The Safety
What happens if the President of the United States orders the bombardment of Iran with the full available nuclear arsenal tomorrow morning after a bad night's sleep — and cannot be talked out of it? The answer is publicly documented. And it is disturbingly concrete.
I. What Most People Believe
Most people imagine there is a button. Or a complicated panel of switches. Or a multi-level committee that votes. Something standing between an impulsive order and the launch of intercontinental ballistic missiles.
This idea is wrong.
Nuclear weapons expert Bruce Blair, a former Minuteman missile launch officer and researcher at Princeton University, has publicly described the actual procedure. The Congressional Research Service has documented it. The Department of Defense confirmed it in the Nuclear Matters Handbook 2020. What follows is not a secret — it is publicly available knowledge.
II. What Actually Happens — Step by Step
- Conference call. Der Präsident initiiert eine gesicherte Schaltung mit militärischen und zivilen Beratern — im Weißen Haus im Situation Room, auf Reisen per gesicherter Leitung. Key participants: the deputy director of the National Military Command Center (NMCC) at the Pentagon, the commander of U.S. Strategic Command (STRATCOM) in Omaha, and the Chairman of the Joint Chiefs of Staff. Duration: as long as the president wishes. In a retaliation scenario with an incoming attack: 30 seconds to a few minutes.
- Decision. The president selects from prepared strike options: major options (mass attack), selective options (specific targets), limited options. He may choose an existing option or, time permitting, ask STRATCOM to prepare a new one. No one can exercise a veto. The Secretary of Defense confirms the president's identity but has no right of objection. The Chairman of the Joint Chiefs advises but is by law only an "adviser" — not in the chain of command. Interim finding: there is no legally binding authority that can overrule the president.
- Authentication. The president is asked to confirm his order. The duty officer at the NMCC states a "challenge code" — two phonetic letters. The president reads the correct response code from the "biscuit" (a plastic card he carries at all times). The officer confirms: it is the president. This authentication confirms only identity — not legality, not mental competence.
- Launch order. The war room at the Pentagon encodes and encrypts the launch order. The document is approximately 150 characters long — the length of an old tweet. It contains: the war plan, launch time, authentication codes and the unlock codes for the missiles. It is transmitted simultaneously to all worldwide command posts and directly to the launch crews. Receipt time for submarine and ICBM crews: seconds.
- Launch. The crews open safes containing sealed NSA authentication codes. They compare these with the codes in the launch order. Four officers aboard a submarine confirm the order. Two votes suffice for launch. Even if three of five ICBM crews refuse: two are enough — the launch cannot be prevented. Land-based missiles: ~5 minutes after decision. Submarine missiles: ~15 minutes.
Summarised in a sentence formulated by Bruce Blair: "The president wakes up, gives an order through a system with almost no gatekeepers, and within five minutes 400 bombs leave on missiles from silos in the Midwest. About ten minutes later, another 400 follow from submarines."
That would be 800 nuclear weapons. In round figures: the equivalent of 15,000 Hiroshima bombs.
III. What the Safeguards Are — and Why They Are None
Die Standardantwort auf die Frage nach den Sicherungen lautet: Institutionen, Prozesse, das Militär. In der Praxis bedeutet das:
The Secretary of Defense is part of the chain of command under the Goldwater-Nichols Act, but his influence is limited to identity verification. Nuclear expert Franklin Miller states it plainly: even the Secretary of Defense cannot exercise a veto. He can only forward the order to the Pentagon war room — or refuse, which would trigger a constitutional conflict but would not prevent the launch, since the president could contact STRATCOM directly.
Der Vorsitzende des Joint Chiefs ist gesetzlich nur Berater. Er ist in der „Kommunikationskette“, nicht in der „Befehlskette“ — so hat es General Mark Milley selbst vor dem Kongress präzisiert. Das bedeutet: Er kann beraten, er kann drängen, er kann argumentieren. Vetieren kann er nicht.
Military law requires service members to refuse manifestly illegal orders. But as the Congressional Research Service notes, legal objections in practice are most likely to lead to consultations and modifications — not outright refusal. And: no one in the NMCC is tasked with assessing the lawfulness of a launch order before forwarding it.
The 25th Amendment — the mechanism for removing an incapacitated president — requires: a petition by the Vice President, a cabinet vote, notification to Congress, possible objection by the president, a second cabinet vote, second notification to Congress, a vote in both chambers. That is a process of days to weeks. A nuclear first strike can be executed in five minutes.
