Two-man rule
Encyclopedia
The two-man rule is a control mechanism designed to achieve a high level of security for especially critical material or operations. Under this rule all access and actions requires the presence of two authorized people at all times.
al or malicious launch
of nuclear weapon
s by a single individual.
In the case of Minuteman missile launch crews, both operators must agree that the launch order is valid by comparing the authorization code in the launch order against the code from Sealed Authenticator (i.e. special sealed envelope which holds the code). These Sealed Authenticators are stored in a safe which has two separate lock
s so a single crew member cannot open the safe alone. Each crew member has two launch keys; both crew members must turn their keys simultaneously. Four keys are required to prevent one person from initiating a launch. For additional protection the missile crew in another Launch Control Center
must do the same for the missiles to be launched. There is also a procedure for the "Single Survivor" situation where some other conditions must be fulfilled for a successful launch.
On a submarine
, both the commanding officer
and executive officer
must agree that the order to launch is valid, and then mutually authorize the launch with their operations personnel. Instead of another party which would confirm a missile launch as in the case of land-based ICBMs, the set of keys
is distributed among the key personnel on the submarine and are kept in safes (each of these crew members has access only to his keys). Some keys are stored in special safe
s on board which are locked by combination lock
s. Nobody on board has the combination to open these safes - the unlock key comes as a part of the launch order from the higher authority.
Higher up, in the United States
, the National Command Authority
comprising the President
and Secretary of Defense
must jointly issue the order to use nuclear weapons to the Chairman of the Joint Chiefs of Staff
. Usually, the two-man rule is also backed up with hardware
and software measures including command code verification and command keys.
Journalist Ron Rosenbaum
has pointed out that, once the order is issued, the process is entirely concerned with authenticating the identity of the commanding officer and the authenticity of the order, and there are no safeguards to verify that the order or the person issuing it is actually sane
. Notably, Major Harold Hering
was discharged from the Air Force for asking the question "How can I know that an order I receive to launch my missiles came from a sane president?"
material and cryptographic manuals. TPI is accomplished as follows:
At no time can one person have in his or her possession the combinations or keys to gain lone access to a security container or cryptographic equipment containing COMSEC material. Neither can one person have sole possession of COMSEC material that requires TPI security. http://www.tpub.com/content/istts/14222/css/14222_85.htm
In the USAF concerning critical weapons, it is a zone in which the presence of a single individual is prohibited. The two-person concept (or policy) is in effect in which two individuals, knowledgeable of the task to be performed, and capable of detecting an incorrect or unauthorized procedure on the part of the other in reference to the task being performed.
critical applications where the presence of two people is required before a potentially hazardous operation can be performed. This is common safety practice in, e.g., laboratories and machine shops; in such contexts, the additional security may be less important than the fact that if one individual is injured the other can call for help. As another example, Firefighters operating in a hazardous environment (i.e. interior structure fire, HAZMAT zone, also known as IDLH
) function as a team of at least 2 or more personnel. There are commonly more than one team in the same environment, but each team operates as a unit. Some software systems enforce a "two-man rule" whereby certain actions (for example, money wire transfers) can only be effected if approved by two authorized users.
Dual keys require the authorization of two separate parties before a particular action is taken. The simplest form of Dual Key security is a lock that requires two keys to unlock it. The two keys would be in the possession of two separate persons. The lock could only be opened if both parties agreed to open it and at the same time. Canada
accepted having American
W-40 nuclear warheads under dual key control on Canadian soil in 1963 to be used on the Canadian BOMARC missiles.
In business
, the four-eye principle "means that all business decisions and transactions need approval from the CEO and CFO. Since the CFO is not reporting to the CEO, there is an independent controlling mechanism in place."
Similarly, many bank
s implement some variant of the two-man rule to secure large sums of money and valuable items. Under this concept, unlocking the vault
requires two individuals with different keys if the vault is secured by a key lock system. For bank vaults secured by combination lock, one individual will know half of the combination and a second person will know the remaining half. At no point will either person know the other person's half of the lock combination, requiring both persons to be physically present in order to unlock the vault.
, when Captain Ramius takes the dead political officer's missile key, a fellow officer, the ship's doctor
, requests that he have the key, using the two-man rule as his reason, saying "The reason for having two missile keys is so that no one man may arm the missiles."
The two-man rule was disputed in the movie Crimson Tide
when the Captain
of the USS Alabama and the executive officer clashed over the release of nuclear weapons.
