Two-person rule
The two-person rule is a control mechanism designed to achieve a high level of security for especially critical material or operations. Under this rule, access and actions require the presence of two or more authorized people at all times.
United States: nuclear weapons[edit]
Per US Air Force Instruction (AFI) 91-104, "the two-person concept" is designed to prevent accidental or malicious launch of nuclear weapons by a single individual.[1]
In the case of Minuteman missile launch crews, once a launch order is received, both operators must agree that it is valid by comparing the authorization code in the order against a Sealed Authenticator (a special sealed envelope containing a verification code). These Sealed Authenticators are stored in a safe which has two separate locks. Each operator has the key to only one lock, so neither can open the safe alone. Also, each operator has one of two launch keys; once the order is verified, they must insert the keys in slots on the control panel and turn them simultaneously. As a further precaution, the slots for the two launch keys are positioned far enough apart to make it impossible for one operator to reach both of them at once. For additional protection, the missile crew in another launch control center must do the same for the missiles to be launched. A total of four keys are thus required to initiate a launch.
On a submarine, both the commanding officer and the executive officer must agree that the order to launch is valid and then mutually authorize the launch with their operations personnel. Instead of another party who would confirm a missile launch as in the case of land-based ICBMs, a third officer – the Weapons Officer – must also confirm the launch. In addition, the set of keys is distributed among the key personnel on the submarine, and the keys are kept in safes (each of these crew members has access only to their key). Some keys are stored in special safes on board which are secured by combination locks. Nobody on board has the combination to open these safes; the unlock key comes as a part of the launch order (Emergency Action Message) from the higher authority.[2]
Journalist Ron Rosenbaum has pointed out that, once the order is issued, the process is entirely concerned with authenticating the identity of the commanding officers and the authenticity of the order, and there are no safeguards to verify that the order or the person issuing it is actually sane.[3] Notably, Major Harold Hering was discharged from the Air Force for asking the question, "How can I know that an order I receive to launch my missiles came from a sane President?"[3]
The two-person rule only applies in the missile silos and submarines; there is no check on the US president's sole authority to order a nuclear launch.[4]
Two-person integrity (TPI) is the security measure taken to prevent single-person access to COMSEC keying material and cryptographic manuals. TPI is accomplished as follows:[5]
At no time can one person have in their possession the combinations or keys to gain lone access to a security container or cryptographic equipment containing COMSEC material. Neither can one person have sole possession of COMSEC material that requires TPI security.[5]
No-lone zone[edit]
A no-lone zone is an area that must be staffed by two or more qualified or cleared individuals at all times.[6] The individuals must maintain visual contact with each other and with the component(s) that require the no-lone-zone area designation. Such a zone may contain a cryptographic component, weapon system hardware under test, a nuclear weapon, active weapon controls, or other such critical information or devices.
In the United States Air Force (USAF) policy concerning critical weapons, a no-lone zone is an area for which entry by a single unaccompanied individual is prohibited. The two-person concept requires the presence of at least two individuals knowledgeable of the task(s) to be performed; in addition, each individual must be capable of detecting an incorrect or unauthorized procedure on the part of any others regarding the task(s).[7]