http://www.jfklibrary.org/White+House+Diar...;m=9&y=1963September 23, 1963
President Kennedy assigns the highest national priority to Project FOUR LEAVES to develop and produce a military communications system.
Could Project FOUR LEAVES be related to Operation Falling Leaves?
The Limits of Safety By Scott Douglas Sagan (p. 4)
….The safety record seems quite extraordinary, however, with the most hazardous technology of all: nuclear weapons. There has never been an accidental, unauthorized detonation of a nuclear weapon, much less escalation to accidental nuclear war.
Why? How have imperfect humans, working in imperfect organizations and operating imperfect machines, been so successful? Have the military organizations that maintain custody and control over U.S. nuclear weapons done something extremely intelligent to avoid accidents? Have they been designed in such a way to produce reliable safety? Or have they merely been extremely lucky?
The first step toward solving this puzzle was to arm myself with major scholarly theories that exist about the causes of safety and accidents in complex organizations. Two competing schools of thought – what I call normal accidents theory and high reliability theory – are analyzed in chapter 1. Such theories are always necessary to understand complex social phenomena; they are the conceptual tools we use to pull disparate events together and understand what caused them.
The point is especially obvious for anyone who tries to do historic research with records kept at massive collections like the National Archives: theories are absolutely necessary to tell you where to look for evidence. (The final scene of the movies Raiders of the Lost Ark, in which the ark of the covenant is slowly wheeled into a mammoth government warehouse, conveys a sense of how effective historical objects are hidden in the recesses of the archives.) Using the theories discussed in chapter 1 as guides, I was able to explore the historical records of the U.S. military, searching for clues.
Let me give just one example of how the process worked. (See chapter 3 for the substantive details about this particular case study.) The literature on the Cuban missile crisis is immense, but no scholar has previously studies the emergency radar warning system, which the United States deployed on a crash basis in October 1962 after the Soviet missiles were discovered. A study of the activities at the three radars used in this Operation Falling Leaves appeared to me, however, to be a very useful way of comparing the strengths of the two theoretical perspectives outlined in chapter 1, since these theories provide contrasting expectations about the warning system’s reliability.
Normal accidents theory would predict that Falling Leaves would be a very accident-prone operation: the warning system displayed al the signs of high interactive complexity and tight coupling, the two structural factors that the theory suggests lead to dangerous accidents in other high technology systems. High reliability theory would predict that Falling Leaves would be a relatively safe operation, since the factors that the theory suggests produced safety in other hazardous systems also existed here: significant decentralization decision-making authority was given to operators in the field, redundant radars were used to provide more accurate warning information, and officers’ caution heightened by the crisis environment. I therefore visited the Air Force archives, found a number of relevant declassified documents, and then used the Freedom of Information Act to request that additional related documents be declassified and sent to me.
These historical records confirmed the more optimistic view of the high reliability theorists. They reported on no serious false warning incidents occurring during the crisis. Indeed, the Falling Leaves after-action report recommended that the emergency radar system be set up again if there were ever another superpower crisis.
This success story was puzzling from a normal accidents perspective. That theory, however, also reminds us to be skeptical of documents that are written by organization actors who are interested in promoting their own…. (P.5)
Normal False Warnings? (p. 122)
From a normal accidents theory perspective, such confidence would not be warranted. As discussed in the two previous chapters, this more pessimistic perspective on organizations points to a number of reasons to suspect the risk of accidents will always be significant in highly complex and tightly coupled systems. Senior decision makers may generally desire high reliability and safety, but others within the organization may have other priorities.
Redundancies may be added to the system, but this can inadvertently reduce safety by making the system more complex and therefore more prone to hidden interactions and mysterious failures. All potential problems cannot be anticipated and cannot therefore be fixed ahead of time. Flexibility in decision making authority and “man-in-the-loop” rules can reduce the danger of excessive reliance on fallible machines, but can also produce higher level human failures.
Did such problems occur in the U.S. warning system during the Cuban missile crisis? Clearly there was no false warning that produced a mistaken “retaliation” against the Soviet Union. Yet the following three case studies of incidents in U.S. warning and intelligence systems in October 1962 demonstrate that a number of serious command and control problems did develop during the crisis.
The first case is a study of a series of false warnings emanating from the emergency ballistic missile warning system that were activated in October 1962 to detect missile launches from Cuba. The second case study focuses on the potential for dangerous interactions that developed during an accidental U.S. Air Force U-2 over flight of the Soviet Union on October 27, perhaps the most tense day of the crisis. The third case concerns a bizarre false warning incident that occurred in Moscow, after Colonel Oleg Penkovsky, a Soviet military officer who was a spy for the United States, was arrested during the crisis. None of these false warning incidents led to further escalation; each of them had the potential to do so.