In the Tom Clancy novel The Sum of All Fears
President Robert Fowler and Jack Ryan, Deputy Director of the Central Intelligence Agency
, comprise the two men that were to issue a nuclear launch order against a city thought to be harboring a terrorist leader. Ryan refused to validate the launch order and the nuclear attack is aborted. Ryan could be that second man because the SECDEF was killed in a terrorist attack, and due to Ryan's role as DDCI
.
In the film WarGames
, during a simulation exercise, one of two launch officers pulls a gun on the second officer when he refuses to turn his launch key. This incident sets up the basis of the movie, in which the Department of Defense replaces the two-man system with the WOPR Computer to prevent refusal to launch.
In the film Salt, US President Lewis together with Secretary of Defense verified the authentication codes alternately to launch nuclear weapons from nuclear football
inside the Presidential Emergency Operations Center
The Star Trek
franchise depicts the two-man rule and other similar variations in critical situations, often concerning arming or cancelling a ship's self-destruct
mechanism. Some variants require the authorization of three senior officers (Star Trek III: The Search For Spock
, Star Trek: First Contact
), others just the Commanding and Executive officers (Star Trek: The Next Generation
episodes 11001001 and Where Silence Has Lease, Star Trek: Deep Space Nine
episode The Adversary). All depictions include voice authorization of the officers involved, while the two-man variant also involved a handprint identification.
As an extension of the broader rationale for the "two-man rule", regulations for some companies or not-for-profit organizations may require signatures of two executives on checks. These rules make it harder for an individual acting alone to defraud the organization.
Nuclear weapons
Per US Air Force Instruction (AFI) 91-104, "The Two Person Concept" is designed to prevent accidentAccident
An accident or mishap is an unforeseen and unplanned event or circumstance, often with lack of intention or necessity. It implies a generally negative outcome which may have been avoided or prevented had circumstances leading up to the accident been recognized, and acted upon, prior to its...
al or malicious launch
Rocket launch
A rocket launch is the takeoff phase of the flight of a rocket. Launches for orbital spaceflights, or launches into interplanetary space, are usually from a fixed location on the ground, but may also be from a floating platform such as the San Marco platform, or the Sea Launch launch...
of nuclear weapon
Nuclear weapon
A nuclear weapon is an explosive device that derives its destructive force from nuclear reactions, either fission or a combination of fission and fusion. Both reactions release vast quantities of energy from relatively small amounts of matter. The first fission bomb test released the same amount...
s by a single individual.
In the case of Minuteman missile launch crews, both operators must agree that the launch order is valid by comparing the authorization code in the launch order against the code from Sealed Authenticator (i.e. special sealed envelope which holds the code). These Sealed Authenticators are stored in a safe which has two separate lock
Lock (device)
A lock is a mechanical or electronic fastening device that is released by a physical object or secret information , or combination of more than one of these....
s so a single crew member cannot open the safe alone. Each crew member has two launch keys; both crew members must turn their keys simultaneously. Four keys are required to prevent one person from initiating a launch. For additional protection the missile crew in another Launch Control Center
Launch control center (ICBM)
A launch control center , in the United States, is the main control facility for intercontinental ballistic missiles . A launch control center monitors and controls missile launch facilities. From a launch control center, the missile combat crew can monitor the complex, launch the missile, or relax...
must do the same for the missiles to be launched. There is also a procedure for the "Single Survivor" situation where some other conditions must be fulfilled for a successful launch.
On a submarine
Submarine
A submarine is a watercraft capable of independent operation below the surface of the water. It differs from a submersible, which has more limited underwater capability...
, both the commanding officer
Commanding officer
The commanding officer is the officer in command of a military unit. Typically, the commanding officer has ultimate authority over the unit, and is usually given wide latitude to run the unit as he sees fit, within the bounds of military law...
and executive officer
Executive officer
An executive officer is generally a person responsible for running an organization, although the exact nature of the role varies depending on the organization.-Administrative law:...
must agree that the order to launch is valid, and then mutually authorize the launch with their operations personnel. Instead of another party which would confirm a missile launch as in the case of land-based ICBMs, the set of keys
Key (lock)
A key is an instrument that is used to operate a lock. A typical key consists of two parts: the blade, which slides into the keyway of the lock and distinguishes between different keys, and the bow, which is left protruding so that torque can be applied by the user. The blade is usually intended to...
is distributed among the key personnel on the submarine and are kept in safes (each of these crew members has access only to his keys). Some keys are stored in special safe
Safe
A safe is a secure lockable box used for securing valuable objects against theft or damage. A safe is usually a hollow cuboid or cylinder, with one face removable or hinged to form a door. The body and door may be cast from metal or formed out of plastic through blow molding...
s on board which are locked by combination lock
Combination lock
A combination lock is a type of lock in which a sequence of numbers or symbols is used to open the lock. The sequence may be entered using a single rotating dial which interacts with several discs or cams, by using a set of several rotating discs with inscribed numerals which directly interact with...
s. Nobody on board has the combination to open these safes - the unlock key comes as a part of the launch order from the higher authority.
