I’m going to declare this up front: I have no private knowledge about this topic; my beliefs are formed by a lot of study of the topic since 1978, a lot of strategy gaming, and a lot of news reading. Naturally, any commentary about nuclear strategy is going to be either a) ignorant except for open source material or b) muzzled by secrecy. I.e.: Those that talk about this stuff are ignorant, those that aren’t ignorant are silent.

This is a re-distillation of a conversation I had with Mike P via txt messages, regarding the situation in Ukraine. Or, should I say, the situation in Russia? Either way, it’s a situation. And the question is, “what if Russia goes nuclear?” [stderr] [stderr]

Simple: Russia gets obliterated.

Obviously, that’s a pretty brazen claim. There’s lots of “but, what?” and that is where I’ll spend most of my time. My reasoning is based on two premises, either one of which can be accurate to give the result I projected above. The first premise is that the Russian strategic deterrent is no longer credible. The second premise is that the US has been preparing to win an offensive nuclear war for some time. I have mentioned the second premise multiple times in this blog, but I will repeat a few of my points in this posting, and will present that argument in the context of an actual strike on Russia, as well as in the context of Russia attempting a first strike, which I think is unlikely to succeed.

When I say that Russia’s strategic deterrent is no longer credible, I mean that there’s a pretty good chance that if the Russians start preparing to launch a first strike, their strategic arsenal and the commanders of their strategic arsenal, especially what we in the US call “national command authority” will suffer a massive, sudden, existence failure. There are multiple reasons and we should all approve of that – the US approach toward intelligence, system compromise, and attack has always been centered around “throwing everything at the wall and see what sticks” combined with overkill. In the 70s, when I first got interested in this problem, the paradigm was quite different – the assumption was that enemy strategic arsenal would all work properly. It was a reasonable, conservative assumption for that time. One reason it was a safe assumption at the time was because both the US and USSR were investing heavily in their strategic weapons at that time, and they were fairly new. They were also under constant testing and development. Since that time, both the US and Russia have made significant changes to their weaponry spend – the US continuing to ramp up its expenditures until it spends more than almost the rest of the world, combined – and Russia continuing to spend like the second-rate power it is, less than $100bn annually. That includes strategic nuclear weapons as well as conventional forces. Compared to the US expenditure of close to $1tn annually ($790bn on military, $300bn? on intelligence). If we were to characterize this as an “arms race” it would look like the US lapping Russia 7 times every year since the 90s. It is a ridiculous expenditure, representing a completely out of control military/imperial agenda, but for this argument, it is what it is. Even if the US is not getting what it’s paying for, maybe it’s only lapping Russia 5 times/year, or something like that. So what? The question of whether the US expenditure is successfully increasing preparedness to win a nuclear war is something we will discuss later.

For now, let’s observe that the Russian military may be proportionally corrupt with the US military. It’s probably worse – remember: we have spent ridiculous amounts of money on things like F-35s and anti-missile systems and, in true pentagon style, the anti-missile systems and F-35s don’t have to actually work very well to completely smash the shit out of late 1980s Russian tech. We can see this writ plain in Ukraine – Russia’s T-90 main battle tanks are faring badly against well-targeted artillery and man-portable anti-tank guided missiles (ATGM) and their command/control systems are, frankly, pathetic. The Russian army in Ukraine, which included (until they got killed) special forces elite units, hasn’t got night vision capability and now they are fielding tanks that date, literally, from the 1960s. The proof, as they say, is in the pudding – and the pudding says Russia can’t even bear to think about the idea of Challenger and Leopard tanks with depleted uranium silver dart rounds poking holes in their T-90s from miles away. Russia’s legendary Armata next-generation tank turns out to be mostly a bunch of powerpoint slides – whereas the Challengers and Leopards and Abrams tanks being moved into Ukraine are mostly NATO’s worn out gear. Worn out through a decade and a half of REFORGER maneuvers and practice. Cycle that back to Russia’s military expenditures: NATO has been spending more money every year practicing to wipe out Russia than Russia spends on its military in toto. And, it shows. Russia’s manifest command/control incompetence such as creating a great big lined-up parking lot of tanks, APCs, and trucks, is an example of how effectively the Russian military has been practicing since the 90s when the cold war ended. The T-14 Armata main battle tank apparently exists in deployable quantity: ~100. Probably way less: [wik]

