy Act, had in many respects become a legal fiction. For example, at Site Baker, the storage facility in Killeen, Texas, the AEC had eleven employees—and the military had five hundred, including all two hundred security personnel.^[3]

Even so, the military pushed hard against those AEC-run sites:

The Joint Chiefs argued that nuclear weapons should be stored at military bases and that time-consuming procedures to authorize their use should be scrapped. Civilian custody was portrayed as a grave threat to readiness and national security.^[4]

And they continued to make inroads over the course of the Eisenhower administration:

In 1954...[the AEC], a civilian agency that had once enjoyed complete control over the stockpile became, in effect, a supplier of nuclear weapons for the military. The Army, Navy, and Air Force were now customers whose demands had to be met.^[5]

In December 1956 the military had gained permission to use nuclear weapons in air defense. In February 1959 the military had gained custody of all the thermonuclear weapons stored at Army, Navy, and Air Force facilities. The Atomic Energy Commission retained custody of only those kept at its own storage sites. And in December 1959 the military had finally won the kind of control that it had sought since the end of the Second World War. Eisenhower agreed to let high-ranking commanders decide whether to use nuclear weapons, during an emergency, when the president couldn’t be reached.^[6]

In the early 60s, Kennedy and his Defense Secretary, Robert McNamara, attempted to reassert civilian control,^[7] but with mixed consequences:

Kennedy gave the Department of Defense “responsibility for identifying and resolving health and safety problems connected with the custody and storage of nuclear weapons.” The Atomic Energy Commission was to play an important, though subsidiary, role...Kennedy’s decision empowered McNamara to do whatever seemed necessary. But it also reinforced military, not civilian, control of the system.^[8]

The high stakes also led to rivalry between the military services over nuclear funding, capability, and influence. Per James R. Schlesinger, former Secretary of Defense and Energy, “if [the services] were to be relevant—which means getting funding from the administration and the Congress—they had to be part of the charmed circle of nuclear capabilities.”^[9] John S. Foster, former Director of Livermore Labs and Defense Department official, says of the services, “every offensive capability they had, had to become nuclear. Everyone had to have one.”^[10] Schlosser also references several instances of the military services jostling for nuclear dominance in these years.^[11]

But the Air Force’s Strategic Air Command (SAC) had the most power regarding nuclear weapons, and its leaders typically sought to maximize weapon capacity and favored aggressive approaches to nuclear war:

The only way to win a nuclear war, according to SAC, was to strike first and strike hard. “Successful offense brings victory; successful defense can now only lessen defeat,” [SAC head Curtis LeMay] told his commanders.^[12]

Instead of air defense, LeMay wanted every available dollar to be spent on more [nuclear] bombs and more bombers for the Strategic Air Command—so that Soviet planes could be destroyed before they ever left the ground.^[13]

Both LeMay and his successor, Thomas Power, also favored the development of a 60 megaton bomb,^[14] “more than four thousand times more powerful than the one that destroyed Hiroshima.”^[15]

LeMay, Power, and SAC’s dominance lessened over the course of the 60s,^[16] but SAC still had planes carrying nuclear bombs flying a 24-hour alert over North America and western Europe through to early 1968.

Relationship between the military and the labs

Nuclear weapon development was (and still is today) the remit of three separate labs: Sandia, Livermore, and Los Alamos. They were overseen and funded by the AEC, but their work was determined by contracts from the military whom Peurifoy described as “a customer who had no budget responsibility.”^[17] Schlosser writes of the dynamic by the mid-70s:

The role of the weapons laboratories had become mainly advisory. They competed for contracts from the Department of Defense—and felt reluctant to criticize their largest customer.^[18]

As I understand it, the military determined the scope (or “military characteristics”) for each weapon and had veto power over weapon design and budget, but wasn’t actually accountable for the spending—that was the AEC and its successor institutions.^[19]

In theory, the principle of “always/never” applies to US nuclear weapons: they should always work when deployed intentionally, and never detonate in any other situation.^[20] The military was much more concerned with the “always” side of things, and was typically resistant to safety requirements that they perceived as obstacles to quick and effective deployment. As Peurifoy claimed, “their focus was reliability, readiness—not accident safety,”^[21] a perspective Gordon Moe shares:

The military was a lot more concerned about being ready and prepared to respond to what might happen [geopolitically]—and anything might happen. So they spent less time worrying about things that might slow them down.^[22]

The military also resisted attempts to alter or update deployed weapons that were already in their hands. One such example is the joint efforts of the labs, the JCAE, and the White House to retroactively fit some weapons with permissive-action links (PALs) in the 1960s. Briefly, the goal was to prevent unauthorized use of US weapons, specifically those deployed in the possession of NATO allies.^[23]

Former Sandia Executive VP Jack Howard remembered the military response after his demonstration of a PAL prototype: “that’s an interesting solution, but we don’t have a problem that goes with it.”^[24] Schlosser writes that

the American military...vehemently opposed putting any locks on nuclear weapons...“No single device can be expected to increase both safety and readiness,” the Joint Chiefs of Staff argued.^[25]

To be clear, the military had had some negative experiences with safety devices. Early PAL models’ batteries “had a tendency to run down without warning. When that happened, the weapons couldn’t be unlocked.”^[26] And in the mid-60s, extensive problems with a Livermore safety improvement to a submarine warhead led to “almost zero confidence that the warhead would work as intended.”^[27] Schlosser continues:

For the next four years, Livermore tried to fix the safety mechanism of the W-47, without success. The Navy was furious, and all the warheads had to be replaced.^[28]

Accidents overview

But over a thousand weapons had been involved in incidents or accidents between 1950 and 1968,^[29] including 31 Broken Arrows. (A Broken Arrow is “any unplanned occurrence involving loss or destruction of, or serious damage to, nuclear weapons or their components which results in an actual or potential hazard to life or property.”)^[30]

Three notable Broken Arrows were US Air Force crashes involving hydrogen bombs:

Goldsboro, North Carolina (1961)

The plane broke up during descent, three crewmen died, and its two bombs fell to the ground.^[31] According to Sidney Drell, “just one switch in the arming sequence of one of the bombs, by remaining in its ‘off position’ while the aircraft was disintegrating, was all that prevented a full-yield nuclear explosion.”^[32] Regarding that switch—the “Ready/Safe” switch—former Sandia engineer Charlie Burks reported that “there have been thirty-some incidents where the Ready/Safe switch was operated inadvertently. We're fortunate that the weapons involved at Goldsboro were not suffering from that same malady.”^[33] If that switch had also failed, lethal fallout could potentially have spread 500 miles north to New York City.^[34]

Palomares, southern Spain (1966)

Seven crew members died in a mid-air collision by the coast; three of four bombs fell on land, the fourth in the ocean.^[35] Peurifoy wrote that “the danger of a nuclear detonation was similar to that in the Goldsboro accident”^[36] While there was no nuclear yield,^[37] the high explosives in two of the land-fallen bombs partially detonated, contaminating a village with plutonium.

