MSNBC - Dec 6
Perhaps no entity on earth faces a more mammoth Year 2000 challenge than the U.S. Department of Defense, which has some 1.5 million computers, 28,000 systems and 10,000 networks. Within its purview, no area has prompted more concern than the country's nuclear weapons arsenal, and whether its control and command is safe from the millennial bug.

THE CONCERN LIES with computer systems programmed to use two rather than four digits to describe the year - for example "79" instead of "1979." When the year 2000 arrives, experts predict that some computers may mistake the date for 1900 and shut down or malfunction. They may also feed bad information to other systems with which they are linked.

The Pentagon stands by its Year 2000 (or Y2K) effort, which it says has been under way since 1995 and budgeted at $2.5 billion over five years. But defense officials don't offer guarantees. "None of us knows exactly what is going to happen," says Pentagon spokesperson Susan Hansen.

"We feel cautiously optimistic that what will happen is some nuisances rather than crises ... We feel pretty confident that we will be able to provide for the national security of the United States."

Cautious optimism on the part of the DoD has done little to reassure critics. A recently released report by the British American Security Information Council (BASIC) in Washington says Department of Defense efforts to address the Y2K issue have been riddled by "severe and recurring problems." And, BASIC notes, there is even less information available about Moscow's efforts, much less the rest of the world's nuclear weapons infrastructure.

The combination of possible computer glitches and the hair-trigger posture of U.S. and Russian nuclear forces raise the specter of a missile launch based on compromised surveillance data, or a communication breakdown in the event of a real attack, according to the BASIC report. "U.S. decision-makers must take steps now to preclude disaster should the Pentagon fail," says the report's author, Michael Kraig, a Scoville fellow.

RISKS AND MYTHS
Analysts on both sides of the debate are quick to say that missiles are highly unlikely to launch themselves at the stroke of midnight on Jan.1, 2000. Rather, most concerns about military computer glitches are focused on the vast web of computerized communications systems under STRATCOM — U.S. Strategic Command, which controls the country's nuclear arsenal. Equally worrisome is U.S. Space Command (part of NORAD, the North American Aerospace Defense Command), responsible for early-warning radar and surveillance — the basis for military decisions. (For a review, see the Federation of American Scientists' Nuclear Forces Guide).

As in other sectors, no one is sure how the military's overall procedures will work if one part of the system fails. What raises the stakes is that both the United States and Russia maintain "launch on warning" postures — calling for nuclear retaliation upon detection of the other's launch of missiles.

If date-related problems produce inaccurate early-warning data, or if communications within the military command are compromised, there will be 10 minutes to half an hour to clarify the situation and make the decision to launch or hold back.

Even in normal times misinterpretation of data frequently leads to heightened alert. Signals are sometimes garbled by solar disturbances. In 1979, personnel at NORAD saw the numbers indicating ballistic missile launches suddenly jump from zero to 20. In preparation to retaliate, nuclear bomber crews started their engines, and Minutemen missiles were readied. Ultimately, the data was traced to a faulty embedded chip design.

Who's benefitting from the frenzy? Given all the work required to make U.S. weapons systems Y2K safe, who's getting the contracts — and subsequently earning big fees? Well, it's not a windfall for defense giants who traditionally make most of their money from government contracts. In fact, the amount budgeted — $2.54 billion spread over five years —is companies like defense and aerospace behemoth Lockheed Martin Corp. Lockheed says it has had piecemeal contracts on the overall Y2K effort, but that most of its input came under regular government maintenance contracts. Compare the amount the company is earning on Y2K upgrades to the $80 million the company is spending to make itself internally compliant, and there's little or no benefit. "It's a wash, or less than a wash," says Jim Fetig, a spokesman for Lockheed. "The outgo is bigger than the input." The same message came from Northrop Grumman, which makes military surveillance systems, military electronics and combat aircraft. Despite winning a handful of small information technology contracts, "we've noticed no big upsurge," a spokesman said.

In 1995, Moscow went into a state of high alert when its early warning radar mistook a Norwegian scientific probe for a U.S. trident missile launched from the Baltic.

The response decision was elevated all the way to President Boris Yeltsin, his defense minister and the chief of staff, who decided against action when they determined the "impact" would be outside Russian borders.

There is also a danger that, in the event of data correctly interpreting attack, communication systems used to coordinate a reaction may malfunction. Indeed, the DoD's efforts to prevent this breakdown go only so far, since the military has shifted from largely dedicated communications systems to commercial networks. In testimony before a House subcommittee in June, Deputy Secretary of Defense John Hamre conceded, "If Ma Bell's or Bell Atlantic's system fails on Year 2000, we're going to have mission failure, and I don't have any control over that."

FAULTY CHAIN
Few military analysts suggest that 2000 will bring the Armageddon. "The most likely thing is that Y2K problems get lost in the noise of flaky computer problems," says John Pike, security analyst for the Federation of American Scientists, a privately funded, non-profit organization in Washington, D.C.

However, Pike believes the greatest risk lies with events that follow component failure. "The thing you worry about is people improvising," he says, causing a relatively innocuous event to escalate, as happened in the Three Mile Island and Chernobyl crises.

