Security Engineering: Part 8. Nuclear Command and Control as well as Security Printing and Seals

The Architectural Conflict Between Two Types of Failure

In the security engineering of critical-purpose systems such as Nuclear Command and Control (NC2), the key task is resolving a fundamental design contradiction. This contradiction is formulated as a balance between two types of failure:

1. False-positive failure (Fail-Safe / Unauthorized action): The weapon is used without an explicit, legitimate order from the national leadership (as a result of a technical malfunction, sabotage, operator insanity or a cyberattack).
2. False-negative failure (Fail-Deadly / Failure to execute an order): A legitimate order to use the weapon cannot be carried out because communication channels have been destroyed, control systems suppressed, the leadership killed, or the actuating mechanisms have technically failed.

Military doctrine demands high combat readiness of the system (a guarantee of response), while civilian control demands absolute safety (a guarantee of non-use without authorization). Historically the priorities shifted. During the Cold War period (especially before the early 1960s) the Fail-Deadly concept prevailed, since the USA and the USSR feared a "decapitating" first strike. Later, with the development of technical means of control, the focus shifted toward Fail-Safe without losing the guaranteed retaliatory potential.

The Authorization Model: The "Authorization, Environment, Intent" Triad

The modern NC2 architecture is based on strict physical and logical separation of the components that must coincide in order to place a warhead into an armed state and initiate detonation. Security is built on three independent vectors (criteria):

                     ┌─────────────────────────────┐
                     │  NC2 authorization criteria │
                     └──────────────┬──────────────┘
                                    │
         ┌──────────────────────────┼──────────────────────────┐
         ▼                          ▼                          ▼
┌──────────────────┐       ┌──────────────────┐       ┌──────────────────┐
│   Authorization  │       │   Environment    │       │      Intent      │
│ (Cryptographic   │       │  (Physical       │       │   (Deliberate    │
│     order)       │       │     sensors)     │       │  action from     │
│                  │       │                  │       │  outside)        │
└──────────────────┘       └──────────────────┘       └──────────────────┘

1. Authorization

A purely logical control. The warhead is locked at the software-hardware level. To remove the lock, the correct digital code (unlock key) must be entered into its controller, transmitted over protected communication channels from the highest command. Without this code the detonators are physically isolated from the high-voltage capacitors.

2. Environment

Physical control of the environment. The warhead does not rely on the code alone. Internal sensors (environment integrators) must register a flight physical profile unique to the specific type of delivery vehicle:

• For intercontinental ballistic missiles (ICBMs): prolonged acceleration (g-force sensors), the state of weightlessness (orbital flight), the subsequent deceleration in the dense layers of the atmosphere and the drop in atmospheric pressure.
• For cruise missiles: the specific vibration profile of an air launch, barometric pressure and the readings of the radar altimeter.

If the warhead electronics receive the authorization code but the sensors do not register an overload of 10g over the specified time, the detonation circuit is blocked permanently (the logic protecting against an attempt to blow up the missile right in the silo is triggered).

3. Intent

An external trigger requiring an explicit physical action by the operator or by the external environment immediately before launch. This prevents accidental activation during maintenance work. For example, the need to pull out a physical strike wire as the missile leaves the silo or as a bomb is released from a strategic bomber.

Mathematical Apparatus and Cryptographic Protocols

The transmission of orders and the separation of authority in NC2 systems require mathematical guarantees that are resistant to interception, message substitution and insider attacks.

Unconditionally Secure Authentication

Under conditions of nuclear war, the use of asymmetric cryptography (RSA, ECC) carries risks: computational complexity, vulnerability to future quantum algorithms, or hidden mathematical defects. Therefore, for the transmission of orders (Emergency Action Messages — EAM) unconditionally secure authentication based on one-time codes is used (an analogue of the One-Time Pad for authentication).
The system uses an authentication function in which the probability of successfully imposing a false message (with an allowance for any computational power of the adversary) is strictly bounded mathematically:

P_success = 1 / |A|

where |A| is the size of the space of authenticators (codes). Operators in the field have paper or electronic tables (codebooks) of one-time codes. The order contains a line that is checked against the next legitimate value. If the characters do not match, the message is ignored at the hardware level.