Higher up, in the United States
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
, the National Command Authority
National Command Authority
National Command Authority is a term used by the Department of Defense of the United States of America to refer to the ultimate lawful source of military orders. The NCA comprises the President of the United States and the Secretary of Defense jointly, or their duly deputized successors, i.e...
comprising the President
President of the United States
The President of the United States of America is the head of state and head of government of the United States. The president leads the executive branch of the federal government and is the commander-in-chief of the United States Armed Forces....
and Secretary of Defense
United States Secretary of Defense
The Secretary of Defense is the head and chief executive officer of the Department of Defense of the United States of America. This position corresponds to what is generally known as a Defense Minister in other countries...
must jointly issue the order to use nuclear weapons to the Chairman of the Joint Chiefs of Staff
Chairman of the Joint Chiefs of Staff
The Chairman of the Joint Chiefs of Staff is by law the highest ranking military officer in the United States Armed Forces, and is the principal military adviser to the President of the United States, the National Security Council, the Homeland Security Council and the Secretary of Defense...
. Usually, the two-man rule is also backed up with hardware
Hardware
Hardware is a general term for equipment such as keys, locks, hinges, latches, handles, wire, chains, plumbing supplies, tools, utensils, cutlery and machine parts. Household hardware is typically sold in hardware stores....
and software measures including command code verification and command keys.
Journalist Ron Rosenbaum
Ron Rosenbaum
-Life and career:Rosenbaum was born into a Jewish family in New York City, New York and grew up in Bay Shore, New York. He graduated from Yale University in 1968 and won a Carnegie Fellowship to attend Yale's graduate program in English Literature, though he dropped out after taking one course...
has pointed out that, once the order is issued, the process is entirely concerned with authenticating the identity of the commanding officer and the authenticity of the order, and there are no safeguards to verify that the order or the person issuing it is actually sane
Sanity
Sanity refers to the soundness, rationality and healthiness of the human mind, as opposed to insanity. A person is sane if they are rational...
. Notably, Major Harold Hering
Harold Hering
Major Harold L. Hering was an officer in the United States Air Force, who was discharged for questioning the process for launching nuclear missiles.Hering served in Vietnam in the Air Rescue Service...
was discharged from the Air Force for asking the question "How can I know that an order I receive to launch my missiles came from a sane president?"
Cryptographic material
Two-person integrity (TPI) is the security measure taken to prevent single-person access to COMSEC keyingKey (cryptography)
In cryptography, a key is a piece of information that determines the functional output of a cryptographic algorithm or cipher. Without a key, the algorithm would produce no useful result. In encryption, a key specifies the particular transformation of plaintext into ciphertext, or vice versa...
material and cryptographic manuals. TPI is accomplished as follows:
- The constant presence of two authorized persons when COMSEC material is being handled;
- The use of two combination locks on security containers used to store COMSEC material; and
- The use of two locking devices and a physical barrier for the equipment.
At no time can one person have in his or her possession the combinations or keys to gain lone access to a security container or cryptographic equipment containing COMSEC material. Neither can one person have sole possession of COMSEC material that requires TPI security. http://www.tpub.com/content/istts/14222/css/14222_85.htm
No-lone zone
A no-lone zone is an area that must be staffed by two or more qualified or cleared individuals. Each individual must be within visual contact with each other and in visual contact with the critical component that requires a no-lone-zone area designation. A no-lone zone may contain a cryptographic component, weapon system hardware under test, a nuclear weapon or active nuclear weapon controls.In the USAF concerning critical weapons, it is a zone in which the presence of a single individual is prohibited. The two-person concept (or policy) is in effect in which two individuals, knowledgeable of the task to be performed, and capable of detecting an incorrect or unauthorized procedure on the part of the other in reference to the task being performed.
Other uses
The two-man rule is used in other safetySafety
Safety is the state of being "safe" , the condition of being protected against physical, social, spiritual, financial, political, emotional, occupational, psychological, educational or other types or consequences of failure, damage, error, accidents, harm or any other event which could be...
critical applications where the presence of two people is required before a potentially hazardous operation can be performed. This is common safety practice in, e.g., laboratories and machine shops; in such contexts, the additional security may be less important than the fact that if one individual is injured the other can call for help. As another example, Firefighters operating in a hazardous environment (i.e. interior structure fire, HAZMAT zone, also known as IDLH
IDLH
IDLH is an initialism for Immediately Dangerous to Life or Health, and is defined by the US National Institute for Occupational Safety and Health as exposure to airborne contaminants that is "likely to cause death or immediate or delayed permanent adverse health effects or prevent escape from such...
