SAGE like Forrest Gump
Lester Earnest (les at cs.stanford.edu)
2016.12.10
The SAGE
air defense system, which was initiated in the early 1950s by the Massachusetts
Institute of Technology (MIT) with funding from the U.S. Air Force, was a
technological marvel that provided the first interactive computing system for
multiple people, including the first point-and-click graphical user interface,
and the first computer network, which spanned North America and provided the
technological foundation for the Internet. Each of the 23 main vacuum tube
computers occupied the area of a football field.
SAGE was
also an operational fraud in that it didn't work against bombers that used
radar jamming, which all did since World War II. Howeve
that and other major deficiencies were kept classified so that no one could
talk about them publicly without risking jail time and this system was kept
going for 25 years for the financial gain of AT&T, IBM, GE, Boeing, Convair, Lockheed and others, resulting in the biggest
Military-Industrial-Congressional fraud of the 20th Century, which nobody talks about
now. Similar frauds are ongoing today such as the anti-ballistic missile
systems being deployed around the world.
Typical SAGE Direction Center contained a vacuum tube
computer system the size of a football field and over a hundred display
consoles on a floor the same size.
I was recruited to help
design SAGE after graduating from Caltech and completing three years service in the U.S. Navy as
an Aviation Electronics Officer, doing computerized flight simulations for
missiles and manned aircraft. I began work at MIT Lincoln Lab in late 1956 and
was assigned to share an office with Paul Sinesi.
When I asked what he did, he replied, in a proper
Boston accent, ÒI work on radaÕ dater.Ó I knew that
SAGE was supposed to automatically track aircraft movements using radar data,
so I asked ÒWhat do you do about electronic countermeasures?Ó ÒWe donÕt do
that,Ó he said.
Having been trained as an
aviation electronics officer I found that answer puzzling, since I knew that hostile
bombers normally attempt to jam radars. Being new to the organization, however,
I figured that I would later figure out how they dealt with this problem.
In fact, as I subsequently
observed, they didnÕt deal with it and carefully designed all tests and
demonstrations to avoid it. Thus SAGE was a gigantic
fraud on taxpayers in that it was a Òpeacetime defense systemÓ that would
malfunction in an actual attack, much like FranceÕs Maginot Line did in World
War II.
This presented a dilemma.
I had come to MIT because it was a hotbed of advanced computer technology
development but helping create a Military-Industrial-Congressional fraud was
unethical. Nevertheless I continued to work on SAGE
for a time and learned that it had other major defects.
á
Though MIT had
recommended that the SAGE computers be placed in hardened underground
facilities so that they would be less vulnerable to nuclear attack, in order to
save money the U.S. Defense Department decided not to
do that. Nevertheless, Canada decided to put their single Direction Center
underground.
á
MIT had also
recommended that the SAGE computer facilities be located remotely, away from
both cities and military bases, so that they would not be bonus targets. In
choosing sites for the Direction Centers, however, the leadership of the Air
Defense Command apparently looked for places with good golf courses and
Officers Clubs and, since the Strategic Air Command (SAC) was being well funded
in that Cold War era, they generally had the best facilities. Consequently, a number of SAGE facilities were placed at SAC bases where
they became bonus targets.
á
Before the SAGE
system was fully deployed, intercontinental ballistic missiles (ICBMs)
superseded manned bombers as the primary strike threat from abroad, so since
SAGE offered no defense against ICBMs it would be taken out by the first strike
and so would be useless.
These problems were widely discussed in-house at the
time but were kept secret from the public. Physicist Herman Kahn, who was
then at RAND Corp., gave classified lectures on some of these matters. Thus SAGE had several things in common with the mythical
Forrest Gump: it was very fast,
financially successful, and incredibly stupid.
As you may recall, when President Eisenhower left
office his final speech
warned about the Military Industrial Complex. Here is an excerpt that makes
this point.
In the councils of
government, we must guard against the acquisition of unwarranted influence,
whether sought or unsought, by the military industrial complex. The potential
for the disastrous rise of misplaced power exists and will persist.
We must never let the weight
of this combination endanger our liberties or democratic processes. We should
take nothing for granted. Only an alert and knowledgeable citizenry can compel
the proper meshing of the huge industrial and military machinery of defense
with our peaceful methods and goals, so that security and liberty may prosper
together.