Pike paints a scenario: "Most probably, the response is not that a missile will jump out of its silo at midnight, but that the door of the missile silo will get stuck." A technician whose job it is to keep the missile ready for use drops his wrench into the silo, tearing a hole in the fuel tank, causing an explosion. The explosion severs communication with the base, and it goes into a higher state of alert, which raises concern at military bases in Russia.

"If systems behave peculiarly, people will be nervous, overworked, and stop trusting the system," says Pike. "Consequently the man-machine interface starts behaving in unpredictable ways."

HOW MUCH PROGRESS IS ENOUGH
The Department of Defense says the situation is well under control. It reports that it has identified 2,581 mission-critical systems, of which 53% are now fully Y2K ready. Another 1,014 are going through the paces and a few hundred are to be retired or replaced before 2000. The idea is to finish all the fixes by Jan. 1, 1999 ... three months earlier than previously announced, according to spokesperson Hansen. This will leave ample time for testing, and including Y2K testing in military exercises. But BASIC, which did extensive documentation of the DoD process, contends that there are serious flaws in the Pentagon's representation ... including ad-hoc funding, lax management and inadequate standards for declaring a system "Y2K compliant." In short, the fixes won't be finished and tested in time, says BASIC. "Initial research findings ... have resulted in no confidence that the Pentagon's present program will meet the Year 2000 challenge," according to its report.

Those findings were based in part on the government's own conclusions, which started to set off alarms last spring. The Office of Management and Budget has expressed its concerns that DoD will not meet its goals. The General Accounting Office for the Senate Committee on Governmental Affairs warned in a report in April, "Time is running out to correct Department of Defense systems that could malfunction ... the impact of these failures could be widespread, costly and potentially disruptive to military operations worldwide."

An array of audit reports posted by the Inspector General for the DoD suggest many military departments are lagging behind schedule on Y2K efforts, and predict disruptions in command and control, testing and day to day operations.

THE NUCLEAR CLUB
Assuming that the Pentagon meets its goals, however, it seems clear that Russia will not, particularly in light of its severe economic constraints. Moscow has insisted that the Russian system is different — not susceptible to Y2K glitches — but the argument has failed to convince. Defense Deputy Secretary Hamre described Russia's early warning system as "fragile" in Senate testimony. "Our concern is that Russia and China have only a very rudimentary understanding of the Year 2000 problem, which is why we need to reach out to them to make sure they have custodial confidence in their own systems," he said.

That was in June. As of October, Washington and Moscow were discussing the possibility of exchanging personnel in military sites to usher in the millennium, which spokesperson Hansen says will "... relay information and relieve the anxiety in case of a glitch ... to ensure no one misconstrues Y2K problem for an attack."

Some critics of U.S. nuclear policy, however, say that the fundamental flaw is in the posture of U.S. and Russian forces in the post-Cold War era. BASIC, as well as members of Congress and other non-governmental groups, urge the U.S. and Russia to "stand down or de-alert" missiles that remain on a hair-trigger prior to 2000. Though most agree it is too late to separate missiles from warheads, BASIC's Kraig urges the two sides to otherwise disable missiles.

Others are calling for an independent audit by a non-governmental agency and fuller public disclosure of the results. "We don't know squat about testing at STRATCOM," says Pike of FAS. "We know a lot more about Y2K compliance of parking garages at Washington headquarters than computers that are planning thermonuclear war."

The Defense Department says it's just not a practical solution to bring in outsiders unfamiliar with the multitude of rules and regulations to which they are subject. And as with many of the ideas being bandied about at the cusp of 1999, there's just not enough time. Says Hansen: "By the time [outside auditors] got up to speed it would probably be past the year 2000."

DISARMAMENT CLEARINGHOUSE
Nuclear Disarmament Information, Resources & Action Tools
Kathy Crandall, Coordinator
1101 14th Street NW #700, Washington DC 20005
TEL: 202 898 0150 ext. 232 FAX: 202 898 0150 ext. 232
E-MAIL: disarmament@igc.org
http://www.psr.org/Disarmhouse.htm
http://www.psr.org/ctbtaction.htm

http://ens.lycos.com/ens/dec98/1998L-12-01-09.html

A recent Defense Department Inspector General's Report has found that the Pentagon office that handles safety and security of U.S. nuclear stockpiles and emergency response in a nuclear accident falsified readiness reports on the Y2K computer problem. The Defense Special Weapons Agency claimed that three of five essential computer systems were fully prepared to face the computer crisis but the necessary testing never took place. The agency neglected to create contingency plans in the event of the failure of these critical systems. The October 30 Inspector General report warns that unless the problem is solved, "The Defense Special Weapons Agency, as a part of the Defense Threat Reduction Agency, may be unable to execute its mission without undue disruption."

---

26th NOVEMBER 1998
PENTAGON EXAGGERATED Y2k READINESS
By M.J. Zuckerman, USA TODAY - http://www.usatoday.com/news/washdc/ncsthu09.htm

WASHINGTON - The Pentagon office responsible for safety and security of U.S. nuclear stockpiles and emergency response in a nuclear incident acknowledges falsifying readiness reports on the looming Year 2000 computer problem.

The Defense Special Weapons Agency (DSWA) claimed that three of five so-called "mission critical" computer systems, essential to conducting its most primary duties, were fully prepared to face the computer crisis despite never conducting necessary testing, according to a recent Defense Department Inspector General's Report.