Secret Sharing Schemes

A nuclear launch requires the exclusion of the "one-person rule" (No-Lone-Zone). No single person — neither the president, nor a general, nor a silo operator — must have the technical ability to initiate a strike alone. For this, cryptographic secret sharing is applied.

Shamir's (t, n) Scheme

To recover the activation key K it is necessary to collect t shares out of the total number n of distributed shares. The scheme is built on Lagrange polynomial interpolation over the finite field GF(p).
Let the secret be the constant term of a polynomial of degree t-1:

f(x) = a_0 + a_1x + a_2x^2 + ... + a_t-1x^t-1 (mod p)

where a_0 = K (the secret key), and the coefficients a_1... a_t-1 are chosen randomly.
Each of the n participants is issued a point (x_i, y_i), where y_i = f(x_i).

• If t participants are collected, they can unambiguously reconstruct the polynomial and find a_0 through the formula:

f(0) = t^∑_j=1 * y_j * П_m ≠ j * x_m / x_m - x_j (mod p)

• If t-1 participants are collected, the system of equations becomes underdetermined: for an attacker the value of the secret K remains equally probable among all elements of the field GF(p), which gives absolute information-theoretic strength.

The Geometry of Threshold Schemes

In the simplest case (2, 2) the secret is the point of intersection of two straight lines on a plane. One operator knows the equation of one line, the second — of the other. The point (the secret) can be found only by combining both graphs. In the case (2, n) the secret is the point of intersection of lines, where each operator is given one unique line passing through that point.

The Hardware Level of Security: PAL Devices (Permissive Action Links)

Historically, before the introduction of PALs, thermonuclear bombs stored at NATO bases in Europe were protected only by physical guards (fences and soldiers). In the event of a base being seized by allies (for example, Turkey or Germany during a hypothetical split of NATO) or by terrorists, the bombs could technically have been dropped and detonated without US involvement.
To prevent this, PAL (Permissive Action Links) devices were developed — specialized hardware code locks integrated deep into the physical structure of the munition.

                     ┌──────────────────────────┐
                     │   Fire signal            │
                     └────────────┬─────────────┘
                                  ▼
                     ┌──────────────────────────┐
                     │ High-voltage stage       │
                     │ (Closed only with a PAL) │
                     └────────────┬─────────────┘
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │         Physical warhead casing                  │
         │  ┌────────────────────────────────────────────┐  │
         │  │              PAL unit                      │  │
         │  │ ┌───────────────┐        ┌───────────────┐ │  │
         │  │ │ Code receiver │        │ Code selector │ │  │
         │  │ └───────┬───────┘        └───────┬───────┘ │  │
         │  │         │                        │         │  │
         │  │         └───────────┬────────────┘         │  │
         │  │                     ▼                      │  │
         │  │         ┌───────────────────────┐          │  │
         │  │         │ Critical component    │          │  │
         │  │         │ (Lithium battery)     │          │  │
         │  │         └───────────┬───────────┘          │  │
         │  └─────────────────────┼──────────────────────┘  │
         │                        ▼                         │
         │           ┌──────────────────────────┐           │
         │           │   Detonator system       │           │
         │           └──────────────────────────┘           │
         └──────────────────────────────────────────────────┘

The Evolution of PAL Categories:

• PAL Category A/B (1960s): Simple electromechanical switches controlled by 3- or 4-digit codes. Entry was performed manually with the help of portable consoles. The main vulnerability was the possibility of guessing the code on site or physically bypassing the contacts.
• PAL Category D (1970s): Introduction of 6-digit codes, support for multiple codes (training code, combat duty code, emergency lockout code). Appearance of the limiting of entry attempts function. When an incorrect code was entered a specified number of times, the device temporarily locked itself or initiated internal destruction of critical circuits.
• PAL Category F (1980s — present): 12-digit digital codes. Integration with environmental sensing devices (ESD). Control not merely by closing contacts, but by activating critical components without which the physical process of converging the fissile material is impossible (for example, activating tritium boosting or controlling high-voltage switches — krytrons).

