President Trump recently vowed that North Korea’s threats of nuclear war “will be met with fire, fury and frankly power, the likes of which the world has never seen before.”

In response, North Korea fired back with a threat of its own. The Korean People’s Army claimed in a statement that it was looking into a plan to hit Guam, a U.S. territory, with missiles that would create an “enveloping fire” around the island. His recent claim of a the test detonation of a hydrogen bomb added to the growing tensions in the region.

And, so it goes in Korea, threats and counter-threats, escalating tensions, and ominous fears of a catastrophic thermonuclear confrontation on the Korean Peninsula.

All this international tension leads to concerns about our nuclear launch protocols. Are the security systems and fail-safe protocols sufficient for today’s threats?

Despite persistent global efforts at non-proliferation, nine nations possess nuclear weapons (including North Korea). The nuclear arsenals of Russia and United States alone have sufficient firepower to destroy each other several times over and to bring an end to the human race in the process.

Moscow and Washington still posture their nuclear forces so that they can be ordered to fire in minutes, a dangerously outdated strategy from the Cold War. In a military confrontation, leaders will have little warning of a potential nuclear attack and only minutes to respond. Once a missile is in the air, even if fired by mistake, there is no way to order it back. A launch decision would be irrevocable and could lead to existential disaster.

As a result of this hair trigger response time, our nuclear arsenal is under very strict security controls. Intercontinental ballistic missile silos in the west and ballistic attack submarines around the world run regular drills to ensure the security protocols are strictly adhered to. The routine is to drill, drill, drill.

Launch teams on the subs and in the silos practice their launch routines on virtually a daily basis to ensure they can be executed flawlessly, with absolute precision, and without hesitation. As a result of this attention to launch protocol detail, we are told there is very little chance of a mistaken launch.

For example, in the case of Minuteman missile launch crews, once a launch order is received, both operators must agree that it is valid by comparing the authorization code in the order against a Sealed Authenticator (a special sealed envelope which holds the code).

These Sealed Authenticators are stored in a safe which has two separate locks. Each operator has the key to only one lock, so neither can open the safe alone. Also, each operator has one of two launch keys; once the order is verified, they must insert the keys in slots on the control panel and turn them simultaneously. A total of four keys are thus required to initiate a launch.

For additional protection, the missile crew in another launch control center must do the same for the missiles to be launched. As a further precaution, the slots for the two launch keys are positioned far enough apart to make it impossible for one operator to reach both of them at once.

A similar “two man” security procedure is used on nuclear submarines. On a submarine, both the commanding officer and executive officer must agree that the order to launch is valid and then mutually authorize the launch with their operations personnel. Instead of another party who would confirm a missile launch as in the case of land-based ICBMs, the set of keys is distributed among the key personnel on the submarine and the keys are kept in safes (each of these crew members has access only to his or her launch keys).

Some keys are stored in special safes on board which are secured by combination locks. Nobody on board has the combination to open these safes; the combination to unlock the safes comes as a part of the launch order (Emergency Action Message) from the president.

That scenario was featured in the box office hit movie Crimson Tide in which a ballistic submarine captain (Gene Hackman), a seasoned combat veteran, and his executive officer (Denzel Washington), a well-educated young officer with no combat experience, fail to concur on the Emergency Action Message resulting in the Executive Officer taking command away from the captain in what the latter called a mutiny. Ultimately, there was no launch of nuclear weapons and the movie had a happy ending.

While military officers charged with the firing of nuclear weapons at the launch site drill constantly to ensure their total readiness to carry out the launch order, the situation at the other end of the chain of command is less clear.

Of course, only the president has the authority to launch a nuclear strike. Accordingly, the president is always accompanied by a military aide carrying a “football,” a metal brief case in a leather jacket which contains the launch codes for nuclear weapons.

There are four things in the football. The “Black Book” containing the retaliatory options, a book listing classified site locations, a manila folder with eight or ten pages giving a description of procedures for the Emergency Alert System, and a three-by-five inch card with the authentication codes.

If the president (commander-in-chief) decided to order the use of nuclear weapons, he or she would be taken aside by the “carrier” and the briefcase opened. A command signal, or “watch” alert, would then be issued to the Joint Chiefs of Staff. The president would then review the attack options with the aide and decide on a plan, which could range from a single cruise missile to multiple ICBM launches.

Before the order can be processed by the military, the president must be positively identified using a special code issued on a plastic card, nicknamed the “biscuit.” The United States has a two-man rule in place, and while only the president can order the release of nuclear weapons, the order must be confirmed by the Secretary of Defense.

Once all the codes have been verified, the military would issue attack orders to the proper units. These orders are given and then re-verified for authenticity. It is argued that the President has almost singular authority to initiate a nuclear attack since the Secretary of Defense is required to verify the order, but cannot legally veto it.

So, all in all, the system at the president’s end is pretty vague. Under the stress of the moment, catastrophic mistakes could be made.

This raises the question of how often, if ever, the president does a dry run-through of the launch procedures… reviewing the contents of the football, coordinating the potential attack with senior nuclear weapons military personnel and the Secretary of Defense, and testing their ability to react calmly and rationally to an attack. With the enormously busy schedules presidents manage on a daily basis, who knows how frequently, if at all, that kind of preparation for the unthinkable occurs.

The regular drills at the other end of the chain of command at the launch sites are designed to ensure that the procedures become virtually automatic. They are meant to ensure that there are no mistakes and that the systems all proceed smoothly.

The same should be true at the Commander-in-Chief end of the nuclear launch chain of command. In fact, it is all the more important, as that is probably the most dire and existential responsibility the president has. It would be tragic, indeed, if the first time the president dealt with the black football was not a drill, but the real thing.