THE CUBAN MISSILE EARLY WARNING SYSTEM
How reliable was the U.S. missile warning system during the Cuban missile crisis? In October 1962, two of the three scheduled BMEWS stations (at Thule and Clear) were in operation, and Secretary of Defense Robert McNamara testified to Congress in early 1963 that “it is reasonable to assume that the BMEWS would be able to provide adequate warning.” 11
Yet, when the Soviet missiles in Cuba were discovered by the United States, a serious deficiency became immediately obvious: despite the enormous sums spent on the BMEWS radars facing north, the United States had absolutely no capability in place to detect a missile launched from the south, from Cuba.
Washington policymakers had simply never anticipated that the Soviets would outflank the BMEWS radars in this manner. The seriousness of this gap in missile warning coverage was immediately recognized by the Strategic Air Command, which required warning in order to launch vulnerable bombers into the air to avoid destruction, and by the Executive Committee (ExComm) of the National Security Council, which was also informed of the problem. 12
In response, the air force quickly initiated an emergency Cuban Missile Early Warning System (CMEWS) program, code-named Falling Leaves, to provide tactical warning in the event that the Soviet missiles in Cuba were launched. 13.
Three radars in the United States were utilized in the Falling Leaves emergency warning program (see figure 3.1).
11. Department of Defense Appropriations for 1964, Hearings before a Subcommittee of the Committee on Appropriations, House of Representatives, 88th Congress, 1st sess., part 1, p. 124.
12. According to CINCSAC General Power, the missiles in Cuba “could for example, knockout all the command and control, Washington and SAC Headquarters, and time that with a missile attack over BMEWS, and maybe catch the whole thing (SAC strategic forces) on the ground.” Thomas Power Interview, Strategic Air Command, FOIA, p. 4, Also see Raymond Garthoff’s October 27, 1962, memorandum for the ExComm, reprinted in Raymond L. Garthoff, Reflections on the Cuban Missile Crisis, 2nd ed. (Washington, Brookings Institution, 1989, pp. 202-203.
13. Unless otherwise noted, this section is based on Headquarters 9th Aerospace Division, Memorandum for the Record, Subject: Falling Leaves, January 11, 1963 (henceforth Falling Leaves Memorandum) NSA-CMCC.
(p. 125)
…Despite these difficulties, the final report on Moorestown radar operations informed air force headquarters that the “facility did provide an acceptable detection capability against the Cuban missile threat.” 20
What about the other sides? To provide independent and redundant sensors, the Air Defense Command also immediately proceeded to alter two other radars and turned them to face Cuba. At Laredo, Texas, an air force MPS-14 space-tracking radar was shifted to the ballistic missile warning mission after real time radar display equipment was sent from the Sheyma, Alaska, sensor site. The Laredo radar became operational on the night of October 28-9, and was considered to be a backup system for the more capable Moorestown radar. It too had to overcome significant operational problems. Several outages were caused by lack of spare parts and a failure to send the maintenance instructions for the display equipment sent from Sheyma. Inadequately trained contractor crews manned the radar control center throughout the crisis. Most importantly, there was no capability for a rapid and accurate test of the Laredo system. After the crisis it was therefore acknowledged by the commanding officers that, “system degradation could have been present without [the] knowledge of the operating crew.” Nevertheless, the after-action report noted that “the Laredo sensor site performed its ‘Falling Leaves’ mission in a satisfactory manner.” 21
The third Falling Leaves site was in Thomasville, Alabama, where an Air Defense Command Semi-Automatic Ground Environment (SAGE) system FPS-35 radar (a radar normally used for aircraft detection and identification) was modified to provide a backup ballistic missile warning capability. Numerous outages occurred at Thomasville, however, due to lack of spare parts and maintenance instructions for the modified equipment, and the radar was therefore not operating for over 16 percent of the emergency period. Inadequate secure communications capability between Thomasville and higher headquarters also existed for the first days of operation. Although the telephone “hotline” between the site and NORAD Command Control and Display Facility (CC&DF) enabled instantaneous verbal reports, all classified messages had to be sent over a jerry-rigged network, which took over two hours to deliver messages between Air Defense Command Headquarters and Thomasville. 22
(p. 127)
…These log books entries, supplemented by air force unit histories and interviews with the key participants in the Falling Leaves operations, paint a much more alarming picture of the CMEWS project than that which exists in the official after-action reports. 25 Indeed, these documents demonstrate that at least three false warning incidents occurred during the Cuban crisis.
Spoofing Ourselves
The first incident was a relatively minor “scare” at the Moorestown radar site, the cause of which was quickly discovered and soon fixed. In 1962, the U.S. Air Force and the U.S. Navy regularly flight-tested ICBMs, IRBMs (intermediate range ballistic missiles) into the Atlantic Ocean out of Patrick Air Force Base on Cape Canaveral and adjacent ocean areas off Florida. NASA also regularly launched space vehicles and satellites from Cape Canaveral.
