In November 2017, for the first time in 41 years, the U.S. Congress held a hearing to consider changes to the president’s authority to launch nuclear weapons. Although Senator Bob Corker of Tennessee, the Republican chair of the Senate Foreign Relations Committee, insisted that the hearing was “not specific to anybody,” Democrats used the opportunity to air concerns that President Donald Trump might stumble into nuclear war. After all, he had threatened to unleash “fire and fury” on North Korea, and he subsequently boasted in a tweet about the size of the figurative “nuclear button” on his desk in the Oval Office. General C. Robert Kehler—a former head of U.S. Strategic Command, the main organization responsible for fighting a nuclear war—tried to calm senators’ fears about an irresponsible president starting such a war on a whim. He described how the existing process for authorizing the launch of nuclear weapons would “enable the president to consult with his senior advisers” and reminded the senators that officers in the chain of command are duty-bound to refuse an illegal order.

What Kehler could not assure the senators, however, was that the process that enabled the president to seek the concurrence of the secretary of defense or senior officers actually required him to do so, or even required that he consult with advisers. Nor could he assure them that officers receiving a launch order would dare to assert their own judgment over his about its legality, or that the president would listen to them if they did. When asked by Senator Ben Cardin, a Democrat from Maryland, whether the president could ignore a military lawyer’s advice that an order to launch a nuclear attack was illegal, Kehler said that would present “a very interesting constitutional situation.” He continued: “I would say, ‘I have a question about this, and I’m not ready to proceed.’” Pressed by Cardin about what would happen next, Kehler responded, “Well, I don’t know.” The implication was worrisome: although common sense and careful official planning dictate a process to prevent an imprudent and impulsive president from starting a nuclear war, there is nothing stopping a determined president from overriding it.

Details of the current nuclear launch process are classified, but in general, they are designed to ensure that the president can quickly order a launch. That’s why wherever the president goes, he is accompanied by a military officer carrying the “football,” a briefcase containing strike options and codes used for communicating with the chain of command and confirming that an order is authentic. Once an order is issued, it reaches officers manning the missile silos, bombers, and submarines responsible for carrying out an attack. Before issuing the order, however, the president is expected to confer in person or over a secure line with senior military and civilian advisers. But that is merely assumed. The secretary of defense has no formal role in the authorization, and the president can bypass him if he wishes.

That needs to change: any presidential order to launch nuclear weapons that is not in response to an enemy nuclear attack should require the concurrence of the secretary of defense and the attorney general. This reform is not aimed at a particular president; it addresses a problem that could arise in any administration. Moreover, adding these checks would not only limit the commander in chief’s power but also buttress it, protecting the launch process from interference by unauthorized parties.

A missile silo at Vandenberg Air Force Base in California, July 2007. Kacper Pempel / Reuters

CONSTRAINING AND CONFIRMING

There are two sets of scenarios in which a U.S. president might order a nuclear strike. The first is relatively straightforward and uncontroversial: launching a retaliatory attack after or during an enemy nuclear attack. In that case, given the need to respond quickly, the commander in chief’s power should remain unhampered. The concern arises when considering the other set of scenarios: the first use of nuclear weapons, either as an initial knockout blow or during the course of a conventional war. What if the commander in chief ordered such an attack without sufficient cause, consultation, or legal justification?

Starting a nuclear war is the most momentous national security decision imaginable. Some observers have called for a ban on nuclear first use altogether, and the Obama administration considered declaring a no-first-use policy near the end of its second term. But for better or worse, U.S. and NATO strategic doctrine has always rested on this option (originally, to counter the Soviets’ perceived superiority in conventional forces), and there is no consensus for taking it off the table.

In the event that the president wanted to be the first in a conflict to use nuclear weapons, two procedural problems could arise: insufficient deliberation and insubordination. On the one hand, the president might order a launch without adequate consideration or without consulting responsible advisers, and the military chain of command might simply comply. On the other hand, he might order a launch and officers might refuse to comply, either doubting the order’s authenticity or resisting it on moral or other grounds. Either possibility is dangerous. The first risks unnecessary and catastrophic escalation. The second may seem less dangerous—to some it may even seem desirable—but a refusal by uniformed officers to comply would deeply damage the hallowed norms of civilian control of the military. Currently, if the president orders a launch, there are technical means to ensure the authenticity of the order, but the system is not designed to deal with an order that appears to be irrational. Relying on ad hoc disobedience of orders of questionable legality is not the right solution to this problem, since it is both unreliable and fraught with bad constitutional and policy implications.

