Pakistani jihadists attacked Pakistani nuclear sites three times since 2007

concern, however, is that most of Pakistan’s nuclear sites are close to or even within areas dominated by Pakistani Taliban militants and home to al-Qaeda.

Detailing the actions taken by Islamabad to safeguard its nuclear assets from external attacks, Gregory writes that Pakistan has established a “robust set of measures to assure the security of its nuclear weapons.” These have
been based on copying US practices, procedures and technologies, and comprise: a) physical security; b) personnel reliability programs; c) technical and procedural safeguards; and d) deception and secrecy.

In terms of physical security, Pakistan operates a layered concept of concentric tiers of armed forces personnel to guard nuclear weapons facilities, the use of physical barriers and intrusion detectors to secure nuclear weapons
facilities, the physical separation of warhead cores from their detonation components, and the storage of the components in protected underground sites.

With respect to personnel reliability, Gregory says the Pakistan Army conducts a tight selection process drawing almost exclusively on officers from Punjab Province who are considered to have fewer links with religious extremism (now increasingly a questionable premise) or with the Pashtun areas of Pakistan from which groups such as the Pakistani Taliban mainly garner their support. Pakistan operates an analog to the U.S. Personnel Reliability Program (PRP) that screens individuals for Islamist sympathies, personality problems, drug use, inappropriate external affiliations, and sexual deviancy.

The army uses staff rotation and also operates a “two-person” rule under which no action, decision, or activity involving a nuclear weapon can be undertaken by fewer than two persons. In total, between 8,000 and 10,000 individuals from the SPD’s security division and from Pakistan’s Inter-Services Intelligence Directorate (ISI), Military Intelligence and Intelligence Bureau agencies are involved in the security clearance and monitoring of those with nuclear weapons duties.

Gregory says despite formal command authority structures that cede a role to Pakistan’s civilian leadership, in practice the Pakistan Army has complete control over the country’s nuclear weapons. It imposes its executive authority over the weapons through the use of an authenticating code system down through the command chains that is deployment sites, aspects of the nuclear command and control arrangements, and many aspects of the arrangements for nuclear safety and security (such as the numbers of those removed under personnel reliability programs, the reasons for their removal, and how often authenticating and enabling (PAL-type) codes are changed).

In addition, Pakistan uses deception — such as dummy missiles — to complicate the calculus of adversaries and is likely to have extended this practice to its nuclear weapons infrastructure.

Taken together, these measures provide confidence that the Pakistan Army can fully protect its nuclear weapons against the internal terrorist threat, against its main adversary India, and against the suggestion that its nuclear weapons could be either spirited out of the country by a third party (posited to be the United States) or destroyed in the event of a deteriorating situation or a state collapse in Pakistan, says Gregory.

At another point, however, Gregory says that “despite these elaborate safeguards, empirical evidence points to a clear  set of weaknesses and vulnerabilities in Pakistan’s nuclear safety and security arrangements.”