Summary of "Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety"

Core Idea

Schlosser argues that the U.S. nuclear arsenal was never truly “safe” in any absolute sense; it was managed through layers of procedure, secrecy, and luck that reduced risk but could not eliminate it.
The book’s central claim is that accidents, misperceptions, and unauthorized actions are normal possibilities in tightly coupled nuclear systems, and that the apparent control of nuclear weapons is often an illusion of safety.
The 1980 Damascus, Arkansas Titan II accident is the anchor case: a dropped socket triggered a chain of failures that nearly produced a nuclear catastrophe, showing how routine maintenance, human error, and bad design can interact.

Schlosser traces the problem back to the Manhattan Project, where scientists learned to create unprecedented destructive power faster than they learned how to control it safely.
Early bombs were assembled with limited safeguards, and even at Los Alamos criticality accidents showed that nuclear work remained casually lethal.
As weapons evolved, the U.S. built a system that separated cores, explosives, arming devices, crews, and custody rules, but those separations often made the system more complex without making it genuinely reliable.
SAC under Curtis LeMay prized standardization, discipline, checklists, and readiness, treating nuclear warfighting like industrial process control.
But readiness repeatedly conflicted with safety: airborne alert, ground alert, overseas deployment, and rapid-launch doctrine all increased the number of ways things could go wrong.
Schlosser emphasizes the recurring “always/never” problem: a weapon must always work when intended and never work when not intended, a contradiction no system can fully solve.

The book accumulates “Broken Arrow” incidents to show that near misses were not anomalies but part of the system’s history.
Examples include bombs dropped or crashed in Goldsboro, Palomares, Mars Bluff, Fairfield-Suisun, and other accidents where high explosives detonated, plutonium was scattered, or weapons vanished.
The Titan II system was especially dangerous because its hypergolic fuel and oxidizer could ignite on contact and because maintenance often required crews to work around a weapon that was already aging and unstable.
In Damascus, the dropped socket pierced the missile; fuel sprayed, vapor spread through the silo, warnings contradicted each other, and emergency response was slowed by bad communications, incompatible networks, and centralized decision-making.
Schlosser presents Damascus as a “normal accident” in Charles Perrow’s sense: the system was tightly coupled and interactive, so small failures cascaded faster than operators could comprehend them.
The same logic applies to other weapons systems in the book: a surface fire, a short circuit, a bad switch, or a botched maintenance step could bypass safing and create catastrophic outcomes.
The book repeatedly shows that official reassurances often came after the fact and were shaped by institutional self-protection, not by transparent accounting of risk.

Schlosser stresses that nuclear command and control was shaped as much by bureaucracy and service rivalry as by engineering.
The AEC, Pentagon, SAC, Sandia, Los Alamos, and the services constantly fought over custody, authority, and what counted as an acceptable safety measure.
Permissive Action Links (PALs), weak-link/strong-link systems, environmental sensing devices, and stronger locks emerged because designers like Bob Peurifoy refused to accept that readiness alone was enough.
Yet the military often resisted safety retrofits because they were seen as threats to launch speed, operational simplicity, or institutional prestige.
Schlosser argues that secrecy made the system worse in two ways: it prevented outsiders from seeing how unsafe the arsenal was, and it sometimes prevented even insiders from knowing the full accident history.
The government often minimized or concealed incidents, while the public was asked to trust that an enormously complex system was under control.
The book also shows that adversarial politics mattered: fear of Soviet first strike, the missile gap panic, and Cold War escalation pushed the U.S. toward ever faster and more brittle command structures.

Schlosser shows how U.S. strategy moved from massive retaliation to flexible response, but never escaped the underlying problem that nuclear war plans were built around speed, automation, and preemption.
The SIOP turned nuclear war into a mechanized targeting process that could kill hundreds of millions; once launched, it could not be meaningfully revised in real time.
Efforts to create continuity-of-government bunkers, airborne command posts, and redundant communications improved survivability, but they did not solve the deeper issue that leaders might be dead, unreachable, or reacting to false alarms.
False alarms and near-misses demonstrated this vividly: radar glitches, bad tapes, defective chips, and misread signals could have triggered launch decisions under extreme time pressure.
The Cold War ended without a U.S. nuclear accident or a deliberate nuclear war, but Schlosser insists that this outcome reflected luck, restraint, and repeated improvisation, not a robustly safe system.
He closes by warning that modern nuclear states still face the same structural problem: when weapons are kept on alert in compressed decision windows, control is always partial and potentially fragile.

Nuclear weapons are not “safe” in any ordinary sense; they are only managed within tolerances that depend on luck, human judgment, and institutional discipline.
Complexity is itself a hazard: the more layers added to prevent catastrophe, the more opportunities there are for error, miscommunication, and unintended interaction.
Secrecy and readiness often undermine each other by hiding problems, delaying fixes, and rewarding optimistic official narratives over honest safety assessment.
Schlosser’s lasting warning is that nuclear arsenals create a permanent contradiction: the systems meant to deter war are also capable of producing accidental war.