Akin to, and largely
responsible for the sweeping changes in our industrial-military posture, has
been the technological revolution during recent decades.
In this revolution, research
has become central; it also becomes more formalized, complex, and costly. A
steadily increasing share is conducted for, by, or at the direction of, the
Federal government.
Today, the solitary inventor,
tinkering in his shop, has been overshadowed by task forces of scientists in
laboratories and testing fields. In the same fashion, the free university,
historically the fountainhead of free ideas and scientific discovery, has
experienced a revolution in the conduct of research. Partly because of the huge
costs involved, a government contract becomes virtually a substitute for
intellectual curiosity. For every old blackboard there
are now hundreds of new electronic computers.
The prospect of domination of
the nation's scholars by Federal employment, project
allocations, and the power of money is ever present and is
gravely to be regarded.
Eisenhower was being discreet in two ways:
1. He was talking mainly about SAGE but did not mention
it by name,
2. He did not mention that the financial arrangements
were sustained by a form of legal bribery in which industrial organizations gave
campaign donations to members of Congress.
Because of his discretion
and the power of the capitalist crooks who managed that ongoing fraud on
American taxpayers, no action was taken and SAGE continued operations until
1983, becoming the biggest Military-Industrial-Congressional fraud of the 20th
Century, but no one talks about it.
That is because the crooks
in charge use security classifications to prohibit whistleblowers from speaking
out without going to jail, as Edward Snowden and others have learned. Big money
also controls major media and will not allow stories to appear regarding the
ongoing frauds such as the deployment of anti-ballistic missile systems that
are being deployed around the world despite the fact that
they do not work against real ICBMs (just imaginary ones).
Back to mythology.
SAGE display consoles. The circular CRTs displayed geographical information
including landmarks as well as aircraft locations and identities. Each console
came with an electric cigar lighter, like cars of that era.
Because I had come from a
military aviation background I was assigned to do weapons integration for SAGE,
which involved specifying intercept guidance calculations for various tactical
approaches by manned interceptors and for direct interceptions by BOMARC
missiles. I had to negotiate with several aircraft companyÕs engineering
representatives regarding how the guidance commands would either be displayed
to pilots or optionally coupled to their autopilots so that the pilot could
focus on launching air-to-air missiles at bombers. I also designed the display
console layout used by Intercept Directors to select tactics and oversee
interceptions. I subsequently learned that MIT had tried hard to duck out of
the responsibility for weapons integration on the grounds
that it should be done by the Air Force, but for some reason the Air
Force did not want to do that.
SAGE also had large screen
displays for the Generals and their staffs and the entire area was illuminated
by dim blue lights. After these impressive control rooms were shown to the
media, Hollywood films began showing War Rooms with similar environments, a
practice that continues today.
The weapons that were used initially by SAGE included
manned interceptors such as the F-102 and F-106 made by Convair,
the F-104 by Lockheed and BOMARC missiles (IM-99A), made by the Boeing.
F-102, a not very good interceptor made by Convair. In 1968
George W. Bush, joined the Texas Air National Guard after graduating from Yale
University with a bachelor's degree in history and, with the help of his
politically powerful daddy, was stationed in Houston, Texas, safely out of the
way of the ongoing war in Vietnam. There he flew under the control of the SAGE
air defense system and, since I had specified the guidance calculations for it
a decade earlier, in a sense I provided early guidance for a future President.
Had I anticipated that I might have provided better guidance, such as straight
down.
BOMARC Ground-to-Air
Missile Launch. The author is
embarrassed to admit that he led the study group that obtained permission to
put nuclear warheads on these missiles, to be blown up in our own skies.
Each BOMARC missile used a
rocket booster to get airborne and a ramjet to cruise at high altitude under
SAGE control to the vicinity of its target. It then used its Doppler radar to
locate the target aircraft more accurately so that it could dive at it and
detonate. BOMARCs were based in hardened structures and, when given a launch
command from SAGE, sent via land lines, the roof would roll back, the missile
would erect, and if it received a complete set of initial guidance commands within
about 5 minutes, it would launch in the specified direction, then be controlled
by a packet radio system.
It was clearly important
to ensure that the electronic guidance systems in these missiles were working
properly, so the Boeing engineers included a test feature that would generate a
set of synthetic launch commands so that the missile electronics could be
tested for correct operation. When in test mode, of course, the normal sequence
of erecting and launching the missile was suppressed.