Thule, Greenland (1968)

A plane crashed into the ice near a strategically-critical airbase, killing one crew member.^[38] Again, there was no nuclear event, but the explosives in all four bombs detonated, dispersing plutonium for miles. Fred Iklé, former Under Secretary of Defense for Policy, believed that given Thule’s location and strategic importance, “if [there had been] a nuclear explosion beyond just a scattering of nuclear materials, we would have been very close to the edge of nuclear war by accident.”^[39]

But the military and Pentagon appear not to have been overly concerned about the accident risks, communicating as much through both public and classified channels. In 1957, Secretary of Defense Erwin Wilson stated that “the possibility of any nuclear explosion occurring as a result of an accident involving either impact or fire is virtually non-existent.”^[40] The following year, Eisenhower was briefed that “the probability of any nuclear detonation during a crash is essentially zero.”^[41] And in 1961

a State Department official summarized the military’s position: “all is well with the atomic stockpile program and there is no need for any changes.”^[42]

While the three Broken Arrows covered above were too big to hide, the military apparently erred on the side of non-disclosure whenever possible. As Peurifoy told it, “the DoD has a policy of "neither affirming nor denying" a nuclear weapon accident unless it's obvious to the public.”^[43]

And “the public” here includes the weapon designers themselves. Peurifoy recounts that “I was unaware of a large number of accidents and incidents because I had no access to the information.”^[44] Schlosser adds that, given the successes of Soviet espionage, “the United States was often more successful at keeping secrets from its own weapon designers than at keeping them from the Soviet Union.^[45]

Awareness of risks in abnormal environments

Without the full picture of the accident record, there was apparently relatively little urgency around safety at the labs. In the mid-60s, according to Schlosser:

The need for new safety devices was not apparent. Again and again, the existing ones worked [in accidents such as Goldsboro]...At Los Alamos, Livermore, and Sandia, the reliability of nuclear weapons continued to receive far greater attention than their safety.^[46]

Schlosser also writes that Bill Stevens, Sandia’s first head of Nuclear Safety, “wasn’t convinced that nuclear weapon accidents posed a grave threat to the United States”^[47] when he was first appointed. Former Sandia Senior Engineer Stan Spray remembers things much the same way:

Safety reviews were conducted by AEC and DOD to assure that adequate devices were provided. To me, at that time, the weapon community appeared satisfied that the weapon safety elements had done their job and the weapons were safe.^[48]

But Palomares and Thule had vividly demonstrated how the detonation of weapons’ high explosives could scatter plutonium following a crash. And Goldsboro revealed that, in an unpredictable environment like the mid-air break-up of a plane, a bomb’s electrical components could behave equally unpredictably.

There was also room for improvement in terms of standards consistency and risk quantification. The concept of one-point safety had been standard in weapon design since the 50s: a weapon’s nuclear core was encased in high explosives which had to be detonated at multiple points simultaneously for the bomb to work as designed. If the explosives were only detonated at one point, they’d consume themselves without transferring enough energy to cause a nuclear explosion—this is what happened at both Palomares and Thule, for example.^[49]

But, per Peurifoy, “between 1958 and 1968 one-point safety requirements...were dealer's choice."^[50] That is, the probability limit for the failure of a weapon’s one-point safety protections was determined on a per-weapon basis, rather than being standardized.

Relatedly, up to the late 60s the odds of an accidental detonation “were usually said to be one in a million during storage, transportation, and handling.”^[51] But, shortly after becoming Sandia head of Nuclear Safety in 1968, Bill Stevens realized that “the one-in-a-million assurances that Sandia had made for years now seemed questionable. They’d been made without much empirical evidence.”^[52]

Stevens recalled:

A typical military characteristic of the time was: “The probability of a premature nuclear detonation from random component failure within the warhead...shall not exceed 10^6 (one in 1,000,000)”...The problem was that the numerical probability requirement was dimensionless, e.g. [sic] it didn’t address probability rate: per nuclear weapon, per weapon system, per stockpile per year, etc. If...it means per nuclear weapon, an interpretation could be that the national risk was about one in 100 (10^2), obtained by multiplying 10^6 by the number of weapons in the national stockpile (say, 10^4).^[53]

And with greater access to accident and incident reports as a Sandia department head, Bill Stevens was persuaded that

the safety of America’s nuclear weapons couldn’t be assumed. The available data was insufficient for making accurate predictions about the future; a thousand weapon accidents were not enough for any reliable calculation of the odds. Twenty-three weapons had been directly exposed to fires during an accident, without detonating. Did that prove a fire couldn’t detonate a nuclear weapon? Or would the twenty-fourth exposure produce a blinding white flash and a mushroom cloud?^[54]

Design solutions, 1968-1972

In the aftermath of the Thule accident, the Chairman of the Military Liaison Committee to the AEC, Carl Walske, worked with a group of Sandia engineers to standardize higher stringency in the probability limits for premature weapon detonations:^[55]

The probability of a premature nuclear detonation of a warhead due to warhead component malfunctions, in a mated or unmated condition, in that absence of any input signals except for specified signals (e.g., monitoring and control), shall not exceed:

1. Prior to launch, for...normal storage and operational environments...1 in 10^9 per warhead lifetime.
2. Prior to launch, for...abnormal environments...1 in 10^6 per warhead exposure or accident.^[56]

At Sandia, Jack Howard had recently been promoted to VP of Weapon Development. He first convened a Sandia safety study group^[57] then set up a Nuclear Weapon Safety Department to meet the new requirements, appointing Bill Stevens as its head.^[58] Eric Schlosser reports how Stevens approached his new remit:

Instead of basing weapon safety on probabilistic estimates, Stevens wanted to ground it in a thorough understanding of abnormal environments—and how the components of a nuclear weapon would behave in them. During a single accident a weapon might be crushed, burned, and struck by debris, at a wide range of temperatures and velocities. The interplay among those factors was almost impossible to quantify or predict, and no two accidents would ever be exactly the same. But he thought that good engineering could invent safety devices that would always respond predictably.^[59]

Howard also established an Independent Safety Assessment Group, led by Stan Spray, which “ruthlessly burned, scorched, baked, crushed, and tortured weapon components to find their potential flaws.”^[60] Spray’s team’s work upturned some previous thinking about how electrical components would behave in abnormal environments. "One of the assumptions they were making was that short to ground would be safe," Spray told me.^[61] But his team’s experimental research uncovered unpredictable behavior in the extreme heat of a fire or lightning strike:

The charring of a circuit board could transform its fiberglass from an insulator into a conductor of electricity. The solder of a heat-sensitive fuse was supposed to melt when it reached a certain temperature, blocking the passage of current during a fire…[but it could] flow back into its original place, reconnect wires and allow current to travel between them.”^[62]

The work of Stevens’s and Spray’s teams led to the definition of the three principles of ENDS (Enhanced Nuclear Detonation Safety):^[63]

• Incompatibility—the signal used to arm the weapon before firing must be an "unambiguous indication of an intent to get a nuclear detonation,"^[64] and “unique relative to signals found in nature.”^[65] This could be achieved via the use of e.g. a unique signal generator.

• Isolation—a weapon’s firing set and detonators must be isolated from unintended energy sources by creating an exclusion region using physical barriers within the firing circuit, aka “strong links.”