Tamper Resistance & Non-Violent Destruction

An attacker may try to disassemble the bomb, extract the plutonium core and detonate it with his own explosive. To exclude this scenario, PAL units are integrated on the principle of active tamper resistance:

1. Sensing envelopes: The PAL components are surrounded by layers of ultra-thin energized conductors, optical fibers or capsules with gas under pressure. Any attempt to drill the casing, cut it with a laser or dissolve it with acid disturbs the capacitance, conductivity or pressure.
2. Non-Violent Destruction: When an attempt at opening is detected — when tampering is registered — the automation activates small shaped charges inside the munition. They do not cause a nuclear explosion (since the geometry of simultaneous compression of the core is violated), but they physically destroy the electronic control boards, turn the plutonium sphere into a shapeless lump of metal and disable the detonators. The weapon becomes unusable.

System Failures, Protocol Defects and Real Incidents

The history of NC2 demonstrates that the greatest risks lie at the junction of rigid instructions, equipment failures and the human factor.

Case 1: The Degradation of Security Codes to "00000000"

The most egregious example of the conflict between combat readiness (Fail-Deadly) and safety (Fail-Safe) occurred with the American Minuteman ICBMs in the period from 1962 to 1977. The Strategic Air Command (SAC) feared that at the moment of a nuclear strike on the USA the communication lines would be cut and the PAL codes from the president would not reach the launch silos.
As a result, the generals de facto nullified the PAL protection: on the launch consoles the secret 8-digit unlock code was set to the value 00000000. Combat control officers were instructed to verify that exactly zeros had been entered on the consoles and to record this in the instructions. The security of the entire system for 15 years rested exclusively on the physical guarding of the silo perimeter.

Case 2: False Alarms and Defects of Early-Warning Systems

Missile attack early-warning systems are directly integrated into the NC2 loop. Failures in them nearly led to the automatic authorization of a launch-on-warning retaliatory strike:

• 9 November 1979 (USA): Into the central NORAD computer (North American Aerospace Defense Command) a duty operator accidentally loaded a training tape simulating a massive launch of Soviet ICBMs from submarines and silos. The system issued the highest alarm priority. Interceptors were scrambled, the president's aircraft was prepared for takeoff (National Emergency Airborne Command Post). The alarm was cancelled only after cross-checking the data with the direct-detection radars, which had registered no actual launches.
• 26 September 1983 (USSR): The "Oko" satellite detection system issued a signal about the launch of five American Minuteman ICBMs from US territory. Lieutenant Colonel Stanislav Petrov, who was the operational duty officer at the Serpukhov-15 command post, analyzed the situation and classified the alarm as false. His logic was based on systemic analysis: a nuclear attack by a superpower cannot begin with only five missiles — this is doctrinally meaningless (a first strike is always massive in order to devalue air defense/ABM). It later emerged that the satellite's sensors had taken the reflection of sunlight from high-altitude clouds for the flashes of launching missiles.

The Insider Problem and the Two-Key Model in Field Conditions

At the lowest level (inside a launch silo or aboard a submarine) a strict verification protocol operates:

• Two officers are at a distance that excludes simultaneous pressing of the buttons or physical influence on each other (the consoles are separated by more than 2–3 meters).
• The launch keys must be turned synchronously to within a fraction of a second.

However, let us point out the vulnerabilities of the EAM-message verification protocol. If one of the officers is an insider (or has developed acute psychosis), he can use violence against his partner. At American facilities, to minimize this, combat control officers carry firearms and have a rigid instruction to open fire to kill upon any unauthorized actions by a colleague.

Summary for the Security Engineer

Designing NC2-class systems gives IT architects and security engineers the following lessons:

1. Protection must be multi-vector: One cannot rely only on cryptography (the logical level) or only on safes (the physical level). True reliability arises at the junction of the cryptographic order and the verification of the physical environment (ESD).
2. Remember operational pressure: If a security system makes the performance of the main business function (or combat mission) too difficult in a critical situation, the personnel will find a way to bypass the protection (as in the case of the "00000000" code). Security design is obliged to take into account the stressed state of the operator.
3. Information-theoretic strength above all: For long-lived critical infrastructure systems, the basic control commands must be encoded by methods that do not depend on future technological breakthroughs by the adversary (the use of one-time codes and Shamir schemes instead of vulnerable mathematical assumptions).