The agency also neglected to develop required "contingency plans" that would take effect if any "mission critical" systems fail.

"We recognize and agree with the findings of the Inspector Generals report," says Capt. Allan Toole, who was recently assigned to correct the Year 2000 (Y2K) problems at the DSWA, which was absorbed into the newly created Defense Threat Reduction Agency on October 1.

He would not discuss the agency's previous false reporting on Y2K.

The Oct. 30 Inspector General report predicts that without corrective action "The Defense Special Weapons Agency, as a part of the Defense Threat Reduction Agency, may be unable to execute its mission without undue disruption."

Toole predicts the agency's systems will be "100% in compliance by April" 1999, despite not having established a complete inventory of the work that remains to be done.

"I have a good feeling about Y2K in this agency," he says.

Y2K is a complex computing problem, causing computers to make false calculations or fail entirely because the code or instructions written into those systems are unable to comprehend dates beyond 1999.

Facing increasing pressure from the Joint Chiefs of Staff, the White House and Capitol Hill to correct the Y2K problem, "people may get a little hasty or mistakenly" report something as ready, says Marvin Langston, the Defense Department official in charge of the computer problem.

"But I think there's very little real mischief going on here," he says.

Langston says he is confident that "a high level of end-to-end re-testing" of all system beginning early next year will root out remaining problems.

But the Pentagon received a D-minus grade this week from the House Government Reform and Oversight Committee, which has been issuing Y2K progress grades to federal agencies for the past year.

"I am deeply concerned by this report," says Rep. Steve Horn, R-Calif., the committee chairman. "There is zero tolerance for error when you're dealing with the defense and safety of our nation."

"Does it come as any surprise to you that the Pentagon on occasion fudges on the truth?" says Sen. Robert Bennett, R-Utah, co-chair of a Senate Special Committee on Year 2000. "Look, the Pentagon has the biggest problem simply because they are the biggest agency. I know they are working very hard."

The federal government identifies 6,696 "mission critical" systems, of which 2,581 are in the Defense Department.

As recently as a few weeks ago, Sen. Bennett was fond of noting that officials of government and industry "all lie to us about Y2K" when asked to testify about their level of readiness.

But heading into the Thanksgiving weekend he says one of the things he is thankful for is that "there aren't as many people lying to us as there used to be."

The newly created Defense Threat Reduction Agency, oversees the full spectrum of weapons of mass destruction, including testing and modeling, stockpiling as well as the export or transfer of high technology. It also works with the FBI, CIA and State Department to monitor weapons of mass destruction held by U.S. adversaries.

---

19th NOVEMBER 1998
MILLENIUM NUCLEAR FEAR

Campaigners are becoming increasingly concerned at the lack of preparation within the nuclear industry for 1st January 2000. The following information reveals shocking levels of work still to be done. Nuclear safety and security are not options, the risk of a nuclear accident is real.

• A BASIC report 'The Bug in the Bomb:The Impact of the Year 2000 Problem on Nuclear Weapons' shows how unprepared the US military system is
• A paper from the UK Nuclear Safety Inspectorate highlights the truly alarming effects of noncompliance at UK's civil nuclear sites
• Taskforce 2000 report puts the Ministry of Defence in a high risk category and BNFL is accused of providing "no basis of confidence"
• The EU has failed to ensure safety at central and eastern European nuclear reactors according to the European court of Auditors

Statements are no longer good enough we are running out of time. We demand that the MoD, BNFL and other licensees prove to the public that there is no risk of a nuclear accident, or accidental launch of a nuclear weapon at the beginning of the new millennium.

Nuclear weapons should be de-alerted and removed from delivery vehicles to avoid an accidental launch. Nuclear sites should be closed down in case there is a failure which emergency services could not deal with because of other national system failures in the country on January 1st 2000. There should be an emergency plan implemented for the whole period, and sites should not be allowed to re-open until enough proof is given to the public that there is no risk.

"January 1st 2000 is likely to be chaotic - putting the public at risk of a major nuclear accident and emergency is simply unacceptable. The public bodies responsible for nuclear safety should be making it clear that sites, companies or military bases unable to be 100% sure that the start of the new millennium will have no effect, will be shut down or immobilised - as is the policy in the US ."

---

13th NOVEMBER 1998
Y2K: MANY CHERNOBYLS POSSIBLE
2000 Glitch Poses Nuclear Threat

Western intelligence is warning of possible nuclear "meltdown" in the former Soviet bloc as a result of the so-called millennium bug, The Times of London reported on Sunday. The millennium bug is a glitch in many of the world's computers that is expected to cripple them worldwide at midnight on December 31, 1999.

Intelligence sources say some of the 65 Soviet-made civilian nuclear power plants scattered across Russia and the former Warsaw Pact countries could malfunction as their computers fall victim to the "Y2K" (year 2000) glitch, which makes them interpret the 00 date as 1900 instead of 2000, The Times reported. "America, Britain and France have been quick to see the dangers. But anxieties about Russian nuclear safety, branded on global memory by the 1986 Chernobyl disaster, have not been diminished by Moscow's assurances that the problem is 'under control,'" the paper reported. An intelligence source was quoted by The Times as saying, "Russia's nuclear industry is in desperate straits. Throw in Y2K and you could have a giant Chernobyl on your hands." It emerged last week that William Daley, the U.S. commerce secretary, is to host an international millennium bug conference this year, indicating the seriousness with which the U.S. White House views the problem, the paper said. "Nuclear safety is bound to be an important item on the agenda," The Times reported, adding, "Al Gore, the [U.S.] vice president, also raised Y2K at a recent meeting with Viktor Chernomyrdin, the former Russian prime minister." In a recent circular to all American power plants, the U.S. Nuclear Regulatory Commission warned that "control room display systems, radiation monitoring and emergency response" are particularly at risk, The Times reported. "The Y2K problem is urgent because it has a fixed, non-negotiable deadline," that circular concluded. "This matter requires priority attention because of the limited time remaining to assess the magnitude of the problem."