The Russian Army initially planned to acquire 2,300 T-14s between 2015 and 2020. By 2018, production and fiscal shortfalls delayed this to 2025, before Russia announced the apparent cancellation of the main production run on 30 July 2018. However, as of 2021, the Russian state-owned TASS media agency claimed the Armata had been expected to begin serial production in 2022, with delivery of a test batch of 100 to the 2nd Guards Tamanskaya Motor Rifle Division expected to begin in 2022. The tanks are planned to only be officially transferred following completion of all state tests. In December 2021 the Russian state conglomerate Rostec stated that serial production had commenced, with “more than 40” Armata tanks anticipated to be delivered to Russian troops after 2023.

The Armata is merely emblematic of the problem. Arguably, it’s not even a “state of the art” main battle tank – but more significantly, the Russians aren’t training with it, shaking out the bugs, or learning how to use it effectively. The traditional Russian military way of training with new gear is to give it to relatively new crews, and send them charging at German panzers to learn things the hard way. That paradigm would work, if Russia had 5,000 Armatas, but – they don’t. And, they won’t, because the US and its allies are blockading Russian access to computer components and other technical systems for building high tech CNC machines, modern optics, and computers. It’s hard to know, because all that stuff is secret, but there’s a good chance that the Russians have been removing night vision and targeting systems from scrapped T-90s for the Armatas, because that’s all they have. And the T-90s are getting targeting systems from T-72s that have been sitting in boneyards for decades. Again, this is merely emblematic of the bigger problem that is the status of the Russian military.

When it comes to the Russian strategic nuclear forces, we learn in Ukraine that the state of the art Kalibr cruise missiles [wik] are easily shot down by NATO anti-missile systems. Even the less-than-stellar PATRIOT anti-missile systems appear to be able to take them out, on the wing. These are Russia’s sub-launchable first strike weapons, and they have depleted their supply. More exotic weapons such as the air-launched nuclear-capable Kinzhal missile – billed as “hypersonic” – are rare: [wik] Russia has 50-80 Kinzhals, and they’re not very good. A full spread launched at Kyiv, 6 missiles in all, were all shot down [reuters]. Russian build capacity for the missile is around 10/month, but they require US components. But the big “gotcha” with all of this is that the Kalibr is mostly sea-launched and the Kinzhal is air-launched and both of the launchers are easy, obvious targets. We should rest assured that the Russian Black Sea fleet is being shadowed by stealthed attack subs, and if the satellites show that they may be loading nuclear warheads, the entire Black Sea fleet will do a “synchronized sinking” exercise. Russia’s recent “new nuclear torpedo” intended to terrify US carrier task force groups, is not thoroughly thrashed out technology. Putin has been talking up a lot of not thoroughly thrashed out technology, such as the Avangard [wik] hypersonic glide vehicle. Granted, this stuff sounds scary but it’s important to focus on the reality that it’s mostly incremental changes to existing gear. Any Multiple Independent Reentry Vehicle (MIRV) warhead is going to be “hypersonic” and basically really hard to shoot down. Both the US and Russia have lots of those, but those tend to be mounted atop big, fat, ballistic missiles that are, themselves, targets. Meanwhile, the US nuclear weapons “revamp”, which really means building a whole new class of weapons, has been in progress for some time and is oriented toward increasing the precision of nuclear weapons to the point where old cold war-style overkill is less necessary. Sure, any air bases that are trying to get a bunch of Kinzhal-carrying aircraft off the runway, will get hit with more than one warhead, but it probably won’t need to be a city-killer like they were planning for in the 70s. The airport and its surroundings will cease to exist, but that’ll be the price they pay for trying to deploy a nuke. What’s interesting is that, while the Russians don’t have as much of a credible nuclear force, the US does – it may be a forward-deployed F-35 that delivers a theater nuke, or a sub-launched cruise missile, or a stealth bomber – the Russians need to worry about this, because the US has multiple axes for attack and the Russians have to worry about whether their stuff will actually work at all, let alone get there, let alone successfully trigger fusion.