However when we reviewed the BOMARC launch control system,
one of our engineers noticed a rather serious defect. If the launch command
system was tested, each missile would be in a state of readiness for launch and,
if the "Test" switch was then returned to the "Operate"
position without individually resetting the control systems in each missile
that had been tested, they would all immediately erect and launch! Needless to say, that ÒfeatureÓ was modified soon after we
mentioned it to Boeing. The fact that it had not been noticed by the
manufacturer suggested that safety oversight of their engineering practices was
inadequate. Boing naturally fixed that soon after we mentioned it to them.
Another problem showed up in
the packet radio system used to guide both manned interceptors and missiles.
The packet formats were carefully specified for each kind of command,
principally heading, altitude and speed, and the creation of the ground
transmitter and airborne receivers were assigned to two different contractors,
but when the system was tested it didnÕt work. It turned out that the
specifications neglected to specify whether the high or low order bits were to
be transmitted first and the two contractors made different assumptions. That
too got fixed, at some expense.
Here is a 17 minute
video of Bomarc launches and here is one on launch failures that talks about a 1960
incident in which a Bomarc with a nuclear warhead disintegrated and left
contamination throughout the area. I am embarrassed to
acknowledge that I enabled that fiasco by obtaining permission to use nukes as
discussed below.
Inadvertent erection
and another embarrassment. In 1960,
I somehow was assigned to lead a study group to get Federal Governmental
approval for putting nuclear warheads on the second-generation BOMARC missiles.
This involved proving to a nuclear safety board in Albuquerque, New Mexico that
the probability of accidentally launching a missile on any given day as a result of system malfunctions was less than a certain
very small number and that one person couldn't do it by himself. We did
eventually get the approval but along the way we discovered a scary problem
and, unfortunately, we also overlooked another one.
SAGE used land lines to
transmit launch commands to the missile sites and, since these lines were
duplexed, a black box at each missile site was set up to detect when the
primary line went bad so that it could switch to the backup line. However, on
examination we noticed that if both lines went bad concurrently the system
would remain connected to the backup line and the amplifiers would then pick up
and amplify whatever noise was there and interpret it as a stream of random
bits.
Jack Dominitz,
a member of our team, did a Markov analysis to determine the expected time that
it would take for a random bit stream to generate a Fire Command for one of the
missiles. He found that it was a little over two minutes and, when such a
command was received, the missile would erect and prepare to launch. However,
unless the missile also received a full set of guidance commands during the
launch window of about five minutes, it would automatically abort. Fortunately he was able to show that getting a complete set
of acceptable guidance commands within this time frame was extremely
improbable, so this failure mode did not present a safety threat, though it
could be a bit frightening.
The official name of the
first BOMARC model was IM-99A, so I wrote a short classified report about this
problem titled "Inadvertent erection of the IM-99A." While that title
raised a few eyebrows, it was destined to get much more attention than I
expected because its prediction came true a couple of weeks after it was
published. Both phone lines went bad at a site in New Jersey, which caused a
missile to suddenly erect, start the launch sequence, and abort. Needless to say, that scared hell out of the site staff and
a few other people but it was not publicly discussed at the time.
The Air Force was suitably
impressed with our prediction and I was immediately appointed to head a
multi-agency task group to fix the problem, which we did. The fix was rather
easy: just disconnect when both lines are bad. With good engineering practice,
of course, this kind of problem wouldn't have happened. However, the world is
an imperfect place.
Oops! Now with 55 years hindsight
I realize that both our study group and the government nuclear safety committee
overlooked other possibilities such as that a malevolent programmer might have
been able to launch a missile all by himself. There was no certainty that such
a scheme would have worked inasmuch as the SAGE
software was reviewed by multiple people who might have questioned any
odd-looking code. Nevertheless, we should have considered that possibility and
taken steps to ensure that it didnÕt happen. The reason we didnÕt was that
there was no such thing as a malevolent programmer in that era (1950s and Ô60s)
Ð we were all honest, upright, and altruistic, so the idea that a programmer
might sneak in evil code was inconceivable. Later experiences on the Internet
have revealed other possibilities.
Another thing that we
neglected to think about was that if a bomber was flying at very low altitude
the BOMARC would still dive to blow it up and, as a side effect would blow up
any people on the ground below. But that was apparently okay with the Air
Defense Command since their mission was to destroy bombers, so side effects
could be overlooked.