Even if the Russian government heeds such warnings, it may not have enough computer experts to go round, The Times reported. Former Soviet bloc countries have 36 Soviet-made civilian nuclear reactors, while Russia itself has 29. Of Russia's, 11 are models similar to the one that exploded at Chernobyl, in Ukraine, releasing 200 times as much radioactivity as the atomic bombs at Hiroshima and Nagasaki. The oldest Chernobyl-style nuclear power plant is the Leningrad Nuclear Power Plant, or LAES, an accident-prone power station just 80 kilometers west of St. Petersburg. LAES's reactors were actually the prototype for Chernobyl's. Russian officials say the LAES reactors have been upgraded since the Chernobyl accident revealed vulnerabilities in them. LAES has been plagued with problems - ranging from a hunger strike last year by unpaid engineers, who continued to work monitoring the reactor's safety despite dizziness and fainting spells, to an overburdened nuclear waste storage facility.

In 1992, an accident at LAES released radiation outside the plant. Last week saw conflicting reports that another accident in March had again released a minor amount of radiation outside the plant.

---

13th NOVEMBER 1998
US AIMS TO AVERT Y2K INDUCED WAR
By M.J. Zuckerman, USA TODAY - 13/11/98
http://www.usatoday.com/news/washdc/ncsfri01.htm

WASHINGTON - Concerned that the Year 2000 computer bug could disrupt military early-warning systems, the United States is reaching out to the world's nuclear powers in an unprecedented effort to avoid an accidental conflict.

Pentagon officials say they are confident that U.S nuclear command and control systems will be ready for the so-called Y2K problem, but worry that foreign early warning systems could malfunction and falsely indicate an attack.

"We're working with all the nuclear powers we can have a relationship with, to physically share people," says Marvin Langston, who directs Pentagon Y2K programs. "Their people will sit in our control centers and our people in their control centers to keep the communications open."

Efforts are also being made through the State Department and intelligence community to establish "back channel" contacts with nations that deny having nuclear capability and others hostile toward the United States, he says.

Although plans are not finalized, Deputy Secretary of Defense John Hamre says he hopes to have some cooperative efforts in place next year.

"We have agreed we will have a center that will provide resources," says Hamre, adding, "We'll move as fast as we can with the Russians."

There is general agreement that Y2K - a date-sensitive programming problem that could disable computers after Dec. 31, 1999 - will not cause missiles to launch mistakenly, but early-warning systems could malfunction. For instance, in January 1995, Russian equipment mistook a NASA launch for a missile attack.

"We have a huge stake in Russia's early warning systems working properly," says former senator Sam Nunn, who raised concerns last June.

Russian authorities first focused on Y2K this summer, finding their space-based tracking equipment was likely to fail.

"Up to 80% of all defense ministry systems could be affected," says Sergey Rogov, an adviser to the Russian Duma on Year 2000 issues.

An arms control think tank, British American Security Information Council, issued a report Thursday questioning the Pentagon's ability to secure its nuclear systems from Y2K distress.

The Government Accounting Office and members of Congress have questioned the ability of the Pentagon, and other government agencies, to complete all its Y2K efforts before Jan. 1, 2000.

Rogov says that "maybe the Year 2000 problem provides us with the impetus to go into the next century with an entirely different relationship of our two nuclear forces."

---

13th NOVEMBER 1998
MORE THAN COMPUTERS VULNERABLE TO Y2K
By M.J. Zuckerman, USA TODAY - 13/11/98
http://www.usatoday.com/news/ndsfri01.htm

The first radio signals from Sputnik 41 years ago helped redefine American national security, just as the so-called Year 2000 computer bug is underscoring the latest risks to a nation built on technology.

"The Year 2000 problem could be an event equivalent to the launching of Sputnik, (which) raised the awareness about the vulnerabilities of the United States," says Marvin Langston, deputy chief information officer for the Department of Defense.

The Year 2000 problem, or Y2K as it is commonly known, has riveted attention on what may happen when computers fail to recognize the year 2000, disrupting internal clocks and causing system shutdowns and crashes.

Governments and corporations here and abroad are allowing unprecedented access to computers as programmers look to fix the Year 2000 bug. That's raising concerns about potential security compromises, industrial espionage, even sabotage. And as in the days following Sputnik, analysts see a need for more domestic talent to keep U.S. technology on the cutting edge.

A serious re-evaluation of security issues has been under way since last year, when a presidential panel warned that the nation's economy and vital services were vulnerable to hacker-style attacks.

"In the millennium bug, we have developed a technology equivalent to natural forces. If it is anywhere, it is everywhere," says G.K. Jayaram, chairman of Transformation Systems of Princeton, N.J. "Nowhere at any time in human history has there existed such a problem."