• Inoperability—“essential elements for detonating the warhead are designed to become inoperable, i.e., to fail, before the isolation features fail,”^[66] aka “weak links”

Sandia also collaborated with Los Alamos Labs to research and recommend the use of insensitive high explosives (IHE) in 1972.^[67] IHEs are much harder to detonate than the conventional explosives used up to that point; they would likely have prevented the detonation and plutonium dispersal at Palomares, for example.^[68]

The Fowler Letter: 1973-1974

With the ENDS-themed solutions of weak link/strong link components and unique arming signals, plus the recommendation of IHE, Schlosser writes that:

all the necessary elements for nuclear weapon safety were now available…The only thing missing was the willingness to fight a bureaucratic war on their behalf—and Bob Peurifoy had that quality in abundance.^[69]

Peurifoy became director of weapon development at Sandia in September 1973 and got an immediate sense of the problem’s scale, “I read through all of the known accident reports, and it scared the hell out of me.”^[70] Concluding that the US was “living on borrowed time,”^[71] here’s what Peurifoy did next: “I required that all new weapon designs use ENDS technology [and] I recommended to my vice president, Glenn Fowler,^[72] that we push for a safety upgrade of weapons then in the stockpile.^[73]

Fowler agreed with Peurifoy’s concerns, and arranged a briefing to the rest of Sandia management in February 1974. But it wasn’t a success—Bill Stevens wrote that their reactions “varied from indifference to direct opposition,”^[74] with the anti-retrofit contingent arguing

that recommending a retrofit would be a suggestion that Sandia had been imperfect, that new weapons….[would] eventually replace the older ones, and that a retrofit program would waste resources on the stockpile instead of…R&D.^[75]

Schlosser elaborates:

Sandia couldn’t force the armed services to alter their weapons, and the Department of Defense had the ultimate responsibility for nuclear weapon safety. The lab’s upper management said, essentially, that this was someone else’s problem.^[76]

Nevertheless, Fowler and Peurifoy opted to escalate, briefing AEC official Major General Ernest Graves in April 1974. Stevens described Graves and his staff as “passive recipients of the proposal,”^[77] while Schlosser says it more bluntly: “Graves listened to the presentation and then did nothing about it.”^[78]

So Peurifoy and Fowler put their safety concerns on the record in what became known as the “Fowler Letter,”^[79] recommending the retrofit or retirement of many weapons in the current stockpile. “Fireworks erupted in Washington,” Peurifoy remembered, “because plausible deniability had been destroyed.”^[80] Don Cotter, another AEC official and a former Sandia engineer, was both unreceptive and offended. “It’s our stockpile. We think it’s safe. Who do you guys think you are?”^[81]

As a VP, Fowler in particular had put himself at professional risk by stepping over the established line between the labs’ and military’s respective turfs. Barbara Peurifoy told me that her husband “greatly admired Glenn Fowler, and his courage in writing the letter,”^[82] while Bob Peurifoy wrote that Fowler was “abused by Sandia, the ACE, and the DoD.”^[83]

But the risk didn’t bring any evident reward. Bill Stevens recounted that the official response to the Fowler letter was “mostly delaying actions in the guise of requiring detailed safety studies."^[84]

Schlosser expands:

Fowler kept his job. But the recommendations in his letter weren’t followed. No air-delivered weapons were taken out of service or retrofitted with new safety mechanisms. Instead, a series of government studies was commissioned to explore the issue of nuclear weapon safety, a classic bureaucratic maneuver to delay taking any action. The Department of Defense argued that “the magnitude of the safety problems is not readily apparent.”^[85]

Burned boards and slow progress: 1975-1988

The Burned Board Briefings

In 1975, the SEAs launched the “Burned Board Briefings”, in which Stan Spray presented damaged hardware from his simulations of abnormal environments and the resulting impacts on weapon circuit behavior. Don Cotter and Ernest Graves received some of the first briefings; Stevens wrote that they “reacted so angrily to the briefing that their comments defied reason."^[86]

According to Stan Spray, the briefing audiences were typically receptive—but bureaucratic and budgetary stalling continued to block progress on “weapons of concern” (those that the SEAs had recommended for retrofit or retirement).^[87]

The SEAs briefed thousands, both internally at Sandia, and externally to senior military and government officials. Per Bill Stevens:

In mid-1985, I had made an estimate of total briefings and persons briefed over the period since January 1975, about 245 and 2,200. About 800 persons were non-Sandians, including key military and civilians in the national nuclear weapons community and/or their staffs...By 1990, the total had reached some 5,000 persons briefed.^[88]

Roughly extrapolating from Stevens’s 1975-1985 estimates, that suggests ballpark numbers of 550 total briefings across 1975-1990, and around 1800 external people briefed.

There’s no comprehensive official list to confirm Stevens’s numbers that I’m aware of, but there is a list in the Peurifoy papers of “Officials Briefed at Sandia on Stockpile Safety” covering the same period (I don’t think it’s online in full, but you can see a glimpse of its first page at 49:57 of Always/Never Part 2). It lists 70-80 non-Sandia officials (there are 86 line items but a few are repeat briefees). Note that the document only covers briefings “at Sandia,” which may explain the difference with Stevens’s numbers—other briefings took place in Washington (and maybe elsewhere too?). Also, this document apparently just lists the most senior official(s) at a given briefing—inferring from Stevens’s numbers again, it sounds like there was a mean of 9 audience members/briefees at each briefing.

Here are some notable briefings and other aspects of the document:^[89]

• After a flurry in 1975, there are no briefed individuals listed for 1976 and one each for 1977 and 1978, before they pick back up again in 1979 to a rate of ~5 per year through 1987.

• January 1981: Air Force Inspector General Howard Leaf was briefed (Bill Stevens gives his first Burned Board briefing as June 1980—maybe in Washington?)^[90]

• October 1981: two senior members of the Joint Chiefs’ Operations directorate.

• October 1987: the Inspector General of SAC; the director of the Defense Nuclear Agency.

• 22 individuals listed in 1988, 7 in 1989, 8 in 1990, including …

• January 1988: two members of the House Armed Services Committee (the first elected officials listed).

• February 1988: Gordon Moe (more in the next section).

• April 1989: Senator John Glenn (ditto).

• February 1990: Energy Secretary James D. Watkins (ditto).

Technical persuasion

While the briefings don’t appear to have moved any external needles regarding deployed weapons before 1988, they do seem to have made a significant impact at Sandia. As part of his remit with the Independent Safety Assessment Group, Stan Spray started “an extensive teaching program with classes and hardware” with “hundreds of people a year going through my classes” in Sandia’s Burned Board Room (yes, there was a room). He also “gave hundreds of internal presentations and demonstrations to convince Sandia designers of the need to change [weapon safety design.]”^[91] Bill Stevens credits Spray with briefing over 10,000 individuals on nuclear weapon safety principles across his career.^[92]

While Sandia engineers were a friendlier crowd overall than non-Sandia officials, Spray recollects that his team still had some persuading to do: “not all our suggestions were met with open arms.”^[93] In Spray’s view, the independent status of his group was key to its success in positively influencing safety design norms at Sandia:

The advantage I had was that I was a colleague, not an outside consultant. I had no authority and did not want it.^[94]

My group was reporting directly to upper management, not through a design line...Designers would listen more carefully to us because we were independent.^[95]

Occasionally I had to take a situation to the [Jack] Howard level but these became a rarity.^[96]

Spray also references the importance of “technical persuasion” in his efforts to win over his fellow engineers:

I needed to use technical persuasion so that the project group would understand the problem with the design, and the options for improvement, and not need me.^[97]

You can't tell the engineers how to do it, but you can suggest how we ought to go about it...as long as that involved the principles behind what you were trying to do.^[98]

Safer new weapons

Spray’s influence on safety thinking at Sandia, combined with Bob Peurifoy’s oversight as director of weapon development, resulted in safer designs being rolled out in the majority of new weapons from the mid-70s onwards. Peurifoy wrote:

In 1976...the first bombs designed with ENDS, the new B61, entered into the stockpile. In 1979, versions of the B61 were the first bombs to enter the stockpile with both ENDS and IHE. In 1981 the first missile warhead entered the stockpile with both ENDS and IHE.^[99]

As I understand it, these opportunities were military-driven. That is, the military would request a new weapon design from the labs (I assume for non-safety reasons such as increasing reliability or making use of new technology). And for the most part, it seems that including the latest safety devices in new weapons was non-controversial. Peurifoy’s notes state that:

The Air Force...supported the use of new safety devices, so long as they didn’t require:

1. Modification of any current operational aircraft

2. Additional crew actions and

3. Expenditure of Air Force money^[100]

I tentatively infer that those three criteria weren’t blockers for including new safety devices in new weapons (I haven’t looked into this carefully). On requirements 1 and 2, the weapons were designed to be inert when handled and transported,^[101] so my intuition is that all else equal they’d be designed to fit into existing systems. And on requirement 3, as covered above, the weapons were funded by civilian agencies (the AEC and its successors)—although possibly the Air Force thought of it as “their money” anyway?