Nuclear warheads are some of the most complicated things humans build. The theory behind them is sort of straightforward, but the engineering details are daunting. Not only that, they require maintenance. So do the delivery vehicles. Everything to do with nuclear weapons is insanely expensive and complicated and the Russians have not been notably investing in new technology, or maintenance. Doubtless some of the missiles will work, and so will the warheads, but – seriously – aircraft (the ultimate soft target) launched missiles? And surface ships launching cruise missiles? They’re toast the second they start to look like they are getting serious about loading “special weapons.” The Russians do the same thing the US does: they have specific, characteristic layouts for the storage of nuclear warheads, that can easily be fingerprinted by satellite [fas]. If forklifts start moving large objects from the special storage bunker to the aircraft in revetments, the sun will rise from the wrong direction.

Now, for the final bit about how Russia’s nuclear deterrent may not be credible. The US has been fairly open about its plans to win a nuclear war. Blame Kim Jong Un and Belarus, but now it’s time to talk about what the X-37B has been up to [wik] and “Conventional Prompt Strike” (formerly “Prompt Global Strike”) [wik] That’s the US strategic direction to be able to win a nuclear war by ruining an enemy before they can deploy. The stated direction is to be able to use conventional weapons, to be able to hit a target more or less in real time. Remember when the US withdrew from the medium range missile treaty because “The Russians are cheating”? Well, we were cheating, too. Of course. And developing a new version of more precise warheads and deploying them under cover of “maintenance upgrade”? Cheating. Of course the Russians said they cheated because we cheated, but it all comes down to who points a finger and screams, first. The Conventional Prompt strike probably includes spaceplane-carried conventional munitions (think of a MIRV warhead full of 1/2″ ball bearings…) or maybe, just maybe, the US is cheating and lofting a few nukes up into orbit, too. Wikipedia:

Conventional Prompt Strike, formerly called Prompt Global Strike (PGS), is a United States military effort to develop a system that can deliver a precision-guided conventional weapon airstrike anywhere in the world within one hour, in a similar manner to a nuclear ICBM. Such a weapon would allow the United States to respond far more swiftly to rapidly emerging threats than is possible with conventional forces. A PGS system could also be useful during a nuclear conflict, potentially replacing the use of nuclear weapons against up to 30% of targets. The PGS program encompasses numerous established and emerging technologies, including conventional surface-launched missiles and air- and submarine-launched hypersonic missiles, although no specific PGS system has yet been finalized as of 2018.

Remember how the US pretended to freak out when Putin started talking about hypersonic missiles? We’ve been doing that shit for years. The GW Bush administration used the “global war on terror” as a covering story to implement the ability for the US to terror strike anyone, anyplace, with conventional or nuclear weapons in under an hour.

On 18 November 2011, the first advanced hypersonic weapon (AHW) glide vehicle was successfully tested by the U.S. Army Space and Missile Defense Command as part of the Prompt Global Strike program. The missile was launched from the Pacific Missile Range Facility in Hawaii, and struck a target at the Reagan Test Site on Kwajalein Atoll, over 3,700 kilometres (2,300 mi) away, in under 30 minutes. The prototype, which incorporated technologies developed by Sandia National Laboratories, was used to gather data to assist the development of future hypersonic warheads. The AHW followed an endo-atmospheric (within earth atmosphere, at altitude below 100 kilometers) non-ballistic trajectory during the test flight. This is a crucial design feature, as following a depressed trajectory that is much lower and flatter than a normal ICBM prevents other nuclear-armed nations from mistakenly thinking the AHW is a nuclear-tipped missile.