Die Architektur des Freigabeverfahrens wurde in den frühen 1960er Jahren entworfen — für ein einziges Szenario: schnelle Gegenvergeltung nach einem Angriff der Sowjetunion. Sie optimiert für Geschwindigkeit und Konzentration von Autorität. Was sie nicht enthält: einen Mechanismus, der einen impulsiven Ersteinsatz ohne erkennbaren Angriff verhindert.
Der Expertenausdruck dafür ist „thermonukleare Monarchie“ — geprägt von der Rechtsprofessorin Elaine Scarry.
IV. What Really Happened in 2021
There is a documented case of someone attempting to install a safeguard outside the official framework. Er ist im Woodward/Costa-Buch Peril beschrieben und in Congressional Anhörungen bestätigt.
In January 2021, two days after the storming of the Capitol, General Mark Milley, Chairman of the Joint Chiefs, convened a secret meeting of senior NMCC officers. He reminded them of the official procedure — and added: no launch order would be executed without his personal involvement. He had each officer confirm this individually. He called it an "oath."
In parallel, Milley called his Chinese counterpart General Li Zuocheng and assured him: the US would not attack. "If we are going to attack, I will call you ahead of time."
On the phone with Nancy Pelosi, who asked whether Trump could order a nuclear strike, Milley reportedly replied: "I agree with you on everything." And: "The president alone can order the use of nuclear weapons. But he does not launch them alone."
What Milley did was legally questionable. He had no authority to insert himself into the chain of command. He acted on the basis of personal judgement — and the assessment that the sitting president was showing "serious mental decline."
It was, in other words, an improvised safeguard. Not an institutional one — a personal one.
V. What Has Changed Since 2021
General Milley is no longer in office. He was succeeded in October 2023 by General Charles Q. Brown Jr., who was in turn dismissed by Trump in February 2025. Trump's new Chairman of the Joint Chiefs is General Dan Caine, a reservist without the institutional independence of his predecessors.
Die Purge im militärischen Führungspersonal war weitreichend. Mehrere hochrangige Offiziere, die als potenzielle Bremsklötze galten, wurden ersetzt oder zurückgezogen. Pete Hegseth, ohne jede Regierungserfahrung als Verteidigungsminister eingesetzt, hat keine erkennbare institutionelle Autorität, einem entschlossenen Präsidenten zu widerstehen.
The improvised safeguard of 2021 — a general acting from personal sense of duty — no longer exists. What exists is the institutional architecture of the 1960s, unchanged, in a situation for which it was never designed.
VI. Conventional Is No Better
It is important to note: the question of nuclear first strikes is not the only problem. Conventional military operations — bombardments, cyber operations, naval blockades — are subject to even fewer formal constraints. A president can order conventional attacks without Congress, with significantly shorter decision chains and less public documentation.
The question "What happens if he has Iran bombed?" is easier to answer for conventional than for nuclear: it happens. Congress can protest afterwards, force a vote, freeze funds. But stop the first order? It cannot.
VII. An Old Insight
This is not a new problem. It is the oldest problem in political philosophy: what happens when power is concentrated in a single person and no institutional control remains effective?
History gives a consistent answer. In systems without a functioning corrective — monarchies, dictatorships, tyrannies — the last remaining means was always a physical one. The assassinations of Caesar, of Caligula, the numerous attempts against Hitler — they were not expressions of barbarism but of institutional failure. Not because those who acted wished it so, but because all other paths were blocked.
James Madison, one of the architects of the American constitution, wrote in the Federalist Papers: "If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary." He knew that institutional control is necessary because people are not angels. He built it into the constitution — for almost everything. Except for the nuclear strike.
The American nuclear launch procedure is, in its basic structure, a monarchy. One person decides, everyone executes. What applies in a monarchy or dictatorship when institutions fail completely applies here too. This is not a recommendation. It is the diagnosis of an architecture that Madison himself would have called incomplete.
VIII. What the Debate Does Not Say
The public debate about Trump's mental state, his character, his motives is real and legitimate. But it distracts from a structural question that applies independently of any individual:
The American system concentrates the decision-making power over the use of weapons that can destroy civilisation in a single person, with a window of minutes, without any legally effective counterweight, in a procedure designed for response to attack and knowing no brake for impulsive first use.
This architecture was already dangerous in the person of Nixon — his Secretary of Defense Schlesinger privately instructed during the Watergate winter of 1974 that no military orders from the president should be forwarded without his countersignature. That too was legally questionable. That too was an improvised personal safeguard.
Two presidents in fifty years — Nixon and Trump — have made the structural weakness of this system so visible that their most senior military officers acted outside their mandate to compensate for it. The pattern is not an exception. It is a diagnosis.
The safeguard is not institutional. It never was institutional. It was always personal — dependent on the character of the people who happen to be in the room when the decision is made.
The room has changed.