Schlosser writes that Peurifoy still had to use his leverage to ensure the safety devices were included:

Peurifoy had no authority to demand changes in weapon systems that the armed services already possessed. But he refused to sign the Sandia major assembly release of any new bombs or warheads that didn’t have the new safety devices. And without his approval, those weapons couldn’t enter the stockpile.^[102]

Schlosser also reports an occasion when Peurifoy “was willing to engage in a bit of devious behavior, on behalf of weapon safety:”

After almost twenty years of fierce resistance, the Strategic Air Command had finally agreed to put locks in its bombs. The installation of permissive action links would require new control boxes in the cockpits of SAC’s bombers. Under a contract with the Department of Energy, those new control boxes would be produced by Sandia. Peurifoy quietly arranged for a unique signal generator to be installed in the boxes, along with the coded switch necessary to unlock the PALs.^[103]

The SEAs’ efforts to ensure that as many new weapons as possible met the 1968 Walske criteria were likely a significant part of their total contribution to catastrophic risk reduction. Here are a couple of relevant milestones:

• The 1974 Fowler Letter named 11 weapons of concern to be “retired, retrofitted, or replaced.”
• By 1988, few of those 11 were still in deployment, perhaps as low as two (as Gordon Moe recalls it, those were the Mark 28 bomb and the W69 warhead).^[104]

It’s unlikely to be as simple as saying the risk went down by 82% (9/11)—for example, the Mark 28 was apparently “SAC’s most widely deployed bomb” as of 1974.^[105] As far as I know, there’s no straightforward source for tracking down how widely used each weapon of concern was, or exactly when each one was replaced with a safer new model. I expect that data likely exists, but it would take some combination of more time, expertise, and access to classified documents than I have to bring it all together.

But big picture: the SEAs successfully shepherded new, safer designs into the stockpile in this period whenever the military gave them opportunities to do so, with the result that the majority of unique weapons of concern named by Peurifoy and Fowler in 1974 had been replaced with safer weapons by the late 80s.

Other SEA activities and successes

There were a few other relevant SEA activities and successes in the 70s and 80s. Bill Stevens calls out that “time and time again, [Peurifoy] sought and obtained a position as technical adviser in [a] series of major high-level studies,”^[106] using that platform to push for greater safety prioritization and better coordination between the Departments of Defense and Energy.

Peurifoy named three of these studies as part of establishing his expert credentials in a 2010 affidavit:^[107]

• "Funding and Management Alternatives for ERDA Military Application and Restricted Data Functions," January 1976, chaired by General A.D. Starbird; with D.R. Cotter, ATSD (AE).
• “Long-Range Planning Group," 1980, chaired by General A.D. Starbird.
• “The President's Blue Ribbon Task Group on Nuclear Weapons Program Management," 1985, William Clark, chairman.

I haven’t located full copies of any of these studies—as far as I can tell, none of them made huge waves at the time, but they seem worth noting as part of Peurifoy’s long-term, slow-burn advocacy efforts.

In 1977, Peurifoy’s team member Dick Brodie completed the Stockpile Improvement Program (SIP), which

provided the Department of Defense with a list of the weapons posing the greatest threat and a timetable for retiring them or improving their safety. The Mark 28 bomb was at the top of the list, followed by the W-25 warhead of the Genie antiaircraft missile.^[108]

The SIP is another document I wasn’t able to access in full,^[109] but it appears to have been a key element in the SEAs’ case-building efforts, both updating the list of weapons of concern and giving the DOD a suggested retrofit/retirement roadmap.

Following the SIP, there were some hints of progress regarding military attitudes towards retrofits and retirements (although not resulting in any significant safety improvements):

In 1979 the Department of Defense finally accepted some of the recommendations that Sandia’s safety department had been making for years—but didn’t want to pay for them. The Pentagon agreed to schedule retrofits of weapons like the Mark 28, so long as the cost wouldn’t interfere with the acquisition of new weapons.^[110]

A program to add new safety devices to the Mark 28—weak links and strong links and a unique signal switch—was begun in 1984. But the retrofits were halted a year later, because the program ran out of money.^[111]

Bill Stevens adds that the SEAs’ early-80s briefings of senior Air Force figures were a contributing factor in prompting “nuclear weapon safety enhancements in the way of changes to fire fighting capabilities at SAC bases and to QRA [Quick Reaction Alert] operations of starting engines on B-52s.”^[112] So, no changes to any weapons, but a potential reduction in accident risk.

1980 accidents

The SEAs’ case was also strengthened by two significant accidents involving older, deployed weapons in the same week of September 1980:

​​September 15, Grand Forks, North Dakota

A B-52 bomber caught fire, but the wind blew the fire away from where its 12 nuclear missiles were loaded. Dr. Roger Batzel, Director of the Livermore lab, testified to a closed 1988 Senate hearing that if the wind had blown in the other direction, “[it] could probably have been worse than Chernobyl.”^[113]

September 18-19, Damascus, Arkansas

An ICBM exploded in its silo following a fuel leak, propelling its nine-megaton warhead into the air, and destroying its launch complex. One Air Force serviceman died, and 21 people were injured.^[114]

In 1983, Peurifoy became a Sandia VP, increasing his influence and reach. But there remained very little progress in phasing out the weapons of concern. The lack of headway was still apparent by 1990, when Dr. Sidney Drell testified to Congress that “the stockpile improvement program has been proceeding slowly with priority given to new weapons rather than [those] remaining in the stockpile.”^[115]

Arguments against the SEAs

What were the arguments against retiring or retrofitting those older weapons of concern? Gordon Moe told me that, by the time of his involvement in the late 80s and early 90s,

the Air Force’s best arguments were, “we’ve improved our safety procedures and fire control [since Grand Forks], so the likelihood of another fire is very low. There are only a few weapons that haven't been retrofitted left, and they're going to be taken off the inventory in a few months.”^[116]

To be clear, there had been a significant reduction in reported major accidents: there were 31 Broken Arrows between 1950 and 1968, but there’s only been one since then (Damascus in 1980). The end of airborne alert after Thule^[117] was likely one significant factor, while the easing of Cold War tensions may have been another. I haven’t come across anything official around changes to the Air Force’s fire safety procedures, but Bill Stevens’s reference to “nuclear weapon safety enhancements in the way of changes to fire fighting capabilities at SAC” in the early-80s may be related.^[118] On the second point Moe referenced above, while the final airborne weapons of concern did eventually get removed from deployment, that decision was only made in 1990—more on that in the next section.