Opening 'trap doors'

One of Jayaram's clients is Provident Bank of Cincinnati, which boasts that it is "among the nation's 100 largest banks, with 72 financial centers and over $6.7 billion in total assets."

It also has about 8.5 million lines of computer code, which Jayaram's firm upgraded for Y2K using a staff of 30 people in Cincinnati and 40 in Chennai, India, linked by satellite.

While Jayram's firm has a solid international reputation, the increasingly common practice of using overseas workers to handle U.S. computer systems concerns some people.

"We are looking, as an intelligence priority, very carefully for people who may present a threat in this area," says Richard Clarke, a senior National Security Council official.

"When systems are modified to be Y2K-compliant, the question remains: Do you know what was changed?" says Sam Varnado of Sandia National Labs, which is working on system security with the federal government and private industry.

It's a simple matter for a programmer handling computer source code to install, undetected, a secret entrance, or "trap door," which can be used to gain access to a system to read sensitive information, copy records, alter files or transfer money. "We have seen multiple times where Y2K activity has resulted in trap doors being placed in commercial systems," says Duane Andrews, executive vice president with SAIC.

"It's a very serious matter," says John Sarazen, director of SynComm Group, a technology consulting firm. "An unprecedented amount of code is being opened up right now as part of Year 2000."

Foreign code-busters

Outside the USA, programmers in India, Pakistan, Ireland and the Philippines are doing most of the world's Y2K upgrades. And each of those nations has issues with the United States or a thriving underground of anti-American terrorist groups.

Given the chilly relations between the United States and India since it and Pakistan conducted nuclear weapons tests earlier this year, concerns are heightened by the amount of computer work done in those countries.

"Y2K remediation provides all kinds of opportunities for someone with hostile intent to understand how your computer network works, how your business works, what your vulnerabilities are," CIA Director George Tenet testified before the Senate Special Committee on Year 2000 in June, even before the nuclear weapons flap. "So we're watching it very, very carefully."

The Philippines was a base of operations for subordinates of Osama bin Ladin, the notorious exiled Saudi millionaire charged with masterminding the bombing of U.S. embassies in East Africa this summer. He reportedly is highly computer-savvy.

Jayaram dismisses concerns about Indians as a threat.

"We have built in layers of safeguards, and there is an audit team from the client overseeing every step of the operation," he says. "So even if there was a programmer who wanted to sabotage something, it would be most difficult."

While reliable estimates say less than 10% of U.S. commercial source code is being treated by foreign companies, many top U.S. trading partner are turning to those countries in a rush to make deadlines.

And, Sarazen cautions, "It's a misperception that only foreign government's will crack our systems. Domestic, commercial espionage is a thriving business."

Shortage of expertise

While the USA is the world's primary consumer of computer goods, it is no longer leading the world in turning out computer scientists.

"We're not cranking out as many technical people as we used to as a percentage of all graduates," Langston says. "And because we're in a very technically driven world, we are setting ourselves up nationally for vulnerability (when) we have to go offshore for technical talent."

India has exploited the U.S. shortfall, turning out more than 50,000 computer scientists in the past year, compared with 26,000 in the USA. India has become second only to the USA in software production, with exports of $1.8 billion this year, up from $10 million a decade ago. And it hopes to capture between 5% and 10% of what will be spent globally on Y2K.

Computerized security

Many of these problems "are going to be with us for a very long time," says Mike Vattis, chief of the National Information Protection Center, a task force based at the FBI. "People are just now awakening to these issues."

But questions are growing about how far government can go in trying to safeguard national security while allowing relatively free access to data.

Civil libertarians warn that some freedoms and rights may be challenged in the process of redefining national security. A presidential commission last year proposed a regulation, which it later withdrew, requiring administrators of private computer systems to pass an FBI background check.

"Even when an agency is charged with observing privacy and other rights, those interests eventually lose out when that agency has a directive to protect national security," says Marc Rotenberg of the Electronic Privacy Information Center.

Says former senator Sam Nunn, chairman of a research panel at the Center for Strategic & International Studies, "Many of the problems we are seeing have been with us for a long while, but this (Y2K) problem is exacerbating the situation."

---

13th NOVEMBER 1998
THE TRUTH ABOUT YEAR 2000 MYTHS
By M.J. Zuckerman, USA TODAY - 13/11/98
http://www.usatoday.com/news/ndsfri02.htm

At the dawn of the new millennium, planes are unlikely to fall from the sky, satellites will not explode, your bank account will not crumble into cyberdust and there's no reason your car shouldn't start.

And here's another bit of hope: The Year 2000 computer glitch is unlikely to hang up the telephone system, say federal auditors who recently completed tests on the network.

"Even the account and billing system were flawless," said an exuberant federal computer snoop, who asked to remain anonymous.

But keep in mind that things still are going to go wrong as computers cope with dates ending in misleading double-zeroes.

"It's going to be a case of massive inconvenience," says John Sarazen, director of SynComm Group, a technology consulting firm. "The sky isn't falling, there are just some chunks going to come down."

