Foreign Relations of the United States, 1977–1980, Volume IV, National Security Policy

167. Memorandum From Secretary of Defense Brown to President Carter¹

Washington, November 20, 1979

SUBJECT

• NORAD False Alarm (C)

(TS) On 9 November 1979, a spurious missile attack warning was inadvertently introduced into the computer system at the NORAD Combat Operations Center (NCOC) in Cheyenne Mountain. As happened in this case, the system design properly and automatically transmits such warnings to appropriate national and regional command centers in the United States, Canada, and the United Kingdom. Understandable concern over this event by those unfamiliar with the technical and procedural safeguards in our strategic warning system has raised questions both here and abroad concerning the potential for precipitous action in a real or simulated crisis. The following report summarizes the genesis of the false alarm, the actions taken as a result, and my conclusions regarding the reliability of the warning system.

(TS) The immediate cause of the incident was the inadvertent introduction of a test attack scenario into the automated NCOC missile warning system display. To the NCOC operations staff, the attack indications were not immediately identifiable as spurious when the display appeared, and they properly initiated alerting and verification procedures appropriate to indications of a mass missile raid. Concurrently, a Threat Assessment Conference (TAC) was called by the Deputy Director for Operations in the National Military Command Center (NMCC) to evaluate the threat. The TAC is an emergency conference one level below the Missile Attack Conference; the latter includes the National Command Authorities. As a result of this conference and the many quickly identifiable anomalies, the threat was clearly, correctly, and conclusively evaluated as spurious in less than six minutes of the first alarm. Because of this evaluation and the earlier recognition of the many anomalies before the official assessment of the threat as spurious, a Missile Attack Conference was deemed unnecessary.

(TS) Within less than sixty seconds of initial alert, system redundancy and direct paths of critical warning information from sensors to users had enabled responsible officials at SAC Headquarters and the NMCC to detect anomalies in warning indications which could not have been present had an actual mass attack been underway. Inconsistencies also began to emerge at NORAD Headquarters in about one minute. For example, Defense Support Program (DSP) satellites and transmission systems were operating normally but were producing no displays to corroborate the missile launches depicted on the NORAD warning display. Similarly, our radar sensors were operating normally, but detected no SLBM activity even though the NORAD display depicted over 200 SLBMs en route. Assessment of these and other anomalies raised serious questions regarding the validity of the NORAD-generated display and avoided any precipitous reaction involving nuclear forces. (No nuclear armed aircraft were activated and no increased alert measures were ordered for any US nuclear forces.)

(TS) However, this incident deserves close attention, causes me real concern, and requires corrective actions.² There are two issues. The first involves the technical and procedural causes of the false alarm, the scrambling of the air defense aircraft, and the launch of NEACP. As to the cause, the possibility of recurrence of such an incident has been eliminated by prohibiting connection of the test computer to the main system in the future without advance coordination and warning to all concerned. Action is also underway to review, clarify, and refine procedures governing launch of air defense and command and control aircraft. In short, mistakes were made and imperfections brought to light which have been and are being corrected.

(TS) But there is a higher order of concern. It involves the broader issue of the reliability, responsiveness, and human control over both our strategic warning system and our nuclear forces. In these terms, the events of 9 November appear to me to provide, overall, considerable reassurance on all counts. Despite a freak incident which severely stressed our warning and assessment procedures, the systems worked as designed, the redundancy of warning paths provided the basis for correct decisions and eliminated the risk of precipitous action. Most important, the people involved at every level acted responsibly and with good judgment, based on the information available to them. Under the demanding situation of conflicting information, a narrow decision-time window, and the natural stress accompanying such circumstances, I believe that the following were amply and creditably demonstrated: a high degree of responsiveness; safeguards against precipitate action; and a system design that places human judgment in a position to override computer mistakes.

(TS) My overall assessment of the lessons learned is that the mechanical, procedural, and human elements of our strategic warning and control system are fundamentally sound and should be supported as such in response to questions or assertions to the contrary. The key point is that the system corrects errors before they cascade in a dangerous way. However, I do not want to minimize the fact that we had several errors in the system and we still have considerable work to do to improve strategic command and control and connectivity across the board. For example, there are still some bugs to be worked out in NORAD’s Command and Control Computer System (427M). These and other problems will receive our priority attention in the days ahead.

(U) In case this incident raises further questions in the Congress, the media, or among allies, I believe that the following points should be stressed:

1. At no time were the strategic nuclear forces activated—the incident was completely contained within the command and control community;

2. The malfunction was very quickly identified and acted upon;

3. The overall way in which the system worked after the initial malfunction is reassuring with respect to the redundancy of indicators, responsible human judgment and adequacy of safeguards in a very short decision time frame.³

Harold Brown

1. Source: Carter Library, National Security Affairs, Brzezinski Material, Subject File, Box 42, Missile Warning Incidents: 11/79–8/80. Top Secret. Carter wrote in the upper right corner of the memorandum: “Harold, This was a serious mistake and should have been reported to me immediately. J.” Brzezinski sent the memorandum to Carter under cover of a November 21 memorandum, which Carter initialed. (Ibid.) Odom sent both Brown’s memorandum to Carter and the covering memorandum to Brzezinski for his signature under cover of a November 21 memorandum. Aaron wrote on Odom’s memorandum to Brzezinski: “ZB, This is an unbelievable fuzzy-ball. It is not possible to figure out what happened. I think Harold should be told to give us an explicit statement of what happened.” (Ibid.)
2. Carter drew two vertical lines in the left margin next to this paragraph.
3. Brzezinski returned the memorandum to Brown under cover of a November 23 memorandum that reads: “Attached is a copy of your memorandum to the President of November 20 concerning the NORAD false alarm. Please note the President’s comment on the first page.” (Carter Library, National Security Affairs, Brzezinski Material, Subject File, Box 42, Missile Warning Incidents: 11/79–8/80)