Another theme, explicitly stated or not, was the military view that existing safety procedures and systems were sufficient and that they had more pressing concerns than what might happen in an accident:

The DoD felt, I think, that what they needed was more war-fighting capability—they had enough safety. (Stan Spray)^[119]

A frequent statement of the military would be, "our job is to be ready to use these weapons. Don't bother us with all this analysis." (Gordon Moe)^[120]

The military perspective was, “once the weapons are deployed, they're ours. We think they're safe.” They didn't believe that safety retrofits and retirements were necessary. (Gordon Moe)^[121]

[In 1973] The Department of Defense was preoccupied with the war in Vietnam, a Broken Arrow hadn’t occurred since Thule, and a familiar complacency once again settled upon the whole issue of nuclear weapon safety. (Schlosser)^[122]

Cost was another concern:

“The safety advantages gained by retrofitting existing stockpile weapons . . . will be a costly program that in all probability will reduce funds available for future weapons,” the [Defense Nuclear Agency] said.^[123]

Schlosser gives Peurifoy’s ballpark retrofit cost as “$100,000 per weapon,” and an OMB estimate of $360 million to retrofit two weapons.^[124] For context, Schlosser also mentions a 1979 Air Force plan “to spend at least $10 billion to equip B-52s with cruise missiles”^[125] [at least $~40 billion in 2022 dollars],^[126] and Peurifoy wrote that,

The average AEC/ERDA/DOE weapon budget for the period 1948/1989 was about $5.1 billion per year in constant 2010 dollars.^[127] [~$6.8 billion in 2022 dollars]^[128]

The $360 million figure is for “the two most widely used Air Force bombs,”^[129] and the Fowler Letter specified 7 weapons to be retrofitted. 7 x 180 = 1260, so conservatively let’s round that up to $~1.5 billion in 1974 dollars, or $~9 billion in 2022 dollars.^[130] So it may have been somewhere around 125-150% of the annual weapon budget to complete all of the SEAs’ proposed 1974 retrofits—although that’s imagining a world where none of the Fowler Letter weapons of concern were replaced by new, military-requested weapons.

To compare these numbers against some kind of benchmark: the US agreed to pay 640 million Euros [then $~750 million] in 2015 for outstanding Palmores cleanup (they also did extensive cleanup in the 1960s, so the total cost is more).^[131] Wikipedia has a cost of $68 billion in 2019 dollars for the Chornobyl cleanup^[132] (to which Roger Batzel compared the counterfactual impact of Grand Forks), and $100 billion for Fukushima in 2016 dollars.^[133] In 2022 dollars: a plutonium scatter cleanup might cost at least $900 million, and a nuclear event cleanup might be in the range of $75-125 billion.

When I asked Gordon Moe if this type of analysis on retrofit vs accident costs would have been part of the military’s thinking and pushback, he responded,

I can't imagine the DoD doing anything like that unless they were directed by the Secretary of Defense himself. And even then it would have been a struggle—it's just not the kind of stuff they do, not the operational commands.^[134]

Peurifoy wrote that, though he faced considerable military opposition, “my major disagreements regarding weapon safety were with Sandia senior management, DoE, and NNSA [the National Nuclear Security Administration, and its predecessors].”^[135] Recall that the SEAs’ opponents in Sandia management, at least initially in 1974, were concerned about saving face and keeping their customer happy, as well as saving money for R&D. I haven’t come across any distinct arguments from the perspectives of the DOE/ERDA/AEC/NNSA—perhaps their default position was to stay in their lane or at least to pick their battles with the DOD? From Gordon Moe’s perspective:

It's an example of bureaucracies stumbling over each other...it's the story of how things can linger on and on and on, and of people defending their own turfs.^[136]

Stalling and other setbacks

The SEAs also encountered their share of stalling, dodging, and sometimes hostility. Peurifoy recounted:

We were opposed by the Department of Defense, as well as by the Air Force and the Army. Their opposition was not surprising -- these organizations are focused on war-fighting, and nuclear weapon safety has not been high on their list ever since Truman decided to make nuclear weapons a civilian responsibility in the late 1940s. Mid-level civilians in the DoD and the Air Force still hate Sandia.^[137]

Variously, Peurifoy and the SEAs would face combinations of evasion, pettiness, stonewalling, foot-dragging, etc. I’ve covered a few examples already—here are a few more:

• Apparently in the mid-70s, “Peurifoy learned that the armed services were no longer telling him about nuclear weapon accidents.”^[138]

• Schlosser notes several examples of the “classic bureaucratic maneuver” of commissioning a study as an apparent delaying tactic in response to a briefing.^[139]

• In 1977, the Air Force tried to bypass the safing components of a newly-designed bomb “without a clearly compelling operational need.” When Sandia raised concerns with military officials at the DOE, they were “offended by Sandia’s objection and directed that henceforth Sandia would not reply directly to [them].”^[140]

• In 1980, an Air Force report refuted the SEAs’ claim that older weapons were unpredictable in abnormal environments.^[141] “The study did, however, urge the Air Force to “expedite the proposed retrofit of the [Mark] 28 and, in the meantime, take extraordinary steps to prevent and ameliorate fires that might involve the unmodified 28s.” Neither of those recommendations was followed.”^[142]

Another SEA-related setback in this period was the decline in influence, and abolition, of the AEC. Gordon Moe believes that the retrofits or retirements of weapons of concern could plausibly have happened sooner in a world in which the AEC had retained its earlier strength:

The AEC was always much more proactive [than its successor institutions] to do things to improve safety and reliability. They could pass laws and they had a lot of power in Congress, like in the case of PALs—they just charged ahead and did that, working closely with the White House. They would stand up to the military very strongly. Once the AEC was abolished and replaced by ERDA [in 1974], it seemed to me a whole lot of that initiative, power, and independence vanished. ERDA never seemed to have a whole lot of that backbone and clout...The DOE still had strength when Schlesinger was head, but later on that devolved too.^[143]

I haven’t looked into this topic in any detail, but the AEC’s decline may have been partly due to changing public perceptions of nuclear energy.^[144] Plus, Gordon Moe adds, it was “the result of typical congressional wrangling for power among the committees...The other committees always resented the AEC's power, so they eventually took it apart.”^[145]

Breakthrough period: 1988-1991

The Moe Panel

In 1988, Peurifoy was asked to take part in an Energy Department safety management review and worked with a DOE ally, John Meinhardt, to recruit Gordon Moe to serve as its chair. By then a private sector security consultant, Moe had started his career as a Sandia engineer before becoming a White House policy expert. His panel’s report focused attention on the W-69/SRAM-A weapon system; the W-69 had been listed as a weapon of concern in the Fowler Letter but remained widely deployed 14 years later, with SAC “still loading about one thousand...onto its bombers on alert.”^[146]

The report used the weapon system as a case study in program management failures, and its findings were damning:

Attention to safety has waned, and we still have risks from weapons that will remain in the stockpile for years...It would be hard to overstate the consequences that a serious accident could have for national security.^[147]

Moe briefed his classified report to military and DOE officials, but without success: “the military were not very pleasant when I briefed them, and civilians in the Pentagon were not much happier…I briefed it all around and nothing much happened."^[148]

Escalation to Cabinet level

In Moe’s view, a key remaining challenge at this point was that “you needed to get to someone at a high level—the right person who'd be feeling the heat.”^[149] That opportunity came in spring 1989, apparently via a stroke of luck. Ohio Senator John Glenn happened to be visiting Sandia,^[150] and Peurifoy got an audience with him:

I gave him a thirty-minute safety briefing, using a picture of the Grand Forks fire, a display of the many safety briefings given to government officials (about 800), and the Moe study. The senator asked me what Admiral Watkins (then Secretary of Energy James D. Watkins) thought of my safety concerns. I said that Admiral Watkins did not know of my concerns. Senator Glenn then said, “I’ll be traveling with Admiral Watkins...next week, and I’ll discuss this with him.”^[151]

Moe was summoned from vacation to brief Watkins, and was initially met with familiar resistance:

I had to go through the staff before I got to the Secretary and I was showing them what I was going to brief, and they said “Oh, you can't say that—that's terrible stuff.” And I said, “Well, I have to say what I have to say.”^[152]

But he made it in front of Watkins, and recalls the Secretary’s response to the prospect of scattered plutonium or a nuclear detonation after a plane crash or fire:

“Oh God, that's terrible. That would be really embarrassing to the President”...He said he’d be seeing the Defense Secretary [Dick Cheney] the next day and he would discuss the concern with him.^[153]

Finally, Watkins was “the right person who’d feel the heat”—at least on the President’s behalf.