The truth about some Y2K "urban legends":

Planes will not fall from the sky. What seems more likely is that systems run by the Federal Aviation Administration and services at smaller airports may encounter problems, creating a ripple effect that will disrupt schedules. Automatic teller machines will work. There have been so many reports of potential failures that banks have made a point of making sure they will operate. Only 8% of potential computer failures will happen at the stroke of midnight on Jan. 1, 2000. The rest could occur over the following two years. Few VCRs care what year it is. Credit cards with expiration dates in the year 2000 or beyond have created problems, but those difficulties are being resolved.

---

12th NOVEMBER 1998
YEAR 2000 TO START WITH A BANG?

CND is horrified by the revelations made in a report released today in Washington by the British American Security Information Council (BASIC) concerning the millennium bug and its possible affect on US nuclear weapons. CND is calling for an immediate Government statement on the matter and an urgent investigation by the National Audit Office.

The report reveals a US nuclear weapons infrastructure in chaos, running out of time to fix an endemic problem, that could have unimaginable consequences in a worst case scenario of total failure of key systems. Whilst the report concentrates on the problems with US nuclear weapons this will have a direct impact on the British programme. This is because a large percentage of the British Trident nuclear weapons systems is reliant upon US equipment and technology.

Little attention has been focussed on how the year 2000 problem will affect British nuclear weapons. The MoD have been working on the issue since 1996 and have had talks with the other four main nuclear powers (the US, France, Russia and China) on this matter.

A letter from Lord Gilbert, the MoD Minister responsible for year 2000 compliance does not instil confidence that the matter is being adequately dealt with. He said:

"Taking missiles off alert... would not eliminate the residual risk. The problems might, for example, only materialise when the systems were turned back on. In a worst case they might arise in early warning and communication systems leading to decisions to reactivate missiles even if they had been taken off alert. The way to eliminate these residual risks is therefore to take action..."

CND Chair, Dave Knight said: "If the year 2000 problem is so insurmountable for the US military what does that say about the chances of Britain, and the other five countries who possess nuclear weapons solving the problem on time."

"There can be no margin for error when you are talking about nuclear weapons. You have to be one hundred per cent certain that every single one of the 36,000 nuclear weapons in the world, all of the command and control systems, all of the design, manufacturing and testing infrastructure are all fully compliant. If the Government cannot give that reassurance then everything should be taken off alert and shut down until such an assurance can be publicly given."

"Time is fast running out and there is an urgent need for an investigation by the National Audit Office to find out whether British nuclear weapons will be year 2000 compliant. Only then can the public and parliamentarians make an accurate assessment of the risk and take the necessary remedial action", he went on to say.

Alan Simpson, MP for Nottingham South, has tabled a series of parliamentary questions on the millennium bug and the bomb in an attempt to illicit more information from the Ministry of Defence.

For a copy of CND's three page prise of the BASIC report or a copy of the Lord Gilbert letter please contact the CND Press Office on 0171 700 2350.

Notes:

According to the US Department of Defense in their latest report on the matter, 51% of their systems still needed repairs, the number of 'mission-critical' systems that will not be fixed by their own March 1999 deadline has increased from 34 to 69 and the number of 'mission-critical' systems that have fallen at least two months behind schedule has risen from nine to 51.

To solve this hugely complex problem every single chip and every single line of computer code in every item that forms a part of every system involved in the design, production, maintenance, testing, deployment and dismantlement of nuclear weapons must be examined for year 2000 compliance to be absolutely certain that nothing will go wrong. Then all of these items in all of these different systems have to be tested in every conceivable scenario they may encounter to ensure they will function as they should.

One can easily imagine how time-consuming and labour intensive ensuring year 2000 compliance has to be in order to be one hundred per cent effective. One more worrying element in the report is the situation in Russia. As with Britain very little information is available but one source in the report stated that about 51,000 of the 96,000 computers in Russia will be susceptible to disruption at the turn of the century and half of the 50 operating systems and 100 software programmes used by the Russian Government face serious millennium bug problems.

CND PARLIAMENTARY BRIEFING

The Millennium and the Bomb
Some rough notes from the BASIC report

My overall impression upon reading and re-reading this report is that the task at hand - ensuring Y2K compliance for all US nuclear weapons - appears insurmountable. This begs the question "If it is so insurmountable for the US military then what does that say about the chances of Britain, France, Russia and China fixing the problem?" (Not to forget the smaller nuclear weapons states of India, Pakistan and Israel.) Time is running out and yet there is so little detailed information available. This is clearly a matter that should be investigated by the National Audit Office and the House of Commons Defence Select Committee.

William Peden, CND Parliamentary Officer

Introduction

The nature of the year 2000 problem is far more complex to solve than just a simple date change in a computer programme.

• Much of the software currently in use is based upon virtually extinct programming languages for which there exists a shortage of people who understand them;
• The code from which a program has been devised may be lost, making amendment difficult if not impossible as the programmers technical remarks may be missing;
• The subsystems which help support the larger operating system are so numerous and varied that they may be difficult to locate and impossible to repair;
• These subsystems may use chips that have their programme imbedded into the chip itself and this programme may be date dependent or use time synchronisation to talk to other chips or other parts of the system and therefore may prove difficult, if not impossible, to identify and difficult, if not impossible, to fix;
• In order to fully ensure Y2K compliance extensive dry-runs (exercises) have to occur to ensure each bit of the system can still function in the way it should, with every other part of the system in every conceivable scenario (these are time-consuming and labour intensive) and;
• Many of the companies who supplied chips in the past have gone bust, so you cannot rely on a 'corporate guarantee' as to Y2K compliance;

The most problematic area is that in order to keep costs down the military have traditionally used 'commercial-off-the-shelf' chips (COTS) that are generic and may have time and/or date functions imbedded within them rather than uniquely one-off designs. These chips are so widespread that their individual identification within a particular system or subsystem takes a lot of time.