I have mentioned this before. When the US pulled out of the medium range missile treaty because of those cheating Russians, we immediately tested out our hypersonic capabilities. The American media, mostly idiots, pretended to believe that this was a capability that apparently was developed more or less instantaneously after the withdrawal, rather than that it was the tip of an iceberg of lawyering around the treaties. “Lawyering” sounds better than “cheating” right? But think about that: real-time satellite surveillance plus 30-minute strike is a recipe for a political decapitation attack. The message for Putin or Kim is “you may order a nuclear strike but you will not live to see whether it succeeds or fails.” I actually approve of that: I believe that political leaders need to be personally placed in the front of the line for their serving of consequences when things go horribly wrong.

There is another problem for Putin and that’s a gigantic one: the US has proliferated nukes all over the place. This was one question I asked Mike P that kind of made him pause for a while:

You are Vladimir Putin and you have decided to start the nuclear war. Who do you hit?
Do you hit Germany?
Do you hit France?
Do you hit the UK?
Do you hit Italy?
Do you hit Australia?
Do you hit China?
Can you hit the US ballistic missile subs, before they hit you?

See the problem? Under the guise of NATO compatibility, the US has forward-stationed nukes all over the place. France actually has their own, and submarines, too. The UK has their own capability but reading between the lines it sounds a lot to me like British Trident subs are carrying American warheads. Did I mention that making your own nukes is expensive? It is. Letting the US station a bunch of warheads at an airfield that can handle F-16s or F-35s is “proliferation” regardless of how the US chooses to lawyer it. The US has built defense and offense in depth. It would be practically impossible to successfully strike all the places where US weapons are stored, but meanwhile it is impossible to prevent all those cruise missiles, stealth jets, and orbital platforms from delivering their message of death unto you. Contrary to American political ideology, I suspect Putin and Kim are nowhere near as crazy as they are made out to be, and they know their threats are empty. When I step back and look at the strategic situation, my conclusion is that the US has won World War 3 without firing a shot. “Checkmate, all y’all motherfuckers” is fine, so long as they respect it.

Now for the last piece of the puzzle, where I have to play the role of optimist. For all that I complain about the CIA and NSA, I do believe those organizations show flashes of brilliance and foresight. Some of the tricks that they pull are truly brilliant. [In another posting I mentioned the story of the Xerox machines that had a hard drive in them, which stored a copy of every document that was scanned. Scheduled maintenance calls were when the hard drive was swapped out.] Those organizations have had decades of massive budgets and access to the best, brightest, and sneakiest technologists in the US. The NSA’s charter, all along, has been to compromise hostile (and friendly, to be frank) communications. This, they do quite well. I think it’s a safe assumption that every communications technology, and quite a few of the communicators, in Putin and Kim’s command/control stack are compromised to some degree or another. And large-scale compromises like I am talking about amount to a pretty effective sensor-web. If there are HUMINT, COMINT, and SATCOM collections all directed at Putin’s command/control, I think it’s pretty unlikely that he’d be able to order a Russian nuclear strike without getting a warning phone call on the red line, “Vlad, please don’t do that.” Putin also has heard of Prompt Global Strike. Can he get far enough in 30 minutes? I’m not saying, exactly, that I expect Putin to be deterred – more like destroyed. After all, the US’ intelligence sensor-web is large enough and widespread enough that the order simply might not happen because the command node that would give the order has suddenly gone offline.