) function as a team of at least 2 or more personnel. There are commonly more than one team in the same environment, but each team operates as a unit. Some software systems enforce a "two-man rule" whereby certain actions (for example, money wire transfers) can only be effected if approved by two authorized users.
Dual keys require the authorization of two separate parties before a particular action is taken. The simplest form of Dual Key security is a lock that requires two keys to unlock it. The two keys would be in the possession of two separate persons. The lock could only be opened if both parties agreed to open it and at the same time. Canada
Canada
Canada is a North American country consisting of ten provinces and three territories. Located in the northern part of the continent, it extends from the Atlantic Ocean in the east to the Pacific Ocean in the west, and northward into the Arctic Ocean...
accepted having American
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
W-40 nuclear warheads under dual key control on Canadian soil in 1963 to be used on the Canadian BOMARC missiles.
In business
Business
A business is an organization engaged in the trade of goods, services, or both to consumers. Businesses are predominant in capitalist economies, where most of them are privately owned and administered to earn profit to increase the wealth of their owners. Businesses may also be not-for-profit...
, the four-eye principle "means that all business decisions and transactions need approval from the CEO and CFO. Since the CFO is not reporting to the CEO, there is an independent controlling mechanism in place."
Similarly, many bank
Bank
A bank is a financial institution that serves as a financial intermediary. The term "bank" may refer to one of several related types of entities:...
s implement some variant of the two-man rule to secure large sums of money and valuable items. Under this concept, unlocking the vault
Bank vault
A bank vault is a secure space where money, valuables, records, and documents can be stored. It is intended to protect their contents from theft, unauthorized use, fire, natural disasters, and other threats, just like a safe...
requires two individuals with different keys if the vault is secured by a key lock system. For bank vaults secured by combination lock, one individual will know half of the combination and a second person will know the remaining half. At no point will either person know the other person's half of the lock combination, requiring both persons to be physically present in order to unlock the vault.
In popular culture
In the film The Hunt for Red OctoberThe Hunt for Red October (film)
The Hunt for Red October is a 1990 thriller film based on the novel of the same name by Tom Clancy. It was directed by John McTiernan and stars Sean Connery as Captain Marko Ramius and Alec Baldwin as Jack Ryan...
, when Captain Ramius takes the dead political officer's missile key, a fellow officer, the ship's doctor
Physician
A physician is a health care provider who practices the profession of medicine, which is concerned with promoting, maintaining or restoring human health through the study, diagnosis, and treatment of disease, injury and other physical and mental impairments...
, requests that he have the key, using the two-man rule as his reason, saying "The reason for having two missile keys is so that no one man may arm the missiles."
The two-man rule was disputed in the movie Crimson Tide
Crimson Tide (film)
The film has uncredited additional writing by Quentin Tarantino, much of it being the pop-culture reference-laden dialogue.The U.S. Navy objected to many of the elements in the script — particularly the aspect of mutiny on board a U.S. naval vessel — and as such, the film was produced...
when the Captain
Captain (naval)
Captain is the name most often given in English-speaking navies to the rank corresponding to command of the largest ships. The NATO rank code is OF-5, equivalent to an army full colonel....
of the USS Alabama and the executive officer clashed over the release of nuclear weapons.
In the Tom Clancy novel The Sum of All Fears
The Sum of All Fears
The Sum of All Fears is the best-selling thriller novel by Dan Fogelman and Tom Clancy, and part of the Jack Ryan series. It was the fourth book of the series to be turned into a film. An interesting historical note is that this book was released just days before the Moscow uprising in 1991, which...
President Robert Fowler and Jack Ryan, Deputy Director of the Central Intelligence Agency
Deputy Director of the Central Intelligence Agency
The Deputy Director of the Central Intelligence Agency is a senior United States government official in the U.S. Central Intelligence Agency...
, comprise the two men that were to issue a nuclear launch order against a city thought to be harboring a terrorist leader. Ryan refused to validate the launch order and the nuclear attack is aborted. Ryan could be that second man because the SECDEF was killed in a terrorist attack, and due to Ryan's role as DDCI
Deputy Director of the Central Intelligence Agency
The Deputy Director of the Central Intelligence Agency is a senior United States government official in the U.S. Central Intelligence Agency...
.
In the film WarGames
WarGames
WarGames is a 1983 American Cold War suspense/science-fiction film written by Lawrence Lasker and Walter F. Parkes and directed by John Badham. The film stars Matthew Broderick and Ally Sheedy....
