THERE ARE no big red buttons in the underground bunkers, or “capsules”, that control America’s nuclear missiles. Instead, launching an intercontinental ballistic missile (ICBM) involves decrypting and verifying orders, receiving the appropriate codes and then many hands turning many keys and levers at the same time: two per officer or “missileer”, two missileers per capsule and at least two separate capsules must act in unison. The redundancies ensure that no rogue missileer or crew can fire a weapon—or block a launch.