NSA’s modus operandi is to develop layered capabilities, in depth. They don’t just figure out how to tap your command/control, they figure out how to disable it. Or, perhaps edit it on the fly. It’s probably too science fiction-y to imagine Putin ordering a launch, and everyone downstream from that order gets “please report your readiness status.” But consider this: the Russian command/control systems would have to be more or less completely free of US made components and software. When I say the NSA develops layered capabilities, let me give an example: the processors may have come from Intel (or Fairchild, Motorola, MIPS, Qualcomm) and if so, there could quite easily be a spare processor on the silicon. Don’t believe me? Researchers found an encoded instruction set embedded in the CPUs for set-top boxes. [youtube] If you want to get an idea of the kind of hijinks US intelligence can get up to, watch that video. It will also give you some understanding of why the US is so passionately concerned about Huawei 5G gear and wireless gear. The backdoor in the set-top CPU is an early example, the newer stuff is much smoother. For example, every single Intel CPU since around 2008 has “Intel Management Engine” (IME) embedded on the chip. The cover story for IME is fascinating: it’s a system administration tool for data centers. Uh, yeah. It is. It’s also a backdoor. While your computer is running along doing all the stuff you think it’s doing, it’s also got a coprocessor on the die which is running a full version of MINIX operating system with a complete IP stack and it’s bus-mastering. Legitimately, this would make a great administrative tool except Intel did it without mentioning it to anyone, and only started talking about its utility as an administrative tool after someone found it and started asking questions. [youtube] By the way, IME can access cryptographic secrets stored in the TPU.

I’ve got to say, it makes me think “those guys sure have looked at Huawei stuff with a fine toothed comb…” [I believe the origin of that expression is regarding catching lice, which is exactly the point] But it’s worse than that – operating systems all have gigantic backdoors into kernel mode in the form of device drivers. So it’s not that Microsoft needs to install a backdoor, or Linux needs a backdoor – your system needs a graphics adapter or network interface that can potentially also interface with other stuff. And, again, it’s bus mastering. [youtube] This stuff is like black magic when it blows up in your face. One time at CANSEC West, I saw a demo from a guy who had found an exploitable buffer overrun in the driver for a smart antenna controller embedded in a certain smart phone; the demo was an exploit of the bug in the form of a single packet sent to the phone, which exploited the overrun, created a process in the phone’s process table (right: the antenna has bus mastery) set it running with uid=0, and connected its input/output to a TCP stream. Instant remote control of a phone, if it had that specific antenna controller, which about 12 million phones did at the time. That hole in the driver was an accidental one. What if the NSA leaned on someone to add a better one? They do that all the time. [arstechnica]

Officials from RSA Security are advising customers of the company’s BSAFE toolkit and Data Protection Manager to stop using a crucial cryptography component in the products that were recently revealed to contain a backdoor engineered by the National Security Agency (NSA).

An advisory sent to select RSA customers on Thursday confirms that both products by default use something known as Dual EC_DRBG when creating cryptographic keys. The specification, which was approved in 2006 by the National Institute of Standards and Technology (NIST) and later by the International Organization for Standardization, contains a backdoor that was inserted by the NSA, The New York Times reported last week. RSA’s advisory came 24 hours after Ars asked the company if it intended to warn BSAFE customers about the deliberately crippled pseudo random number generator (PRNG), which is so weak that it undermines the security of most or all cryptography systems that use it.

That’s without thinking about the software layer. Do you write your own compilers? Linkers? Libraries? Operating systems? A modern O/S and compiler and runtime comprises millions of lines of code. Vetting them all is not an option. Nor is writing your own – because the device drivers may only be delivered in object code or executable image, and besides your GPU is also bus mastering and is, basically, a supercomputer with its own operating system. NSA’s model has always been to “attack at every possible point” [- said to me by Brian Snow, commandant of the US Cryptologic Academy] each break into the target is done and treated separately but when the time comes to launch an attack, then the synergies get mapped and everyone shows up to the dance. If you study the architecture of STUXNET you’ll see what I’m talking about: it exploits hardware bugs in electrical switches, software bugs in devices, application bugs, and kernel bugs in operating systems. It was an all-up effort and only later did the security community learn that the developers of the malware had other, deeper, stacks of digital weapons that did not even appear in the STUXNET framework. Then, there was the Vault7 leak, which revealed that the CIA had its own parallel stacks of malware that did not depend on the NSA’s and vice-versa.*