A third and very different problem—the possibility of unauthorized parties tampering with the system to inject a false launch order or block a legitimate one—has received less attention. Such a problem is unlikely. The U.S. nuclear command-and-control system has been carefully designed with redundant bulwarks against imaginable accidents—but so have nuclear power plants, and still there were unanticipated disasters at Three Mile Island, Chernobyl, and Fukushima, all of which would pale in comparison to a single mistaken use of nuclear weapons. When it comes to nuclear weapons, even extremely low odds of a mistake should be reduced in any reasonable way possible. Whether an unauthorized launch stemmed from an unhinged military aide in charge of the football, unforeseen technical glitches that accidentally mimicked a presidential order, malicious hackers who managed to penetrate the command-and-control system, or malfunctioning sensors that generated false warnings of an attack, a requirement that officials in addition to the president sign off on a nuclear launch would serve as a valuable safeguard. It would make it harder for a wayward president, a provocateur, or a malfunction to start a nuclear conflagration, while preserving the president’s option to fire nuclear weapons first when sensible officials consider it necessary.

Given the deficiencies in the existing process, it is time to add new checks for nuclear first use: certification from the secretary of defense that a given order is valid (meaning definitely from the commander in chief) and from the attorney general that it is legal (that is, within the president’s authority and proper legal bounds). Requiring written confirmation from the secretary of defense that the president has, in fact, commanded a launch would supplement the existing technical means for ensuring an order’s authenticity. More important, it would guarantee the secretary’s involvement in the decision-making. Requiring written confirmation from the attorney general that an order is legal—or, alternatively, that there has been a meaningful review of the order’s legality—would further widen the circle of cabinet-level discussion. For both officials, provisions would need to be made for alternates to perform their roles when needed.

It is time to add new checks to the process for nuclear first use.

These proposed requirements could be implemented either by the executive branch, through an executive order, or by the legislative branch, through a new law. The executive-branch route would be more politically and legally palatable to those who oppose legislative restrictions on presidential decision-making or fear that it would lead to further congressional meddling. True, executive orders can be waived by the president, but once it was institutionalized in two cabinet departments, it would be difficult to undo this requirement quickly and without raising major alarms internally.

Codifying these requirements instead through legislation would have virtues and risks. For one thing, statutory requirements would give commanders below an irrational president greater confidence to resist an unjustified launch order. There is, however, a danger that even if such a statute were not watered down during the legislative process, the executive branch might label it unconstitutional and announce that it would refuse to be bound by it, at least in certain circumstances. The legal issues raised by such a law are unlikely to ever be resolved by the courts, which have tended to punt on tough questions about war powers and leave them to the other branches. That said, the executive branch often adopts practices mandated by Congress even without conceding its legal position. (For example, presidents regularly submit notifications to Congress about the use of U.S. forces, as required by the 1973 War Powers Resolution, even when questioning the constitutionality or applicability of the law.) If Congress did pass reforms to the nuclear launch process, it should be prepared to exercise firm oversight and, if necessary, use its other powers, such as threatening to withhold certain funding, to ensure that the executive branch followed through.

Adding new certifications to the launch process should appeal to a broad range of opinions—both of those who want to move toward a ban on first use and of those who are worried about the credibility of U.S. nuclear deterrence, including whether the command-and-control system will function as intended in crises. The fact that the safeguards would both constrain and empower the president as commander in chief should increase the odds of a viable political coalition for reform. Still, the proposal would no doubt be controversial. But the most likely criticisms do not hold up.

Trump and White House Chief of Staff John Kelly at the White House, January 2018. Yuri Gripas / Reuters

IS THIS REALLY A PROBLEM?