The Physical Level of Security and the Threat Model

Security engineering often focuses on logical and cryptographic mechanisms; however, in the real world digital systems are closely tied to physical media: banknotes, passports, identity documents, cheques, tickets and certificates. Security printing solves the task of authenticating a physical object and preventing its counterfeiting, copying or unauthorized modification (modification of data).

Classification of Attackers (Threat Model)

When designing security printing systems, the threat model classifies potential attackers by the level of available resources, equipment and qualification:

1. Casual Fraudsters (Opportunists): Private individuals using publicly available office equipment (inkjet and laser printers, household scanners, color copiers) to forge travel documents, tickets or small-denomination notes. Their goal is to deceive an inattentive checker during a cursory inspection.
2. Organized Crime (Professional Criminal Syndicates): Groups with access to written-off or semi-professional printing equipment (offset presses, screen printing). They are able to procure specialized inks and paper through roundabout channels, and also to hire qualified technologists.
3. State-Sponsored Attackers (State Intelligence Services): The maximum-level violator. Possesses unlimited resources, its own paper mills, chemical laboratories and the ability to order original printing presses from the world's leading manufacturers (for example, KBA-NotaSys). The goal is the mass destabilization of the adversary's economy (the production of supercounterfeits such as "superdollars") or providing agents with perfect cover documents.

Substrates: The Basis of Physical Protection

The protection of a printed document begins not with the ink, but with the material onto which it is applied. The main goal is to make the substrate unique, unavailable on the open market and physically resistant to the chemical removal of text.

Paper Substrates and Their Modification

Security paper is made from cotton or linen fiber (unlike commercial wood-pulp paper). This gives it a characteristic tactile crispness, wear resistance and chemical neutrality.

• Absence of optical brighteners: Ordinary office paper contains fluorescent substances that glow bright blue under ultraviolet (UV) radiation. Security paper remains UV-dull (black). This is a basic filter that makes it easy to detect a counterfeit printed on household material.
• Watermarks: Formed during the process of casting the paper web by changing the density and thickness of the fibers with the help of a special mesh roller (a dandy roll). One-tone (light or dark) and multi-tone (filigree) watermarks with smooth gray transitions are distinguished. A genuine watermark is located inside the structure of the paper; it is impossible to fully imitate it by overprinting or oiling, since it changes its optical properties both in transmitted light and in reflected light.
• Security fibers and planchettes: Silk or synthetic fibers (visible, invisible, fluorescing under UV or IR radiation) are chaotically introduced into the paper mass at the production stage, as well as microscopic disks (planchettes). Any attempt to extract them with a needle destroys the structure of the paper.
• Security Threads: Polymer strips introduced inside the paper web. They may be fully hidden (visible only in transmitted light) or "windowed" (emerging onto the surface of the paper at certain points). Modern threads contain microtext, demetallized elements and optically variable effects.

Polymer and Hybrid Substrates

Since the end of the 20th century (first mass-implemented in Australia), polymer substrates have been actively used (for example, biaxially oriented polypropylene — BOPP).

• Advantages: The service life of banknotes increases 3–5 times; they are resistant to water and dirt. Polymer allows the creation of absolutely transparent windows with diffractive elements, which are impossible to reproduce on paper or ordinary plastic.
• Composite/Hybrid materials: Multilayer sandwiches (for example, paper coated with thin layers of plastic, or vice versa). They combine the tactile properties of paper and the technological protection of polymers.

Industrial Printing Technologies

A highly protected document is never printed in a single pass on a single machine. A combination of several fundamentally different ways of applying ink is used.

                    ┌───────────────────────────────┐
                    │  Security printing methods    │
                    └───────────────┬───────────────┘
                                    │
       ┌────────────────────────────┼────────────────────────────┐
       ▼                            ▼                            ▼
┌──────────────┐             ┌──────────────┐             ┌──────────────┐
│ Intaglio     │             │ Letterpress  │             │ Offset       │
│              │             │              │             │ (Orlov/Dry)  │
└──────────────┘             └──────────────┘             └──────────────┘

1. Intaglio (Intaglio Metallographic Printing)

The main element protecting banknotes and passports from copying.