The point is that if you’re Putin, you give the order to load up the “special munition” and people are listening into the order as it goes over your wired and wireless communications, as it crosses your devices, as the officers read it off the console (which is probably jiggered, too) etc. Then, as soon as the threat is assessed and something must be done about it, the Prompt Global Strike is inbound, and all your computers brick. What if the order to launch nukes died on the vine? Next question: how do you test this, without getting yourself and all your friends killed?

With weapons systems knowing that it works is probably the single most important thing. If you are not able to be confident in your weapons, you cannot wield them – or even threaten to wield them – strategically. Worse yet, if you are relying on those weapons as a deterrent, and you cannot rely on them, they are not a deterrent they are a trap. What if Russia goes nuclear? I pity them.

* I actually spent a couple days reading through some of the Vault7 stuff. I admit I was disappointed in the journalists who had looked at it because they obviously did not understand what they were seeing. I saw things that made me very uncomfortable – for example, why would you want to be able to take over a smart TV set’s NTP server setting? [Corrected: I originally wrote “NNTP”]

[Spoiler:
Orpnhfr, vs lbh gnxr bire gur AAGC freire, lbh pna xabj gur gvzr gung rirel GI frg guvaxf vg vf. Gura, vs gur GI frg hfrf FFY rapelcgvba naq gur vzcyrzragngvba hfrf n anvir enaqbz ahzore trarengbe frrqrq jvgu gvzr(), na nggnpxre pna cerqvpg gur CEAT inyhr ng nal tvira gvzr, juvpu zrnaf gurl pna cerqvpg gur “enaqbzyl” pubfra xrlf rkpunatrq va n qvssvr-uryyzna rkpunatr ng gur ortvaavat bs na FFY frffvba.
]

Vault7 was full of stuff like that. I remember calling one of my security buddies and imitating Private Hudson from ALIENS, “We’re in some really pretty shit, man. Game over, man.”

If you really are interested in security and want to hurt your soul, go read a book called “The Huawei / Snowden Question” [wc] … Another Private Hudson moment.

A little bird told me that the reason the intelligence community was so upset when Trump shared pictures of the Iranian rocket launch failure was not because it revealed a lot about the quality of satellite targeting and imaging that was available – it was because the failure was not an accident. Trump accidentally blurted out the wrong secret. Of course, I don’t actually know if that’s true so I can blurt it out, in my ignorance.

On that last point: I was talking with a very senior CIA cold war intelligence officer who said that his wife had once asked him “why do you bother keeping some of this stuff secret? CNN just said that an airplane was shot down over Iraq and you’re keeping it secret even through CNN is talking about it.” He said, “the difference is that CNN believes a plane was shot down, but I know a plane was shot down.” OK, another funny story from the same guy: when his kid got old enough, he hold them where he worked and roughly what he did for a living. The kid said, “Oh, so you’re a spy?” and he replied, “No, I’m an intelligence officer. Spies work for me.”

CNC machines depend on computers and software. Making nuclear weapons nowadays depends on CNC machines to get the required precision in the explosive lenses. I have wondered how many explosive lenses failed, due to mysterious glitches in the CNC modeling engine. Picture Microsoft “Clippy” popping up: “You appear to be making an explosive lens, do you think it will actually work? Y/N?”

A US Abrams, UK Challenger, German Leopard MBT can track and shoot a target while moving perpendicular to it at a range of several kilometers. A T-90 can’t. An Armata might be able to if it survived more than a few seconds on the battlefield, but we don’t know how reliable its auto-leveling gun and targeting systems are. Meanwhile, in Germany: “here, hold my beer.”