A small number of these launches went directly over the island of Cuba and officials at the Department of Defense quickly recognized the potential for such missile launches to be misinterpreted by the Cubans or Russians in Cuba. It was possible, for example, that Soviet or Cuban warning systems might misidentify a test missile as an attack. An errant or malfunctioning rocket could be particularly provocative if it hit Cub during the crisis. In fact, as recently as November 1960, portions of a Thor missile that malfunctioned in flight during a satellite launch, had impacted in Cuba, reportedly killing a cow and causing strong diplomatic protests from the Castro government. 26.
The Pentagon therefore ordered that any missile launches whose trajectory went over Cuba would be postponed, a decision that fortunately stopped a scheduled Thor missile launch that would have passed over the island on October 24. 27
The postponement of this potentially provocative missile launch demonstrates that the Pentagon officials were cognizant of the danger that these missile launch operations in Florida might create a false warning for Soviet and Cuban forces in Cuba. They treated the danger seriously and took immediate action to solve the problem. In the haste to deploy an emergency U.S. missile warning system against the Soviet missiles in Cuba, however, no one apparently thought about the possibility that a U.S. missile launch might be misidentified by the U.S. Falling Leaves radars. No one had arranged for the CMEWS radars to receive timely advance notification of all U.S. missile launches from Florida, most of which (like the ICBM tested at Vandenberg Air Force Base in California discussed in chapter 2) continued according to a schedule during the crisis. 28
The danger of a false warning was greater than anticipated during the first days of the Cuban missile crisis because the redundant sensors, which had been designed into the system to provide overlap and confirmation capabilities, did not become operational simultaneously. It was considered critical to get at least some warning system in place as soon as possible. The Moorestown radar was the first of the Falling Leaves sites to become operational, achieving initial capability against Cuba on October 24. 29
The second sensor site, at Laredo, did not become operational until October 28. 30 On the afternoon of October 26, however, before the second sensor site was available to provide redundant warning information, a Titan II ICBM was fired on a test launch toward the south Atlantic. 31
The Moorestown radar operators had not been anticipating this missile launch when, suddenly, it appeared on their display screens. Because of the extremely close range of Soviet missiles in Cuba to the United States, the Falling Leaves operators expected to receive only five minutes of warning and perhaps less, between detection of a medium-range ballistic in flight and its impact in the southern United States. 32 The radar operators recall in interviews that they were, quite naturally, shocked when a missile suddenly appeared on their radar screens. It took a few tense minutes, in the crisis control room at Moorestown, for air force duty officers and contract civilian personnel to recognize, as their radar began to show the missile heading southeast, that this was “a friendly” missile with no impact point predicted inside the United States.
The Air Defense Command immediately acknowledged the potential for serious false warnings here. Colonel William Watts, of the 9th Aerospace Division, flew down to Patrick Air Force Base to explain the problem to officials there and to ensure that advance notification of U.S. missile launches would be sent to the CMEWS radar sites. 33
On October 27, the commander of the Air Force Missile Test Center further informed the higher headquarters that “the test schedule would continue, with the prelaunch announcement policy changed so as to avoid international misunderstanding or ‘inadvertent action.’” 34
After that procedural change, there were apparently no further alarms caused by U.S. ICBM launches. The Moorestown operators were sufficiently concerned to recommend that in the future “a procedure be established to allow an immediate ‘on call’ reaction for launch and final count-down information, (to) be provided (to) all sensors.” 35
There is both good news and bad news in the history of this brief incident. The good news is that the system worked even without redundancy: the Moorestown radar by itself was able to discriminate between a hostile missile launch toward the U.S. and a friendly launch toward the Eastern Test Range impact area. Moreover, rapid organizational learning took place: a potential for false warning problems was recognized and the operational procedures for integrating U.S. missile launches with the Falling Leaves sites were adjusted immediately. Imagination also helped; all missile test launches over Cuba were canceled.
32. Message BMEWS ESD to RCA Moorestown, n.d., supporting document 61, Electronic Systems Division Historical Report on “Cracker Jack.” The five-minute estimate is given for a hypothetical attack from Cuba against Savannah, Georgia, and warning time for any target south of that area would be even less. Also see James Daniel and John G. Hubbell, Strike in the West: The Complete Story of the Cuban Missile Crisis (New York: Holt, Rinehart and Winston, 1963), p. 118
33. William C. Watts, interview with the author, September 8, 1989.
34. History of the Air Force Systems Command, July 1-December 31, 1962, vol. 1, p. 11-82, FOIA.
33 Falling Leaves Memorandum, pp. 6-7. The AFSC history states that after November 1, “to avoid mistaking the missile warning network covering Cuba, the Center also arranged to notify the North American Air Defense Command of any planned Cape Canaveral test launches which would rise above 70,000 feet.” History of the Air Force Systems Command, July 1-December 31, 1962, vol. 1, p.11-87.
(p. 198)
…What is disturbing is to look at the evidence on how little the Strategic Air Command learned from the experience at all; and, indeed, how creatively it reconstructed the events after this and other accidents.