The first criticism of additional checks is that they represent a solution to a problem that does not exist. Granted, the image of a president simply pushing a button to launch hundreds of missiles at a moment’s notice, unchallenged, is naive. And although the details of command and control are classified, some of the most informed critics of reform insist that consultation and concurrence are solidly built into the standard operating procedure. As a practical matter, however, senior officials might not be immediately available when called on to confer with the president, a problem that has come up in past exercises and false-warning incidents. More to the point, the president can change or revoke the procedural plans that his subordinates have designed, reject the counsel of top advisers, or issue orders directly to officers in the chain of command—who in some circumstances could be no more senior than a colonel.

Officers are bound to disobey orders that are obviously illegal, but when the legality of a command seems uncertain, they are not expected to resist. Officers might be especially inclined to defer to the commander in chief in a crisis or even merely in a situation of increased tension, when an order for action, however unwise it may sound, would not seem to be a completely nonsensical bolt from the blue. (The current strain with North Korea represents just such a situation.) If the president said that the United States needed to launch an anticipatory first strike to prevent an enemy attack that could kill many Americans, there is no guarantee that officers of any rank would assert that their interpretation of the law should take precedence over his. Besides, those who count on officers in the chain of command to resist illegal nuclear orders rarely consider what that would mean the day after, for presidential authority over the military or for the credibility of the nuclear deterrent.

If a four-star general who headed U.S. Strategic Command does not know what would happen if the president insisted on a suspect order, as Kehler admitted, then there certainly is a problem. And some of the most knowledgeable civilian experts on command-and-control procedures—such as Bruce Blair, a scholar at Princeton (and former missile launch control officer in the U.S. Air Force), and Scott Sagan, a political scientist at Stanford—are firmly convinced that the current system is inadequate. The current reliance on the president’s optional consultation with top advisers is only a speed bump in slowing a precipitous launch authorization. What’s needed is a circuit breaker. Lengthening the time in which an irrational launch order could be held up, as required certification by the secretary of defense and the attorney general would do, would buy time for the most extreme solution, if it appeared necessary: the as-yet-untested process, authorized by the 25th Amendment, by which cabinet officers can legally remove a president who has gone off the deep end.

What about the opposite problem—that unauthorized parties could manage to block the legitimate use of nuclear forces? It’s hard to know how significant that risk is. But even if the current system is immune to such interference—and to the similar danger of an unforeseen malfunction—there is no guarantee that it will remain so, especially in the age of rapidly evolving technology and burgeoning failures in cybersecurity. The record in military history of disastrous surprises that had been considered impossible before the fact does not inspire confidence.

TYING THE PRESIDENT’S HANDS?

A second line of criticism contends that these reforms would dangerously tie the president’s hands. Skeptics fear that even a short lag in the process could give an enemy an advantage, whether during a tense standoff or in the course of a conventional conflict. It’s important to remember, however, that the measures would apply only to first use, meaning that there is no risk that a president would be unable to retaliate quickly against an enemy nuclear attack in progress.

That said, the one situation in which additional steps in the process could present a problem would be if a president felt it necessary to launch a preemptive nuclear strike—that is, one intended to interdict an imminent attack by an enemy making immediate preparations for nuclear war. It’s important to distinguish this from a preventive war, one waged in anticipation of a possible enemy attack sometime in the future. Preventive wars are almost never a good idea, given the uncertainty about whether the threat will ever come to pass, and because they are usually seen by the rest of the world as aggression, not defense. A nuclear one started by the United States, inflicting epochal devastation without immediate provocation, would brand the country as an international outlaw.

A preemptive attack, in contrast, could be more legitimate, since if an enemy attack really was about to begin, a U.S. first strike might block the damage it could inflict. Preemption is still very risky, however, since it may be impossible in the heat of a crisis to determine whether the enemy’s war preparations are intended for offense or defense. Figuring out which mistake is the greater risk—launching an unnecessary attack or falling victim to aggression—has long been a central strategic dilemma for decision-makers.

