The two-person rule is a control mechanism designed to achieve a high level of security for especially critical material or operations. Under this rule, access and actions require the presence of two or more authorized people at all times.
The two-person rule is a control mechanism designed to achieve a high level of security for especially critical material or operations. Under this rule, access and actions require the presence of two or more authorized people at all times.
Per US Air Force Instruction (AFI) 91-104, "the two-person concept" is designed to prevent accidental or malicious launch of nuclear weapons by a single individual. [1]
In the case of Minuteman missile launch crews, once a launch order is received, both operators must agree that it is valid by comparing the authorization code in the order against a Sealed Authenticator (a special sealed envelope containing a verification code). These Sealed Authenticators are stored in a safe which has two separate locks. Each operator has the key to only one lock, so neither can open the safe alone. Also, each operator has one of two launch keys; once the order is verified, they must insert the keys in slots on the control panel and turn them simultaneously. As a further precaution, the slots for the two launch keys are positioned far enough apart to make it impossible for one operator to reach both of them at once. For additional protection, the crew in another launch control center must verify the authorization code and turn their keys for the missiles to be launched. A total of four keys are thus required to initiate a launch.
On a submarine, both the commanding officer and the executive officer must agree that the order to launch is valid and then mutually authorize the launch with their operations personnel. Instead of another party who would confirm a missile launch as in the case of land-based ICBMs, a third officer – the Weapons Officer – must also confirm the launch. In addition, the set of keys is distributed among the key personnel on the submarine, and the keys are kept in safes (each of these crew members has access only to their key). Some keys are stored in special safes on board which are secured by combination locks. Nobody on board has the combination to open these safes; the unlock key comes as a part of the launch order (Emergency Action Message) from the higher authority. [2]
Journalist Ron Rosenbaum has pointed out that, once the order is issued, the process is entirely concerned with authenticating the identity of the commanding officers and the authenticity of the order, and there are no safeguards to verify that the order or the person issuing it is actually sane. [3] Notably, Major Harold Hering was discharged from the Air Force for asking the question, "How can I know that an order I receive to launch my missiles came from a sane President?" [3]
The two-person rule only applies in the missile silos and submarines; there is no check on the US president's sole authority to order a nuclear launch. [4]
Two-person integrity (TPI) is the security measure taken to prevent single-person access to COMSEC keying material and cryptographic manuals. TPI is accomplished as follows: [5]
At no time can one person have in their possession the combinations or keys to gain lone access to a security container or cryptographic equipment containing COMSEC material. Neither can one person have sole possession of COMSEC material that requires TPI security. [5]
A no-lone zone is an area that must be staffed by two or more qualified or cleared individuals at all times. [6] The individuals must maintain visual contact with each other and with the component(s) that require the no-lone-zone area designation. Such a zone may contain a cryptographic component, weapon system hardware under test, a nuclear weapon, active weapon controls, or other such critical information or devices.
In the United States Air Force (USAF) policy concerning critical weapons, a no-lone zone is an area for which entry by a single unaccompanied individual is prohibited. The two-person concept requires the presence of at least two individuals knowledgeable of the task(s) to be performed; in addition, each individual must be capable of detecting an incorrect or unauthorized procedure on the part of any others regarding the task(s). [7]
 | This section needs additional citations for verification .(May 2021) |
The two-person rule is used in other safety-critical applications where the presence of two people is required before a potentially hazardous operation can be performed. This is common safety practice in, for example, laboratories and machine shops. In such a context, the additional security may be less important than the fact that if one individual is injured the other can call for help. As another example, firefighters operating in a hazardous environment (i.e., interior structure fire, HAZMAT zone, also known as IDLH, or "immediately dangerous to life or health") function as a team of at least two personnel. There is commonly more than one team in the same environment, but each team operates as a unit.
Dual keys require the authorization of two separate parties before a particular action is taken. The simplest form of dual key security is a lock that requires two keys to open, with each key held by a different person. The lock can only be opened if both parties agree to do so at the same time. In 1963, Canada accepted having American W-40 nuclear warheads under dual key control on Canadian soil, to be used on the Canadian BOMARC missiles.
Similarly, many banks implement some variant of the two-person rule to secure large sums of money and valuable items. Under this concept, unlocking the vault requires two individuals with different keys if the vault is secured by a key lock system. For bank vaults secured by combination locks, two or more employees may each be given a portion of the combination. None of them knows the entire combination, and all of them must be physically present in order to open the vault.