Computer scientists and industry pundits estimate that between two and five per cent of all chips in existence will experience problems. This figure may seem low but who knows which chips will fail.

The BASIC report states: "In short: to be considered invulnerable, the DoD (US Department of Defense) has to test nearly every chip and every line of computer code for systems that are dependent on dates for operations. For those military items considered "critical to core mission requirements" every chip may have to undergo examination just to be certain of force readiness, even when the larger system in question does not overtly utilize dates."

The year 2000 problem is an incredibly complex problem, with no easy solution. Yet the consequences of failure to solve it by the middle of next year are potentially devastating.

There is also not just one date to watch out for and fix:

"The year 2000 also sports a leaps year, so Feb 2, 2000 through March 1, 2000, should be checked, as should 2/29/01, which should be rejected as it is not a leap year... [other dates include] Oct 10, 2000, the first eight character date using a two digit month; Dec 31, 2000, the 366th day of the year, Aug 22, 1999, the first end of an epoch for GPS [Global Positioning System]... 'overflow' problems in older Unix systems; and March 1, 2101, the 'terminal date' used to encompass all established rules for calculation of dates and calendar events." [Hess, June 26, 1998]

To solve this hugely complex problem every single chip and every single line of code in every item involved in the design, production, maintenance, testing, deployment and dismantlement of nuclear weapons must be examined for Y2K compliance to ensure nothing goes wrong.

"The potential seriousness of Y2K-related glitches in this vast 'system of systems' was demonstrated by a 1993 simulated test by NORAD personnel. Out of curiosity, the technicians rolled the dates up to Jan 1, 2000. The result, total system blackout (Kaplan, 1993). Officials have become increasingly aware of the Y2K glitch since that incident; this is especially true for the nuclear weapons and C3I community." Problems in what may appear to be a well ordered Y2K audit

According to the research by BASIC on 5 June 1998 the US Department of Defense Inspector General's Office published a highly critical audit of the DOD's methods for solving the Y2K problem.

"The audit uncovered two separate but related problems in DoD implementation of the Management plan. First, many systems were certified as compliant when in fact no adequate justification for such assertions existed; the IG estimated that only 109 of the 430 systems reported as compliant by November 1997 were in fact adequately validated... Three of the 22 systems in the sample for which a completed and signed checklist was provided were not in fact fully certified through testing, even though renovation probably had been completed. Two of the 22 systems had not even reached the validation phase. In addition, 14 examples in the 83 point sample taken by the IG "were inspected without testing (such s a manual review of the system's software code);" seven of the 83 systems were considered Y2K compliant based on a statement from another organization; and 30 systems were labelled compliant without any inspection, testing, or statement from another source."

What's happening now?

Despite renewed efforts to sort the problem out "there are signs that severe problems persist in meeting project deadlines... On July 31, 1998, the DoD predicted that 43 mission critical systems would not be renovated on time and therefore would suffer from a high risk of failure..."

The most recent report from DoD stated:

"...51 per cent of its mission critical systems still needed Y2K repairs. The number of mission-critical systems that will not be fixed by a March 1999 deadline set by OMB has increased from a reported 34 in May to 69. The number of mission-critical systems that have fallen at least two months behind schedule since the Pentagon's last report has risen from nine to 51..."

Just what are the potential Y2K outcomes?

• The consequences might be minor in both depth and breadth and not that noticeable;
• The problem could be pervasive with fairly minor affects in most cases. More of a nuisance than anything else
• Problems may occur in only a few systems "but with major and decisive impacts on their performance in terms of both nuclear safety and their ability to meet stated national security requirements..." i.e. if they insist upon continuing with current operational status they may find the system unable to cope and liable to fail.
• The 'doomsday scenario'; almost all systems fail outright, and the nature of the glitches leaves systems impervious to timely intervention by technicians. "...there might be a combination of nuclear nightmares: C3I networks may leave the nation blind to incoming attack or inform leaders that an attack is in progress when none actually exists, or foreign systems (such as those in Russia or China) may fail while the US continues to field a viable arsenal, possibly causing increased fears and instability as leaders with Y2K problems become suspicious of US military activities..."

  "Although it is not currently possible to reach a definitive conclusion on the status of individual nuclear systems, available information on the DoD's overall remediation does not support the first two 'optimistic' scenarios. The evidence clearly shows that Y2K-induced failures are likely to be pervasive, complex, difficult to repair, and potentially damaging. Given the highly interconnected nature of all systems under the purview of US Strategic Command (STRATCOM), it is impossible to say with any degree of certainty that current "fixes" have succeeded. Given the pervasiveness of imbedded subsystems, in the form of microchips and microprocessors; it is also impossible to say with any authority that all problem areas have been properly identified, much less repaired. The only method for attaining this type of knowledge is through comprehensive, integrated 'mission-level' testing and verification programs, done well in advance of the Year 2000 in case difficulties occur that need further renovation."

