When I recently told former CIA director James Woolsey that the USSR had built a doomsday device, his eyes grew cold. “I hope to God the Soviets were more sensible than that.” They weren’t…

Perimeter ensures the ability to strike back, but it’s no hair-trigger device. It was designed to lie semi-dormant until switched on by a high official in a crisis. Then it would begin monitoring a network of seismic, radiation, and air pressure sensors for signs of nuclear explosions. Before launching any retaliatory strike, the system had to check off four if/then propositions: If it was turned on, then it would try to determine that a nuclear weapon had hit Soviet soil. If it seemed that one had, the system would check to see if any communication links to the war room of the Soviet General Staff remained. If they did, and if some amount of time—likely ranging from 15 minutes to an hour—passed without further indications of attack, the machine would assume officials were still living who could order the counterattack and shut down. But if the line to the General Staff went dead, then Perimeter would infer that apocalypse had arrived. It would immediately transfer launch authority to whoever was manning the system at that moment deep inside a protected bunker—bypassing layers and layers of normal command authority. At that point, the ability to destroy the world would fall to whoever was on duty: maybe a high minister sent in during the crisis, maybe a 25-year-old junior officer fresh out of military academy. And if that person decided to press the button … If/then. If/then. If/then. If/then…

By guaranteeing that Moscow could hit back, Perimeter was actually designed to keep an overeager Soviet military or civilian leader from launching prematurely during a crisis. The point, Zheleznyakov says, was “to cool down all these hotheads and extremists. No matter what was going to happen, there still would be revenge. Those who attack us will be punished.”