During the Cold War, the United States handled the dilemma by constructing a nuclear force capable of surviving a first strike and firingback effectively, creating a sense of certain retaliation, which would make Moscow refrain from initiating a nuclear attack under any circumstances, since it knew that doing so would be suicidal. Thus, there would be no need for preemption, even in a crisis. No strategy is foolproof, but such deterrence should still work today, even against a reckless adversary such as the North Korean leader Kim Jong Un, who, for all his bluster, still wants to stay in power (and alive).

If U.S. intelligence did report a major increase in the readiness of North Korean forces, the argument for a preemptive strike would grow stronger, but should not override the reasons for nuclear restraint. Rather, policymakers should make an effort to maximize the capabilities for preemption with conventional forces. Doing so may require technical and operational innovations, along with the deployment of additional forces near the scene in peacetime, and it would raise the risk of failing to destroy 100 percent of the enemy’s arsenal. But the alternative risk—starting an unnecessary nuclear war—is worse.

A U.S. B-52 bomber takes off from an airbase in Gloucestershire, England, March 2003. Darren Staples / Reuters

UNCONSTITUTIONAL?

The third likely criticism would come from those who believe that limiting the president’s nuclear authority—if done through legislation—would violate the Constitution. Imposing conditions on his authority to direct military officials and exercise tactical and operational control over U.S. forces, the argument runs, would encroach on his executive powers, including as commander in chief.

But the proposed requirements are justifiably within Congress’ authority. The Constitution gives Congress the power to declare war and regulate the military, provisions that arguably include the power to place limits on when the president may resort to nuclear first use. New requirements would also raise separate concerns about encumbering the president’s direct command of military forces or intruding on his power to determine how to conduct military operations, but Congress may arguably legislate measures such as these to ensure that the president’s commands are lawfully and properly carried out, without taking military options completely off the table. In the past, the enormous stakes of nuclear decision-making were used to justify expanded presidential powers, but today, the better argument is that the special challenges of nuclear decisions justify giving Congress some authority to regulate them.

To be clear, this proposal leaves open many constitutional and legal questions. Under what circumstances may a president resort to a nuclear first strike without explicit authorization from Congress? What international law applies to a proposed strike, and how should it be interpreted in the context at hand? But the aim right now should not be to answer such questions definitively; rather, it should be to ensure that before a nuclear attack is launched, the answers are carefully considered, formalized, and communicated reliably down the chain of command. Instead of settling the thorny questions in advance, they would be left for the attorney general to answer when certifying the legality or legal review of a given proposed attack. Moreover, merely institutionalizing this process of requiring the attorney general’s official opinion would allow time for reconsideration. And in the event that the attorney general refused to certify that a strike was legal, the process would give the chain of command the confidence needed to resist an irrational president who wished to start a nuclear war without reasonable grounds. In other words, it would put insubordination on firmer legal footing, should it come to that.

THE BALANCE OF RISKS

Requiring additional checks for the first use of nuclear weapons would serve as a hedge against a low-probability, high-consequence event: an impetuous commander in chief lurching into catastrophe. At the same time, it would help guard against interference by hostile parties seeking to sabotage the chain of command, and it would improve decision-making and implementation in the very unlikely event that a nuclear first strike were truly necessary. Political and legal opposition to this proposal will inevitably be strong. Much of that will concern the question of the extent of the president’s war powers, but merely adding a delay to the process for first use does not require resolving this long-standing constitutional debate. If only by ensuring and formalizing deliberation, these reforms would buy time for responsible officials to take action. And although critics will inevitably point to the political, strategic, and legal risks of this proposal, the problem of an inadvertent nuclear war has no risk-free solution. Adding new steps to the authorization process would balance these risks better than the current system does.

Questions about how and when to use nuclear weapons may seem like an academic relic of the Cold War era, a time when they consumed defense planners. Indeed, after the Soviet Union collapsed, such questions faded away as smaller security problems took center stage. But now, as tensions grow with the established nuclear powers of China and Russia and with the new nuclear power of North Korea and the potential one of Iran, such debates have returned to the fore. As the United States adapts its nuclear strategy to the twenty-first century, it should adapt its nuclear decision-making procedures, too. The founders put a high premium on checks and balances out of a healthy appreciation for the limits of any individual’s virtue or wisdom. There is every reason to apply this logic to the process of starting a nuclear war—the ultimate presidential power.