The two-man rule
is a control mechanism designed achieve a high level of security for especially critical material or operations. Under this rule all access and actions requires the presence of two authorized people at all times.
Per AFI 91-105, "The Two Person Concept" is designed to prevent accidental or malicious launch of nuclear weapons by a single individual. In the case of a missile silo command crew, both operators must agree that the launch order is valid, and must each complete a set of tasks independently and in proper order to launch. On a submarine, both the commanding officer and executive officer must agree that the order to launch is valid, and then mutually authorize the launch with their operations personnel. Higher up, in the United States, the National Command Authority comprising the President and Secretary of Defense must jointly issue the order to use nuclear weapons to the Chairman of the Joint Chiefs of Staff. Usually, the two-man rule is also backed up with hardware and software measures including command code verification and command keys.
Two-person integrity (TPI) is the security measure taken to prevent single-person access to COMSEC keying
material and cryptographic manuals. TPI is accomplished as follows:
- The constant presence of two authorized persons when COMSEC material is being handled;
- The use of two combination locks on security containers used to store COMSEC material; and
- The use of two locking devices and a physical barrier for the equipment.
At no time can one person have in his or her possession the combinations or keys to gain lone access to a security container or cryptographic equipment containing COMSEC material. Neither can one person have sole possession of COMSEC material that requires TPI security.
The term is used in other safety
critical applications where the presence of two people is required before a potentially hazardous operation can be performed. Some security protocols designate areas where human occupation is only permitted when two or more authorized individuals are present; such areas are sometimes known as no lone zones
. This is common safety practice in, e.g., laboratories and machine shops; in such contexts, the additional security may be less important than the fact that if one individual is injured the other can call for help. Some software systems enforce a "two man rule" whereby certain actions (for example, money wire transfers) can only be effected if approved by two authorized users.
Dual keys are required the authorization of two separate parties before a particular action is taken. The simplest form of Dual Key security is a lock that requires two keys to unlock it. The two keys would be in the possession of two separate persons. The lock could only be opened if both parties agreed to open it and at the same time. Canada accepted having American W-40 nuclear warheads under dual key control on Canadian soil in 1963 to be used on the Canadian BOMARC missiles.
In popular culture
In the film WarGames
, a Two-man rule drama plays out in the opening scene -- one of the missile silo refuses to turn his key during a test run. As a result, the military replaces some of the silos with computer controls.
In popular culture, the Two-man rule is evidenced in the television series Star Trek: The Next Generation, as it requires the authorization of both the Captain and the Executive Officer to initiate the self-destruct mechanism of the Starship Enterprise.
The two-man rule was disputed in the movie Crimson Tide when the Captain of the USS Alabama and the executive officer clashed over the release of nuclear weapons.
In the Tom Clancy novel The Sum of All Fears President Robert Fowler and National Security Advisor Elliot comprise the two men that were to issue a nuclear launch order against a city thought to be harboring a terrorist leader. Ryan refuses to validate the launch order and the nuclear attack is aborted.
The requirement for the presence of at least two staff members is also used in other contexts where there are security concerns, such as in banks. When bank employees perform some tasks, such as removing money from safes or opening Automated Teller Machine deposits, company policies often require that at least two employees be present. Many banks also make use of physical measures to ensure this - such as cabinets which require the simultaneous use of two keys, or by issuing only half of a vault combination to certain employees and the other half of the combination to the remaining employees.
As an extension of the broader rationale for the "two man rule", regulations for some companies or not-for-profit organizations may require signatures of two executives on checks. These rules make it harder for an individual acting alone to defraud the organization.