Continued opposition

Moe adds that even after Watkins briefed Cheney, "nothing happened except that there was another study commissioned."^[154] And while outgoing Sandia President Irwin Welber signed a letter supporting concerns about the ongoing issue with the W-69/SRAM-A, Bill Stevens reports that he “elected to soften the wording and lower the [reporting] level” to which the letter was addressed, “with the rationale [of] maintenance of good relationships with the immediate reporting level [at the DOE].”^[155]

R. Jeffrey Smith also later reported in a Washington Post article that

DOE officials sought to mention several safety problems involving the SRAM-A warhead in a routine report to [President] Bush [in 1989] about the overall safety of the nuclear weapons stockpile. But DOD officials rebelled, causing submission of the report to the White House to be held up for more than three months, according to officials at both agencies.^[156]

But, in Watkins, the SEAs now had a powerful ally in their corner:

Watkins said he used the dispute to win DOD's approval for a new weapons safety review committee under DOE's control. He also said the safety matters at issue were explained to Bush by national security adviser Brent Scowcroft with Cheney's concurrence.

"I would have just moved unilaterally {with Bush} had I not been satisfied that the thing was being well aired," Watkins said.^[157]

QRA removal and Drell Panel

Peurifoy wrote that, by the following spring,

the House and Senate armed services committees learned of these safety concerns. They held hearings in May 1990 in which Watkins and the lab directors testified. Much dodging took place.^[158]

(I assume the “dodging” was by the lab directors rather than Watkins, but I haven’t checked this).

The House Armed Services Committee then engaged three leading physicists (the Drell Panel) to further investigate Moe’s findings.^[159] Meanwhile, the Washington Post ran a succession of R. Jeffrey Smith’s articles later in May, increasing pressure on Cheney:

• “Defective Nuclear Shells Raise Safety Concerns”
• “Pentagon Urged to Ground Nuclear Missile for Safety”
• “Pentagon to Await Missile Safety Study”

I’m not sure how directly involved the SEAs were in these specific articles. Bill Stevens alludes to “the value of...a leak to the media” regarding the campaign against the SRAM-As, and Peurifoy and others reference Smith’s articles as influential in supporting their efforts^[160]—so it’s plausible Peurifoy or others were sources for Smith.

In June, Cheney temporarily ordered the SRAM-As off of Quick Response Alert.^[161] Then, December 1990 brought two further landmarks—first, Cheney made the SRAM-A decision permanent on December 7th.^[162] Bill Stevens notes that this represented "the removal of the last deficient weapon system from operational deployment."^[163] I haven’t firmly verified this—as of 1988, the other remaining weapon of concern had been the Mark 28. Schlosser says a retrofit program for that bomb started and stopped in 1984-5,^[164] then resumed in 1988,^[165] while Nuclearweaponarchive.org lists the last Mark 28 as “retired in 1991.”^[166] But I assume that if the Mark 28 was still a live issue by the end of 1990, it would have been featured prominently in e.g. the Drell Report (below). Whatever the exact dates, based on how Peurifoy and others referred to it,^[167] the removal of the SRAM-A from QRA was a significant watershed moment in the SEAs’ advocacy efforts: when the final item from the Fowler Letter was checked off.

Later in December, the Drell Panel released their report in December 1990, recommending the adoption of ENDS and IHE throughout the stockpile and vindicating the SEAs:

We are concerned…that serious issues that had been known for at least a decade remained unattended for so many years.^[168]

The following year, a House and Foreign Affairs Committee review rated the existing stockpile on safety, with 12 of 30 weapons receiving a “D” grade (the lowest).^[169]

By the time Bob Peurifoy retired in the spring of 1991, Schlosser writes:

his goals had been achieved...The changes in the stockpile that Peurifoy had sought for decades, once dismissed as costly and unnecessary, were now considered essential. Building a nuclear weapon without these safety features had become inconceivable.^[170]

Impact summary

To recap the SEAs’ achievements in terms of impact on deployed weapons:

• The Fowler Letter identified 11 weapons of concern in 1974.
• Up to 9 of the Fowler 11 had been replaced by newer, safer weapons by 1988.
• In 1988, assuming there were only two remaining Fowler Letter weapons of concern, those were the Mark 28 bomb and the W69 warhead.
• The Mark 28 retrofit apparently resumed in 1988, and it looks like it was retired in 1991.^[171]
• The W69 was removed from alert in 1990 (no longer deployed but still in the stockpile), and was apparently fully retired in 1994.^[172]

Per Sandia engineer Raymond Wolfgang in 2012:^[173]

Modern weapon systems in the US stockpile all adhere to the ENDS principles, with newer systems implementing the theme in more technologically advanced ways.

And in the same year, Bob Peurifoy wrote:

All warhead and bomb types in the inventory meet the 1968 Premature Yield standards, so the probability of an unintended nuclear explosion is less than one in a billion, and less than one in a million if there is an accident. There is no quantitative DoD standard for an accident that would scatter plutonium.^[174]

Peurifoy’s reference to plutonium scatter nods to some submarine missile warheads that were designed to use conventional high explosives (i.e. not IHEs) in the 70s and 80s. As I understand, at least two (the W76 and W88) may still be deployed in that state today.^[175]

I haven’t seriously attempted to quantify the SEAs’ risk reduction for a couple of reasons:

• My main goal is to summarize the story of their advocacy efforts and consider potential lessons—for that purpose, it seems sufficient to believe that the scale of their impact was plausibly non-trivial (which I do).
• Lack of time (given my view that it’s a lower relative priority) combined with difficulty of accessing relevant data (mentioned earlier).

The US accident record up to 1968, and the 1980 near-miss at Grand Forks, underlined the very real possibility of a catastrophic accident involving nuclear weapons—either plutonium scatter or a full nuclear event. And there were several “nuclear close calls” in the post-Fowler period that might plausibly have led to war.^[176]

While I assume accidents represented a relatively small amount of the total contemporary catastrophic or existential risk from nuclear weapons, I also assume it wasn’t zero either. Even with the SEAs’ efforts, weapons that presented an elevated risk of nuclear detonation were deployed through 1990. So it doesn’t seem too far-fetched to imagine a counterfactual major accident involving one of those weapons either triggering or exacerbating a nuclear escalation between the USSR and US.

Quick side note on the international context: I’m unsure how much the SEAs’ impact extended outside the US. I believe all of their efforts were US-focused so any impact would have been indirect, and I didn’t have time to look into this topic in any detail. I did ask Gordon Moe, who wasn’t aware of any obvious examples of this, but he considers it likely that the US would have shared safety recommendations with their allies. This may have included the former USSR, too, following the 1991 start of the Cooperative Threat Reduction program.

Lessons: what went well?

Bill Stevens attributed the successful campaign to remove the W69 from QRA to "the roles of deep personal commitment to a belief, perseverance, knowing how the "system" really works, and the value of serendipity plus a leak to the media."^[177] Many of those factors also apply to the whole, decades-long advocacy effort that preceded it.

Agency, persistence, and scale of effort

Sidney Drell recounts that

the priority of safety struggled to the fore in the nuclear weapons enterprise during the 1970s and 1980s, spurred on by the determined commitment of a small cadre of courageous leaders in the weapons labs.^[178]

The scale of the SEAs’ advocacy effort seems worth pausing over: around 5,000 individuals briefed on weapon safety between 1975-1990, roughly a third of whom were external to Sandia. And 10,000 individuals briefed on safety just by Stan Spray (I assume these two totals overlap, but I’m not sure).