• Technology: The design is etched or engraved on metal plates (forms), forming recesses. Thick ink is packed into these recesses under high pressure and at elevated temperature. The paper is literally pressed into the form.
• Effect: The ink lies on the substrate as a thick, three-dimensional relief layer. The thickness of the ink layer can reach tens of micrometers. This creates a unique tactile effect (felt by the fingers). In addition, under high pressure the paper itself deforms, forming an embossing on the reverse side. Copiers and desktop printers are fundamentally incapable of reproducing this three-dimensional relief.

2. Letterpress

Used mainly for applying unique identifiers — serial numbers.

• Technology: The printing elements are located above the non-printing areas. Ink is applied to the protruding parts of the metal type, which are then pressed against the paper.
• Effect: At the edges of the letters or digits the ink is squeezed outward, forming a characteristic dark rim (ink squash). At the point of impact of the type, a noticeable micro-relief (an indentation) remains on the paper, visible in raking light.

3. Offset Printing and the Orlov Effect (Simultan/Orlov Printing)

Used for creating background meshes and complex graphic patterns.

• Guilloche meshes: Complex geometric patterns of interwoven thin lines (less than 50–80 µm thick), constructed according to strict mathematical formulas. When scanners attempt to digitize such a mesh they inevitably introduce distortions (discretization), which leads to the appearance of the Moire effect when a copy is printed.
• Orlov printing: A technology in which inks of different colors are assembled on a single printing form from different templates, and their transfer onto the paper occurs in one pass. This allows an ideal, sharp transition of one line color into another to be achieved without breaks, shifts or overlaps. On ordinary offset machines each color requires its own pass, which inevitably causes micro-shifts (misregistration of inks) noticeable under a magnifying glass.

4. Materials Science: Security Inks and Pigments

The chemical composition of security inks is strictly classified. They are classified by the types of physico-chemical triggers that activate their properties.

Optically Variable Ink (OVI)

Contains microscopic interference flakes. The color of the ink changes radically depending on the viewing angle (for example, from green to a clearly defined violet, or from gold to green). Copying on a color photocopier captures only one viewing angle, turning the element into a pale monochrome spot.

Luminescent and Metameric Inks

• UV- and IR-luminescence: Inks invisible in daylight but glowing brightly in a certain color (green, red, yellow) when irradiated with UV light of a specific wavelength (usually 254 nm or 365 nm). Similarly, IR-active inks are used (which glow or, conversely, absorb IR radiation, disappearing from IR cameras).
• Metameric Inks (Metameric pairs): Two pigments are selected so that under ordinary daylight they look absolutely identical (for example, brown). However, when viewed through a special optical filter or under certain artificial lighting, one pigment absorbs light differently, and a hidden design or text appears against a uniform background.

Chemically Reactive Inks (Reactive Inks)

Protect the document from unauthorized modification of data (erasure, etching). If an attacker tries to wash off the ink of a serial number or the amount of a cheque using household solvents (acetone, alcohol, chlorine bleach), the reactive inks of the background mesh instantly enter a chemical reaction. They are either washed away completely (exposing a white spot) or change color to bright blue/brown, irreversibly spoiling the document and making the attempt at falsification obvious.

Documents: Passports and Visa Stamps

A modern passport is a complex distributed security system combining physical, optical and digital layers of control.

1. Stitching and assembly: The pages of the passport are sewn with a special multicolored thread that fluoresces under UV. The stitching method excludes the possibility of neatly extracting one page and replacing it with another without destroying the entire spine.
2. Perforation: The passport serial number is often applied by laser perforation through all the sheets. The laser burns conical holes (the hole on the first page is larger than on the last), and the edges of the holes have a characteristic charring trace, which excludes forgery by drilling or piercing with a needle.
3. Data Page: The most critical element. It is now made of monolithic polycarbonate. The holder's data and photograph are applied by laser engraving inside the structure of the plastic at different depths, rather than printed on top. It is impossible to change such a photograph without melting the polycarbonate plate itself.
4. Connection with the logical level: Inside the data page there is a contactless RFID chip (ICAO standard / ICAO Doc 9303). On the chip, in encrypted form signed with a state key (digital signature), the same biometric data and photo are stored that are physically printed. Physical protection prevents quick "on-the-knee" forgery, while the digital signature makes it impossible to create a completely fake passport capable of passing automated border control (e-Gate).