As an extension of the broader rationale for the two-person rule, regulations for some companies or not-for-profit organizations may require signatures of two executives on checks. These rules make it harder for an individual acting alone to defraud the organization.
Some software systems enforce a two-person rule whereby certain actions (for example, funds wire transfers) can only take place if approved by two authorized users. This helps prevent expensive errors, and makes it more difficult to commit fraud or embezzlement. While such requirements are common in financial systems, they are also used in controls for critical infrastructure, such as nuclear reactors for electrical power generation, and dangerous operations, such as biohazard research facilities.
Finally, the testimony of two witnesses is valuable in various situations to deter a wrongful act or a false accusation of one, or to prove that a wrongful act occurred.
In some correctional facilities, inmates may be given a two-person rule designation, which means that a minimum of two correctional officers must be utilized to move that particular inmate, primarily due to disciplinary reasons or possible officer safety issues.
In late March 2015 many civil aviation authorities and/or airlines made the cockpits of aircraft in flight mandatory "two-person" or "no-lone zones" as a result of the Germanwings Flight 9525 crash. [8] [9] [10] [11] [12] Early on in the investigation of that crash, it was believed from the cockpit voice recorder audio, and later supported by flight data recorder information, that the co-pilot deliberately crashed the aircraft after locking the cockpit door when the captain left to use the toilet. [13]
 |
After the September 11 attacks, there was an immediate call to action regarding the state of aviation security measures as the hijackers involved in 9/11 were able to successfully pass through security and take command of the plane. The existing security measures flagged more than half of the 19 hijackers in 9/11; however, they were cleared to board the plane because their bags were not found to contain any explosives. In the months and years following September 11, 2001, security at many airports worldwide were reformed to deter similar terrorist plots.
In physical security and information security, access control (AC) is the selective restriction of access to a place or other resource, while access management describes the process. The act of accessing may mean consuming, entering, or using. Permission to access a resource is called authorization.
Communications security is the discipline of preventing unauthorized interceptors from accessing telecommunications in an intelligible form, while still delivering content to the intended recipients.
A permissive action link (PAL) is an access control security device for nuclear weapons. Its purpose is to prevent unauthorized arming or detonation of a nuclear weapon. The United States Department of Defense definition is:
A device included in or attached to a nuclear weapon system to preclude arming and/or launching until the insertion of a prescribed discrete code or combination. It may include equipment and cabling external to the weapon or weapon system to activate components within the weapon or weapon system.
The Single Integrated Operational Plan (SIOP) was the United States' general plan for nuclear war from 1961 to 2003. The SIOP gave the President of the United States a range of targeting options, and described launch procedures and target sets against which nuclear weapons would be launched. The plan integrated the capabilities of the nuclear triad of strategic bombers, land-based intercontinental ballistic missiles (ICBM), and sea-based submarine-launched ballistic missiles (SLBM). The SIOP was a highly classified document, and was one of the most secret and sensitive issues in U.S. national security policy.
The nuclear football is a briefcase, the contents of which are to be used by the president of the United States to communicate and authorize a nuclear attack while away from fixed command centers, such as the White House Situation Room or the Presidential Emergency Operations Center. Functioning as a mobile hub in the strategic defense system of the United States, the football is carried by a military aide when the president is traveling.
The Hughes AIM-47 Falcon, originally GAR-9, was a very long-range high-performance air-to-air missile that shared the basic design of the earlier AIM-4 Falcon. It was developed in 1958 along with the new Hughes AN/ASG-18 radar fire-control system intended to arm the Mach 3 XF-108 Rapier interceptor aircraft and, after that jet's cancellation, the YF-12A. It was never used operationally, but was a direct predecessor of the AIM-54 Phoenix used on the Grumman F-14 Tomcat.
From the 1960s to the 1990s, South Africa pursued research into weapons of mass destruction, including nuclear, biological, and chemical weapons under the apartheid government. South Africa’s nuclear weapons doctrine was designed for political leverage rather than actual battlefield use, specifically to induce the United States of America to intervene in any regional conflicts between South Africa and the Soviet Union or its proxies. To achieve a minimum credible deterrence, a total of six nuclear weapons were covertly assembled by the late 1980s.