, during a simulation exercise, one of two launch officers pulls a gun on the second officer when he refuses to turn his launch key. This incident sets up the basis of the movie, in which the Department of Defense replaces the two-man system with the WOPR Computer to prevent refusal to launch.
In the film Salt, US President Lewis together with Secretary of Defense verified the authentication codes alternately to launch nuclear weapons from nuclear football
Nuclear football
The nuclear football is a briefcase, the contents of which are to be used by the President of the United States of America to authorize a nuclear attack while away from fixed command centers, such as the White House Situation Room...
inside the Presidential Emergency Operations Center
Presidential Emergency Operations Center
The President's Emergency Operations Center is a structure that lies beneath the East Wing of the White House in the United States. Originally constructed for President Franklin D...
The Star Trek
Star Trek
Star Trek is an American science fiction entertainment franchise created by Gene Roddenberry. The core of Star Trek is its six television series: The Original Series, The Animated Series, The Next Generation, Deep Space Nine, Voyager, and Enterprise...
franchise depicts the two-man rule and other similar variations in critical situations, often concerning arming or cancelling a ship's self-destruct
Self-destruct
A self-destruct is a mechanism which causes a device to destroy itself under a predefined set of circumstances.Self-destruct mechanisms are also found on devices and systems where malfunction could endanger large numbers of people...
mechanism. Some variants require the authorization of three senior officers (Star Trek III: The Search For Spock
Star Trek III: The Search for Spock
Star Trek III: The Search for Spock is a 1984 motion picture released by Paramount Pictures. The film is the third feature based on the Star Trek science fiction franchise and is the center of a three-film story arc that begins with Star Trek II: The Wrath of Khan and concludes with Star Trek IV:...
, Star Trek: First Contact
Star Trek: First Contact
Star Trek: First Contact is the eighth feature film in the Star Trek science fiction franchise, released in November 1996, by Paramount Pictures. First Contact is the first film in the franchise to feature no cast members from the original Star Trek television series of the 1960s...
), others just the Commanding and Executive officers (Star Trek: The Next Generation
Star Trek: The Next Generation
Star Trek: The Next Generation is an American science fiction television series created by Gene Roddenberry as part of the Star Trek franchise. Roddenberry, Rick Berman, and Michael Piller served as executive producers at different times throughout the production...
episodes 11001001 and Where Silence Has Lease, Star Trek: Deep Space Nine
Star Trek: Deep Space Nine
Star Trek: Deep Space Nine is a science fiction television series set in the Star Trek universe...
episode The Adversary). All depictions include voice authorization of the officers involved, while the two-man variant also involved a handprint identification.
Other meanings
The requirement for the presence of at least two staff members is also used in other contexts where there are security concerns, such as in banks. When bank employees perform some tasks, such as removing money from safes or opening Automated Teller Machine deposits, company policies often require that at least two employees be present. Many banks also make use of physical measures to ensure this - such as cabinets which require the simultaneous use of two keys, or by issuing only half of a vault combination to certain employees and the other half of the combination to the remaining employees.As an extension of the broader rationale for the "two-man rule", regulations for some companies or not-for-profit organizations may require signatures of two executives on checks. These rules make it harder for an individual acting alone to defraud the organization.
See also
- Buddy systemBuddy systemThe buddy system is a procedure in which two people, the "buddies", operate together as a single unit so that they are able to monitor and help each other.-Advantages:...
- Fail-deadlyFail-deadlyFail-deadly is a concept in nuclear military strategy which encourages deterrence by guaranteeing an immediate, automatic and overwhelming response to an attack. The term fail-deadly was coined as a contrast to fail-safe.-Military usage:...
- Segregation of duties
- The Hunt for Red OctoberThe Hunt for Red OctoberThe Hunt for Red October is a 1984 novel by Tom Clancy. The story follows the intertwined adventures of Soviet submarine captain Marko Aleksandrovich Ramius and CIA analyst Jack Ryan.The novel was originally published by the U.S...
- The Sum of All FearsThe Sum of All FearsThe Sum of All Fears is the best-selling thriller novel by Dan Fogelman and Tom Clancy, and part of the Jack Ryan series. It was the fourth book of the series to be turned into a film. An interesting historical note is that this book was released just days before the Moscow uprising in 1991, which...
- Crimson TideCrimson Tide (film)The film has uncredited additional writing by Quentin Tarantino, much of it being the pop-culture reference-laden dialogue.The U.S. Navy objected to many of the elements in the script — particularly the aspect of mutiny on board a U.S. naval vessel — and as such, the film was produced...