Physical Packaging and Tamper Indicators (Seals and Tamper-Evident Packaging)

The protection of material objects and their distribution channels (from containers with nuclear waste to envelopes with bank PIN codes) relies on the concept of sealing. The main task of a seal or protective packaging is not to prevent physical intrusion (locks and barriers serve that purpose), but to leave irreversible and obvious evidence of an attempted access (Tamper Evidence).

Substrate Properties in Packaging Systems

As in security printing, the effectiveness of a seal depends on the material of its base. High-tech sealing tapes and stickers are made from specialized polymers (for example, polyester or brittle vinyl) with controlled cohesive strength.
When an attempt is made to peel off a protective sticker, a controlled destruction of the material structure occurs. The seal delaminates, and hidden text irreversibly appears on the surface (usually the words "VOID" or "OPENED"). It is impossible to re-stick such a tape without noticeable seams and distortion of the graphics.

The Problems of Glue

Glue is the key and at the same time the most vulnerable element of physical sealing. Most commercial adhesives (including hot-melt adhesives and pressure-sensitive adhesives — PSA) are susceptible to chemical and thermal exposure:

• Temperature attacks: Cooling the seal with a freeze spray (liquid nitrogen or freon) makes the adhesive layer brittle like glass. In this state adhesion falls almost to zero, allowing the attacker to carefully separate the seal with a blade, carry out unauthorized manipulations and, after waiting for it to warm up, stick it back on. The reverse method is controlled heating with a hair dryer to soften the glue.
• Chemical solvents: The use of specialized organic solvents (heptane, acetone, xylene) allows the chemical bonds of the glue to be temporarily weakened without destroying the polymer substrate of the seal itself.

Engineering protection: Modern security inks on seals are mixed on components soluble in the same solvents as the glue. When a chemical attack is attempted, the design of the seal instantly "runs" or changes color.

Envelopes for the Secure Mailing of PIN Codes (PIN Mailers)

A classic example of protective packaging in banking engineering is envelopes for sending PIN codes to customers (PIN Mailers). Their task is to guarantee that no one, including postal or bank employees, intercepted the four-digit code during delivery.

Design Methods of Protection:

1. Background Scrambling (Disorientation matrix): The inner side of the envelope is covered with a dense, chaotic printing mesh (often black or dark blue). This makes it impossible to read the text hidden inside by transmitted light using a powerful directional light source.
2. Carbonless/Impact Transfer (Carbon and chemical transfer): The PIN code itself is not printed with ink by a printer on top of the envelope. Instead, a high-speed dot-matrix or impact printer strikes the outside of the sealed multilayer envelope. The energy of the impact is transmitted through the layers, destroying microcapsules with a special dye on the inner secret layer. The text is formed inside the already closed packet.
3. Protection against delamination: The edges of the envelope are bonded by ultrasonic welding or cryogenic glue. An attempt to open the envelope with steam or a blade leads to the tearing of the paper fibers, which makes the fact of compromise obvious to the end customer.

System Vulnerabilities and the Specifics of the Threat Model

Physical security depends critically on the human factor and on organizational procedures built into the overall system architecture.

Peculiarities of the Threat Model

Unlike cryptographic systems, where an attack often occurs remotely and unnoticed, an attack on physical seals requires direct contact. This dictates its own conditions:

• Time Window (The time factor): The violator needs time to carry out a careful attack (freezing, applying solvents, restoring the structure). If the seal is checked every 15 minutes, a complex attack becomes unrealizable. If a container travels by ship for a month without inspection — the attacker's hands are untied.
• Insider Threat (Insiders): The most dangerous category of violators. Security service or warehouse employees have legitimate access to the original sealing tools, to the databases of numbers, and can replace seals entirely.