Controlled Cryptographic Item (CCI) is a U.S. National Security Agency term for secure telecommunications or information handling equipment, associated cryptographic component or other hardware item which performs a critical communications security (COMSEC) function. Items so designated may be unclassified but are subject to special accounting controls and required markings.
The United States was the first country to manufacture nuclear weapons and is the only country to have used them in combat, with the bombings of Hiroshima and Nagasaki in World War II. Before and during the Cold War, it conducted 1,054 nuclear tests, and tested many long-range nuclear weapons delivery systems.
The United States government classification system is established under Executive Order 13526, the latest in a long series of executive orders on the topic of classified information beginning in 1951. Issued by President Barack Obama in 2009, Executive Order 13526 replaced earlier executive orders on the topic and modified the regulations codified to 32 C.F.R. 2001. It lays out the system of classification, declassification, and handling of national security information generated by the U.S. government and its employees and contractors, as well as information received from other governments.
Launch on warning (LOW), or fire on warning, is a strategy of nuclear weapon retaliation where a retaliatory strike is launched upon warning of enemy nuclear attack and while its missiles are still in the air, before detonation occurs. It gained recognition during the Cold War between the Soviet Union and the United States. With the invention of intercontinental ballistic missiles (ICBMs), launch on warning became an integral part of mutually-assured destruction (MAD) theory. US land-based missiles can reportedly be launched within 5 minutes of a presidential decision to do so and submarine-based missiles within 15 minutes.
The possession and acquisition licence is the primary firearms licence under Canadian firearms laws. The PAL is the only licence issued to new adult firearms licence applicants in Canada; it is both required and the only permissible document for a person to acquire or permanently import a firearm. Applicants for a PAL must be 18 years of age or older.
A nuclear briefcase is a specially outfitted briefcase used to authorize the use of nuclear weapons and is usually kept near the leader of a nuclear weapons state at all times.
United Nations Security Council Resolution 1718 was adopted unanimously by the United Nations Security Council on October 14, 2006. The resolution, passed under Chapter VII, Article 41, of the UN Charter, imposes a series of economic and commercial sanctions on the Democratic People's Republic of Korea in the aftermath of that nation's claimed nuclear test of October 9, 2006.
On 29 August 2007, six AGM-129 ACM cruise missiles, each loaded with a W80-1 variable yield nuclear warhead, were mistakenly loaded onto a United States Air Force (USAF) B-52H heavy bomber at Minot Air Force Base in North Dakota and transported to Barksdale Air Force Base in Louisiana. The nuclear warheads in the missiles were supposed to have been removed before the missiles were taken from their storage bunker. The missiles with the nuclear warheads were not reported missing and remained mounted to the aircraft at both Minot and Barksdale for 36 hours. During this period, the warheads were not protected by the various mandatory security precautions for nuclear weapons.
The Army Strategic Forces Command is a strategic and missile formation of the Pakistan Army. Headquartered at the Joint Staff HQ in Chaklala near Rawalpindi, the strategic command controls the land-based ballistics and cruise missile systems—both nuclear and conventional.
Harold L. Hering is a former officer of the United States Air Force, who was discharged in 1975 for requesting basic information about checks and balances to prevent an unauthorized order to launch nuclear missiles. Hering was subsequently presented the 2017 Courage of Conscience Award at the Peace Abbey, Boston, Massachusetts.
The Mark 26 Guided Missile Launching System (GMLS) was a United States Navy fully automated system that stows, handles, and launches a variety of missiles. The system supported RIM-66 Standard, RUR-5 ASROC, and potentially other weapons. The Mark 26 had the shortest reaction time and the fastest firing rate of any comparable dual arm shipboard launching system at the time. With only one man at the control console, a weapon can be selected, hoisted to the guide arm, and launched. Several mods provided magazine capabilities of 24 to 64 missiles.
Germanwings Flight 9525 was a scheduled international passenger flight from Barcelona–El Prat Airport in Spain to Düsseldorf Airport in Germany. The flight was operated by Germanwings, a low-cost carrier owned by the German airline Lufthansa. On 24 March 2015, the aircraft, an Airbus A320-211, crashed 100 km north-west of Nice in the French Alps, killing all 150 occupants.
| Authority control databases: National |
|---|