While it was certainly a team effort, it seems right to single out Peurifoy’s personal qualities and efforts as a critical factor. Stan Spray believes that “without Bob Peurifoy, nothing would have happened,” and Gordon Moe agrees. “If not for Bob, nothing would have changed. When he got hold of something, he would not let go."^[179]

Peurifoy’s agency and persistence are particularly noteworthy. He seems to have assumed safety as a personal responsibility, considerably beyond the scope of his various roles. He developed key relationships at Sandia and the Pentagon, and with reporters and activists, and he kept on advocating for more than 15 years without much apparent external success and in the face of constant opposition. In a letter sent right after Peurifoy’s retirement, his former manager Glenn Fowler summed up his contribution:

Your persistent attention to safety and reliability, despite somewhat uncomfortable circumstances at times, has been the major factor in the avoidance of a disastrous accident which would have changed the military and political posture of America.”^[180]

Willingness to take professional risk

Picking up on Fowler’s mention of discomfort: I haven’t come across any references to specific occasions when Peurifoy was at risk of losing his job, but my intuition is that that must have seemed a non-zero possibility at times. On this question, Barbara Peurifoy shared, “I think he did worry about that, although he didn't talk about it that much. I think it was a possibility in his mind.”

Bob Peurifoy apparently received a negative performance rating in 1989—the year he briefed John Glenn^[181]—and his references to “fireworks erupting” and to Glenn Fowler being “abused” suggest the type of responses he and other SEAs sometimes got for their advocacy efforts. Another former manager, Al Narath, recalled supporting Peurifouy’s candidacy for a National Security award in the 1990s without success; it was still apparent that “his uncompromising commitment to stockpile safety had not made him many friends in the weapon physics community.”^[182]

Developing and implementing solutions

A major part of the SEAs’ total reduction of catastrophic risk came from their successes in ensuring that as many new weapons as possible used ENDS and IHE after 1974. Several factors drove that success:

• Sandians working with Walske to define the improved safety criteria in the first place.
• The research and design work in the 1968-1972 period.
• Bringing their findings and recommendations to life via the Burned Board Briefings, which Bill Stevens claims “shattered the image of order conveyed to the designer by circuit diagrams and layouts."
• Stan Spray’s technical persuasion and internal education efforts to get the safety principles into weapon designers’ heads, and therefore into the weapons they designed.
• Peurifoy using his leverage to block weapons without ENDS from being signed off.

Getting in front of the right people

As Gordon Moe puts it, getting in front of “the right person who'd be feeling the heat” was a key part of the SEAs’ eventual success in triggering the removal of the W69 from QRA. And the interventions of both Moe and John Glenn in helping to get the support of Secretary Watkins are instructive. Both had credibility and connections in government and science: Moe as an engineer and policy adviser in the Nixon and Ford administrations; Glenn as a sitting senator and former astronaut. As Moe recalls:

There was really no way they could affect me...I was pretty much a free agent, and I think that's why Meinhardt and Peurifoy decided to give me that job. [They thought] “he can maneuver around all that space, but he's not going to get sidelined by any particular agency or general.”^[183]

In other words, both Moe and Glenn were high-value allies: they had clout, but were less vulnerable to repercussions for speaking their mind than Peurifoy or his co-workers.

Playing the long game

The relationship between the SEAs’ slow-burn persistence and their long-term readiness also seems important. Despite making limited progress with weapons of concern between 1974-1988, it’s plausible that their continued advocacy efforts played a small part in shifting the Overton window in their favor (I assume other factors like the changing geopolitical situation likely were more significant). It also meant that when their opportunity to get in front of the right people came, they had all the arguments and evidence ready to make their case effectively.

Lessons: what might have gone better?

Two major disclaimers to kick off this section. First, I’m pretty uncertain about these points. To reiterate: I’m not an expert in any of these areas; this article is the result of a few weeks’ research; many of the key individuals are now dead; and many primary sources are either still classified or otherwise hard to access.

Second, none of the below is meant to dismiss or downplay the efforts of Bob Peurifoy or his allies, which I think were considerable. But it’s plausible there were some missed opportunities that we can learn from.

Communication

I’ll consider a couple of themes here around communication and strategy. Here’s one recollection from Gordon Moe:

All those briefings—and I looked at a lot of them—were scary, but they didn't really focus on the absolute seriousness of the risk after Goldsboro...I d​​on't think they did a good enough job of really focusing on and highlighting that.^[184]

There’s no unclassified record of the verbal content of the SEAs’ briefings as far as I know (there are lots of images of the “Burned Board” props),^[185] but it sounds like they leaned relatively technical. Maybe they were great at making the scientific case that the safety risks were real and substantial, but less effective at winning a non-technical audience over on an emotional level or inspiring them to take action?

Moe, a close friend of Peurifoy’s, also recalled with kindness that "it's hard to imagine somebody less subtle than Bob."^[186] Barbara Peurifoy added, "he was not the most diplomatic person in the world. When he disagreed with Small Staff [Sandia management], he let them know."^[187] On the other hand, Moe remembers Dick Brodie as a persuasive communicator:

I watched Brodie give briefings and it was the most amazing thing…I could stand up in the Pentagon and give my briefing and be as nice as I could and I just got chewed up and spit out. Dick Brodie, because he was a former fighter pilot and had a lot of class and grace, could stand up in front of the same crowd and pretty much say the same thing I was saying, and they all said, “Yeah, right!” He was a real asset.^[188]

So it seems somewhat plausible that the SEAs might have made an earlier or bigger breakthrough by focusing more on getting their key audience (the military) onside—maybe Dick Brodie was underused as a spokesman? (I don’t know what proportion of the briefings Brodie gave relative to Peurifoy or others, and I’d guess there isn’t a record of this).

But recall that the military was rarely won over through advocacy in this case if at all (the 1988 Mark 28 retrofit is the only one I know of that the military agreed to). The SEAs’ successes were almost entirely down to 1) implementing safer designs in new weapons before 1989, and 2) finally getting in front of the right civilians (Watkins via Glenn) in 1989.^[189] And it was Peurifoy who briefed Glenn, so his communication was apparently effective enough when it mattered.

Strategy

That introduces a related question: might the SEAs have got in front of the right civilian sooner? Peurifoy did have contacts in Washington (including Moe, who worked for the Nixon and Ford administrations up to 1976), and he served on a 1985 Task Force headed by two former Republican cabinet secretaries (William J. Clark and James Schlesinger) who presumably had connections in the Reagan administration.

Regarding Fowler and Peurifoy’s initial escalation outside of Sandia, Gordon Moe told me that Graves "wouldn't have been one of my choices [to brief]...In the AEC, I would have gone to somebody on the JCAE or their staffs.”^[190] I also asked Moe if the SEAs—his former co-workers at Sandia—had approached him for help in the 70s. Here’s his response:

I was involved in weapons stuff during the early 70s at the White House Office of Science and Technology and the NSC^[191]—I don't recall anyone ever rattling my cage about these things...I distinctly remember the day [in the late 80s] when I was briefed about the Burned Boards and ENDS, and the first time I heard somebody say "in a hazardous environment, we cannot predict what these weapons will do." I looked across the table to Bob Peurifoy and asked, "is that right?" And he said, "that's right." And that really got my attention. I think if that sort of meeting had happened while I was at NSC, I would have sent it up the line and tried to get some attention on it, but that didn't happen."^[192]

A brief comparison: Matthew Meselson

Let’s briefly consider another case with some similarities to the SEAs’—the efforts of Dr. Matthew Meselson, who advocated successfully against biological and chemical weapons. Here’s a high-level overview:

• He first learned about biological weapons in depth in the early 60s.^{[193] [194]}

• He advocated against them by lobbying senior government officials and later the president, and via a national media campaign.^[195]

• By 1969, at least partly as a result of his advocacy, the US renounced biological weapons.^[196]

• From there, he made significant contributions to international efforts to ban biological and chemical weapons.^[197]

Meselson was clearly strategic and meticulous in his approach—I quote him at length here to illustrate:

I made a kind of a plan, like a protocol for doing an experiment, to get us to stop all this [biological weapons research]. How do you do that? Well, first you ask yourself: who can stop it? There’s only one person who can stop it. That’s the President of the United States.