The "Gundecking" Phenomenon (Anti-Gundecking Measures)

The term gundecking comes from the navy and means the falsification of inspection reports (when an inspector signs the seal inspection checklist without even approaching the guarded object).
If inspectors are tired, inattentive or motivated to finish their shift faster, they ignore the minor signs of seal tampering (glue traces, micro-scratches). Attackers actively exploit this, counting on the "cursory glance" of the checker.
Counteraction methods (Anti-Gundecking):

• Use of random non-correlatable identifiers: Each seal has a unique serial number and barcode that the inspector is obliged to scan (or manually enter into a terminal), rather than simply confirm the fact that a seal is present.
• Two-factor control: Inspector A installs the seal and records the number in a cryptographically protected database; inspector B at another node checks the number upon the actual arrival of the cargo, without knowing in advance which number should be there.
• Dynamic seals: Modern electronic seals generate a random cryptographic code (token) at the moment of closing. Upon unauthorized opening of the circuit, the internal log is cleared (Zeroization) or generates an alarm code that cannot be hidden during inspection.

Materials Control

It is useless to develop the most protected seal in the world if the attacker can legally, or through a front person, buy its exact copy in an online store.

• Manufacturers of top-level protection systems strictly control distribution channels. Each batch of sealing materials (tapes, plastic or lead seals, specialized rivets) is marked with unique customer logos and serial ranges.
• The disposal of defective and used seals in production is strictly regulated. A violation of materials control completely nullifies the strength of the system, turning inspection into a fiction (Security through obscurity).

Cost and Inspection Methodology

Designing protection systems is always an economic balance (Security Economics). A mistake made by many engineers is concentrating on the cost of the seal itself, whereas the main operating costs fall on the process of its inspection and verification.

The Economics of Control:

1. Nature of Inspection: A quick visual inspection is cheap but misses skilled attacks. Inspection using microscopes, UV scanners and chemical tests guarantees the detection of a counterfeit, but sharply reduces the throughput of the node (for example, a customs terminal) and requires expensive staff training.
2. Evaluation Methodology: For the certification of physical protection systems the "Red Teaming" approach is applied. A specialized independent laboratory (Black Hat / Penetration Testing Group) receives samples of packaging or seals and attempts to open them by all available methods (including chemical, thermal and mechanical), striving to restore the original appearance of the object. The level of protection of a seal is measured by the time (T) and the qualification/tools (E) necessary to accomplish an undetected bypass.

Summary

The physical level of security (Security Printing & Seals) obeys the same fundamental laws of engineering as software-hardware complexes:

• Defense in Depth: No single element (be it a watermark, OVI ink or a Void effect) provides one hundred percent protection by itself. Security is achieved through the synergy of the substrate, the printing, the chemical triggers and strict organizational control procedures.
• Weakest Link: A security printing or sealing system breaks not where complex technologies are used, but where a tired inspector carelessly checked a serial number (gundecking) or where an attacker was able to buy an original form/seal on the black market because of a failure in materials accounting.

Scaling, System Concepts and NC2 Hardware Traps

The Permissive Commanded Actions System and the Two-Key Communication Protocol

In a distributed nuclear command and control system it is critically important to protect the communication channels not only against the forgery of orders (intrusions), but also against the blocking of legitimate commands (DoS attacks). The architecture for transmitting Emergency Action Messages (EAM) is designed as a redundant mesh network. Signals are duplicated simultaneously in several media:

• High-frequency (HF) radio networks.
• Very-low-frequency (VLF) transmitters for communication with submarines at depth.
• Protected satellite channels (MILSTAR).
• Ground-based fiber-optic and seismic cables.

At the same time, message encoding at the physical level uses error-correcting coding algorithms (for example, Reed-Solomon codes), which makes it possible to recover 100% of the order text even with the loss of up to 30–40% of packets or the physical destruction of some repeaters by the electromagnetic pulse (EMP) of a nuclear explosion.

The Two-Key Problem on Strategic Bombers

There is a specific organizational protocol aboard long-range aviation aircraft (B-52, B-2). Unlike an underground ICBM silo, where officers are separated by physical distance, in the pilots' cockpit everyone is in a confined space. To prevent the seizure of control by one insane crew member, the safe with the PAL codes has two independent mechanical locks. The key to one lock is held by the aircraft commander, to the second — by the navigator. The protocol requires mandatory mutual isolation when checking EAM codes against the one-time code books (Sealed Authenticator Systems — SAS).

PAL Hardware Design: The Concept of "Critical Nodes"

At the microelectronic level, the PAL unit is embedded directly into the architecture of the detonation system so that it cannot be shunted (voltage applied bypassing the logic).

