Two-man rule


The two-man rule is a control mechanism designed to achieve a high level of security for especially critical material or operations. Under this rule all access and actions require the presence of two authorized people at all times.

United States: nuclear weapons

Per US Air Force Instruction 91-104, "the two-person concept" is designed to prevent accidental or malicious launch of nuclear weapons by a single individual.
In the case of Minuteman missile launch crews, once a launch order is received, both operators must agree that it is valid by comparing the authorization code in the order against a Sealed Authenticator. These Sealed Authenticators are stored in a safe which has two separate locks. Each operator has the key to only one lock, so neither can open the safe alone. Also, each operator has one of two launch keys; once the order is verified, they must insert the keys in slots on the control panel and turn them simultaneously. As a further precaution, the slots for the two launch keys are positioned far enough apart to make it impossible for one operator to reach both of them at once. For additional protection, the missile crew in another launch control center must do the same for the missiles to be launched. A total of four keys are thus required to initiate a launch.
On a submarine, both the commanding officer and the executive officer must agree that the order to launch is valid and then mutually authorize the launch with their operations personnel. Instead of another party who would confirm a missile launch as in the case of land-based ICBMs, a third officer - the Weapons Officer - must also confirm the launch. In addition, the set of keys is distributed among the key personnel on the submarine and the keys are kept in safes. Some keys are stored in special safes on board which are secured by combination locks. Nobody on board has the combination to open these safes; the unlock key comes as a part of the launch order from the higher authority.
Journalist Ron Rosenbaum has pointed out that, once the order is issued, the process is entirely concerned with authenticating the identity of the commanding officers and the authenticity of the order, and there are no safeguards to verify that the order or the person issuing it is actually sane. Notably, Major Harold Hering was discharged from the Air Force for asking the question, "How can I know that an order I receive to launch my missiles came from a sane President?"
The two-man rule only applies in the missile silos and submarines; there is no check on the US president's sole authority to order a nuclear launch.

Cryptographic material

Two-person integrity is the security measure taken to prevent single-person access to COMSEC keying material and cryptographic manuals. TPI is accomplished as follows:
At no time can one person have in his or her possession the combinations or keys to gain lone access to a security container or cryptographic equipment containing COMSEC material. Neither can one person have sole possession of COMSEC material that requires TPI security.

No-lone zone

A no-lone zone is an area that must be staffed by two or more qualified or cleared individuals. Each individual must be within visual contact of each other and in visual contact with the critical component that requires a no-lone-zone area designation. A no-lone zone may contain a cryptographic component, weapon system hardware under test, a nuclear weapon or active nuclear weapon controls.
In the United States Air Force policy concerning critical weapons, a no-lone zone is an area in which the presence of a single individual is prohibited. The two-person concept requires the presence of two individuals knowledgeable of the task to be performed, and capable of detecting an incorrect or unauthorized procedure on the part of the other regarding the task being performed.

Other uses

The two-man rule is used in other safety critical applications where the presence of two people is required before a potentially hazardous operation can be performed. This is common safety practice in, for example, laboratories and machine shops. In such a context, the additional security may be less important than the fact that if one individual is injured the other can call for help. As another example, firefighters operating in a hazardous environment function as a team of at least two personnel. There are commonly more than one team in the same environment, but each team operates as a unit.
Dual keys require the authorization of two separate parties before a particular action is taken. The simplest form of dual key security is a lock that requires two keys to unlock it. The two keys would be in the possession of two separate persons. The lock could only be opened if both parties agreed to open it and at the same time. In 1963, Canada accepted having American W-40 nuclear warheads under dual key control on Canadian soil, to be used on the Canadian BOMARC missiles.
Similarly, many banks implement some variant of the two-man rule to secure large sums of money and valuable items. Under this concept, unlocking the vault requires two individuals with different keys if the vault is secured by a key lock system. For bank vaults secured by combination lock, one individual will know half of the combination and a second person will know the remaining half. At no point will either person know the other person's half of the lock combination, requiring both persons to be physically present in order to unlock the vault.
As an extension of the broader rationale for the "two-man rule", regulations for some companies or not-for-profit organizations may require signatures of two executives on checks. These rules make it harder for an individual acting alone to defraud the organization.
Some software systems enforce a two-man rule whereby certain actions can only take place if approved by two authorized users. This helps prevent expensive errors, and makes it more difficult to commit fraud or embezzlement. While such requirements are common in financial systems, they are also used in controls for critical infrastructure, such as nuclear reactors for electrical power generation, and dangerous operations, such as biohazard research facilities.
Finally, the testimony of two witnesses is valuable in various situations to deter a wrongful act or a false accusation of one, or to prove that a wrongful act occurred.
In some correctional facilities inmates may be given a "two man rule" designation, which means that a minimum of two correctional officers must be utilized to move that particular inmate, primarily due to disciplinary reasons or possible officer safety issues.

Civilian aircraft

In late March 2015 many national aviation authorities and/or airlines made the cockpits of aircraft in flight mandatory "two-man" or "no-lone zones" as a result of the Germanwings Flight 9525 crash. Early on in the investigation of that crash, it was believed from the cockpit voice recorder audio, and later supported by flight data recorder information, that the co-pilot deliberately crashed the aircraft after locking the cockpit door when the captain left to use the toilet.

In popular culture