The next thing is: what kind of advice is he going to get?... So the answer there is: well, you go to talk to the Secretary of Defense, and the Secretary of State, and the head of the CIA, and all of the senior people, and their people who are just below them…

Now, I should say something about writing papers for Presidents. You don’t want to write a paper that’s saying, “Here’s what you should do”...You’ve got to give every option a fair trial. You’ve got to do your best, both to defend every option and to argue against every option. And you’ve got to do it in no more than a very [small] number of pages. That’s no easy job, but you can do it…

I had tried to write a paper [for Nixon] that steered clear of political arguments — just scientific ones and military ones. However, there had been an editorial in the Washington Post …“How can the President renounce typhoid only to embrace botulism?”

I thought it was so gripping, I incorporated it under the topic of the authority and credibility of the President of the United States. And…[according to Kissinger] that’s what made up the President’s mind. And of course, it would. The President cares about his authority and credibility. He doesn’t care about little things like toxins, but his authority and credibility.^[198]

Compared to the SEAs, Meselson appears to have achieved a more comprehensive success in a shorter timeline, and it seems likely that his approach to strategy and communications played a non-trivial role. But there are some notable differences between the two cases.

First, Meselon’s advocacy area may have been more tractable, at least in terms of military attachment to the status quo. He says of biological and chemical weapons:

We didn’t need them…it was never something that the military liked.^[199]

Second, while the SEAs operated from within the bureaucracy at Sandia, Meselson was a celebrated, independent academic who occasionally consulted for the federal government^[200]—I infer that he had relatively little to fear in terms of career risk by speaking his mind to the President and other powerful figures. Third, and relatedly, he appears to have had an easier time getting an audience with those figures than the SEAs. Presumably, his status as a leading scientist^[201] was one factor; he could also “knock on any door” in the Johnson administration due to his Harvard connections,^[202] and his direct access to Nixon came via the same source:

Kissinger… [was] my neighbor at Harvard, the building next door to mine. There was a good lunch room on the third floor. We both ate there…We traveled a little bit in Europe together. So I knew him, and I wrote papers for Henry [Kissinger] knowing that those would get to Nixon.

The comparison with Meselson highlights some important aspects of the SEAs’ undertaking: they were working inside the system, on a pretty intractable national security problem, with no obvious social connections to the White House or Cabinet.^[203]

Working inside the system

Schlosser writes that

Peurifoy told me, on many occasions, that he regrets not having been braver…He’d chosen to work within the system, despite his strong opposition to many of its practices. Although he was critical of the way in which official secrecy has been used to cover up mistakes, he’d honorably obeyed its code.^[204]

It makes sense that the nature of the SEAs’ work would require both a collaborative attitude towards the military (my impression is that most Sandians had/have deep respect for the military, and many had service backgrounds themselves) and an acceptance of the default need for both secrecy and stratified decision-making. Here’s how Schlosser evokes Sandia:

The mix of public and private management, of academic inquiry and industrial production, helped to form a unique, insular culture at Sandia—rigorous, grounded, and pragmatic; eager to push the boundaries of technology, yet skeptical of wild and abstract schemes; highly motivated, collegial, and patriotic...Most of the engineers, like Peurifoy, were young. They couldn’t tell their friends, relatives, or even spouses anything about their jobs. They socialized at the Coronado Club inside the gates of Sandia, hiked and skied the nearby mountains, conducted experiments on new fuzes and detonators and bomb casings. They perfected America’s weapons of mass destruction so that those weapons would never have to be used.^[205]

In interviews, Barbara Peurifoy described her husband to me as both ethical and patriotic, and Gordon Moe corroborated Schlosser’s account of Bob Peurifoy’s worldview:

Peurifoy always stayed within the system—he wasn't a whistleblower. He wasn't going to resign and attack from the outside. Even after he retired, everything he did was within the system of retired folks in the weapon community.^[206]

I also asked Gordon Moe what he thought about the counterfactual of Peurifoy quitting and campaigning externally at some point in the 70s or 80s:

It's possible that something else might have changed if he’d have stepped outside the system, but maybe not. I think he did all the right things he should have done in order to accomplish what he did. After the development of ENDS, lots and lots of weapons did get changed. He saw to that, because he was in the system. He could sign off on things. It was just these outliers [older weapons] that kept dragging along, and eventually he succeeded even with those... If Peurifoy had resigned and advocated from the outside, he would have lost all his clearances, and had a lot less access to everything that was going on.

On the question of whether Peurifoy might have asked Gordon Moe for help getting access to Kissinger (whom Moe worked under in the 70s), Moe doesn’t think Peurifoy would have considered it. He also confirmed that while Fowler and Peurifoy escalated beyond Sandia in 1974 to brief Ernest Graves, they didn’t attempt to take it any higher than that at the time; “they were always trying to stay within the limits of the system to some extent.”

Intractability and the Overton window

And the system could be an unforgiving place. Testifying to Congress in 1990 about the safety delays his panel had highlighted, Sidney Drell said:

There were people working within the labs who were calling attention...They were struggling down there. There was no effective way to pull that concern up to the top and bring it out.^[207]

Gordon Moe contrasts the comparative difficulty of advocating for weapon retrofits in the late 80s/early 90s versus earlier times:

[By 1990] these weapons were being scheduled for deactivation, withdrawal, and replacement...Earlier in the 70s and 80s, there were way more weapons and the expense of fixing everything would have been way, way greater, and it would have been a bigger operational problem to think about replacing or withdrawing them—so the resistance was a lot heavier.^[208]

And the language of the 1990 Drell Report echoes this shift:

As we enter the last decade of the 20th century, the world is in the midst of profound, and indeed revolutionary, changes in the strategic, political, and military dimensions of international security. These changes, together with a continuing rapid pace of technical advances, create an entirely new context for making choices in the development of our nuclear forces for the future. It is likely that, in the future, the U.S. nuclear weapons complex will evolve into a new configuration—perhaps smaller and less diverse and at lower operating expense but with enhanced requirements for safety and control.^[209]

The country has different perceptions of its strategic needs in the post-Cold-War era; the public has very different perceptions about safety.^[210]

So it may just be that the SEAs had to wait for the Overton window to shift in their favor before conditions were right for success regarding weapon retrofits and retirements. It’s also plausible that their long-term advocacy efforts contributed to that shift in part—but I’d guess the changing geopolitical environment was likely a bigger factor.

The SEAs’ success was a long time coming and perhaps might have been quicker or more comprehensive given different approaches. Equally, it might also have been slower or lesser, given the extent of the challenges they faced.

Acknowledgments

My work on this post was funded via the Future Fund Regranting Program.

Many thanks to Gordon Moe, Barbara Peurifoy, and Stan Spray for agreeing to be interviewed and being so generous with their time, and to Aaron Gertler, Ben West, Darius Meißner, Gordon Moe, Stan Spray, and Toby Jolly for reviewing drafts and giving feedback. All mistakes mine!

Notes