[Order / PAL code] ──> [PAL decoder] ──> [IR emitter node] ──> [Optical barrier] ──> [Photodiode] ──> [Detonation stage]

For this, optical isolation is used: upon receiving the correct code, the PAL decoder activates a unique encoded light or laser pulse inside a closed opaque chip. This pulse opens a phototransistor that passes the high-voltage charge to the detonators. Any attempt to physically solder a wire to the detonator circuit from outside leads to a violation of the geometry of the optical pocket and the blocking of the system.

Commercial Fraud, Holograms and Attacks on Logistics

Technical Vulnerabilities of Holograms (Kinegrams / Holograms)

Many engineers mistakenly consider holograms to be "absolute protection" (a Silver Bullet). [the book] demystifies this illusion in detail.
First-generation holograms (2D/3D), often used on commercial goods and software, are easily counterfeited by criminal groups using commercially available photolithographic matrices or the electroforming method (copying the relief of the original hologram by creating a metal copy of its surface).

The engineering solution — Kinegrams:
Unlike ordinary holograms, kinegrams use mathematically calculated diffraction gratings. When the angle of inclination changes, the elements of the design do not merely shimmer with the colors of the rainbow, but perform a controlled logical movement (for example, a wheel "rotates", an arrow "moves" left and right). It is much simpler for a person to verify a kinegram, and it is practically impossible to imitate it by an artisanal sputtering method, since sub-micron precision of the grating pitch is required.

The Specifics of Document Protection: Cheques and Drafts

In the banking sector, the protection of paper cheques against modification includes the use of artificial-type watermarks and chemically reactive paper:

• Protection of the amount: The place where the amount of the cheque is written is covered with an invisible layer of manganese or iron salts. When an attempt is made to use a chemical ink erader (for example, a chlorine-containing bleach) to change the figure "100" to "10000", the paper at the point of contact instantly turns a persistent brown or black color.
• Microtext as a line: The lines on which the customer signs, under a magnifying glass, turn out to be a continuous string of small-font text (0.25 mm high), for example: VALIDDOCUMENTVALIDDOCUMENT. A household copier does not have sufficient resolution (DPI) to reproduce these letters and turns them into a blurred solid line. When checked under a magnifying glass, the forgery is revealed instantly.

Protection of Commercial Brands and Excise Stamps (Brand Protection)

For mass markets (alcohol, medicines, cigarettes) the cost of a single protective unit is critically important. Here Taggant technology (micromarkers) is applied:
Microscopic synthetic nanoparticles or rare-earth elements are mixed into the ink or varnish. They possess a unique luminescence spectrum when irradiated by a specialized laser scanner. This method makes it possible to automate inspection on the conveyor: the scanner reads the spectral "signature" of the ink and instantly rejects counterfeits, even if the packaging has been visually copied perfectly.

Summary System Analysis: What IT Engineers Can Learn from Physical Security

Let us give direct parallels between physical and digital protection mechanisms, building up the concept of unified security engineering:

Physical security mechanism	Digital analogue in IT systems	Systemic meaning
PAL devices (warhead code locks)	Hardware security module (HSM / TPM chip)	Isolation of critical keys from the main operating system.
Guilloche meshes and microtext	Digital watermarks (Watermarking) / Steganography	Protection of content from unauthorized copying and distribution.
Tamper indicators (VOID tapes)	Write-once logs (Append-Only Logs / Blockchain)	The impossibility of hiding the fact of unauthorized access or data modification.
Shamir's secret sharing scheme (t, n)	Multisignature (Multisig) / Separation of roles (M-of-N)	Exclusion of system compromise due to a single compromised administrator (an insider).
The Gundecking phenomenon (inspector negligence)	Alert Fatigue (SOC analysts' fatigue from false positives)	The human factor ignores attack indicators if there are too many of them or if the verification process is over-complicated.

Final Conclusion

The main lesson of the article is that security is a process, not a product. High-tech ink, Shamir's cryptographic protocol or a PAL controller are useless if the organizational procedures around them (Materials Control, supply chain audits, combating staff negligence) fail. The engineer must design the system taking into account the worst-case scenario: when the attacker has unlimited time, access to equipment, and the checking personnel are fatigued and inattentive.