What about Russia?

The report is primarily about US nuclear weapons but there is one interesting statement made.

"...a recent report by the Russian "State Communications Committee" and Russian Foreign Ministry stated that possible disruption could happen in computer systems for Russian defense forces, and that about 51,000 of the 96,000 computers in Russia will be susceptible to disruptions at the turn of the century... Specifically, the report estimated that half of the 50 operating systems and 100 software programs used by Russian government structures are facing serious problems due to the millennium bug."

What about Britain?

We know very little and need to find out more. In the only letter from the MoD CND has seen on the subject Lord Gilbert (the Minister responsible) stated on 14 June 1998:

"The MoD has had a strategy in place to tackle the year 2000 problem across all areas of defence activity since 1996. This includes the identification and assessment of all affected equipment and systems and, when necessary, their repair or replacement to make them year 2000 compliant. I can assure you that our procedures for control of our nuclear deterrent are robust enough to preclude any possibility of an accidental launch of a Trident missile through equipment malfunction. We are not, however, complacent about possible risks in this area. We have been in close contact with the US and France over this issue. The year 2000 problem has also been raised with Russia and China. Taking missiles off alert... would not eliminate the residual risk. The problem might, for example, only materialise when the systems were turned back on. In a worst case they might arise in early warning and communication systems leading to decisions to reactivate missiles even if they had been taken off alert. The way to eliminate these residual risks is therefore to take action, as we will continue to do, to raise the subject in all relevant international for a and with various international organisations, including the other nuclear weapon states."

One should also recall that a large proportion of the essential bits of Britain's Trident system are purchased from the US. If as the BASIC report concludes "things are not as good as made out", then what does that say about British Y2K compliance?

What does BASIC recommend?

BASIC recommends what CND has been recommending for many years - take all nuclear weapons off alert and remove the warheads to storage ashore. In addition BASIC want to see more money and more personnel being devoted to fixing the Y2K problem, particularly with regard to nuclear weapons systems.

---

18th AUGUST 1998
SWEDEN MAY FACE FROSTY YEAR 2000
By Reuters

STOCKHOLM -- Swedes may get an unwelcome foretaste of their plan to phase out nuclear power by 2010 unless computer experts crush the millennium bug.

Sweden's nuclear watchdog is tightening its grip on the power industry's 2000 preparations after uncovering a fault at an atomic unit which could have left many Swedes in the cold and the dark.

Nuclear power workers are in for a dull and sober New Year 2000 as plants plan full staffing in case of problems. And some plants are worried the millennium bug might even strike at the end of this year.

Maintenance personnel at the three-reactor Forsmark station sounded the alarm in July when they found that the plant's data system was unable to recognize the first two digits of the number 2000, resulting in an automatic shutdown.

"If possible millennium problems are not taken care of well in advance, people could face a cool and dark New Year's Eve," spokesman Anders Bjoerle at Sweden's nuclear power inspectorate (SKI) told Reuters.

SKI has said it might order a temporary shutdown on the eve of the millennium and go over to hydro-power as a back-up if it cannot guarantee there will be no computer problems.

Bjoerle said SKI's first step was to inspect Sweden's 12 nuclear units, which produce around 50 percent of the country's total output. Testing has shown that the millennium bug could prove fatal to nuclear power production.

Programmers in the 1960s and 1970s saved time and money by skipping the first two numbers of a four-digit year. That means computers will read 2000 as 1900, threatening glitches in power supply and raising the urgent need for back-up sources.

Bjoern Lindquist, manager for the millennium project at Vattenfall AB, Sweden's national power producer, said the company was focusing on testing to find ways to avoid shutdowns.

"We do not fear any problems after all the precautions we have taken. But if a plant shuts down, we will have alternative plants ready and we will take the electricity we need from other places," Lindquist told Reuters. He said stand-by measures were not yet in place but that plants would be fully staffed on the night.

Vattenfall, the owner and operator of the Forsmark station, has been working on the 2000 bug since 1996. "We have invested hundreds of millions of crowns in this program," Stig Goethe, manager for Vattenfall's environment and development unit, told Reuters.

But he said the costs involved represented just a fraction of the potential losses the company could face if its data system breaks down when 2000 begins.

Sweden's other major nuclear power owner, Sydkraft AB, says it stepped up its millennium bug efforts after discovering computer problems could arise earlier than expected. The three-unit Oskarshamn plant, operated by Sydkraft unit OKG AB, uncovered an error which would have disturbed regulation of the reactor's feed water, likely to result in an automatic shutdown when the computer systems switched to 1999.

"We turned the clock forward in our computer system and found the reactor broke down as soon as it was confronted with the figure 1999," plant spokesman Anders Oesterberg said.

Programmers had used 999, or "zero" in computer language, to store unidentified information which interfered with the plant's operation.

Oesterberg said Oskarshamn has solved--or postponed--the problem by turning back clocks to make its data system believe that 1999 was 1991. In 2000, computers will be programmed for 1992, delaying bug problems by eight years.

"That will leave us plenty of time to replace the old computer systems," he said.

SKI's Bjoerle said there was no threat to safety from the millennium bug but merely the problem of keeping Swedes warm.

"There is no connection between the millennium and the safety of the nuclear reactor. The problem is power supply," he said.

---

Home Page