Photos: Heesoon Yim/AP Photo; Right: U.S. Navy

SPACE COLLISION: At a press conference at the Pentagon on 21 February, General James Cartwright, vice chairman of the U.S. Joint Chiefs of Staff [left], points to a photo of an errant U.S. satellite being destroyed by an interceptor missile. The rocket had been launched from a U.S. Navy Aegis cruiser and hit the satellite 247 kilometers above the Pacific Ocean.

Assessing technological risk is a thorny enough problem here on Earth, even with our experience and our intuition about familiar uncertainties, factors, and processes. But transport the problem into the unearthly venue of outer space, where human experience is limited, and sound assessment becomes astronomically more challenging.

A notable and illuminating case in point was the U.S. decision earlier this year to use a missile to knock out a derelict spy satellite, to head off the possibility of its splashing a half ton of toxic hydrazine fuel somewhere on Earth. That official explanation of the shootdown—and, it turns out, an entirely plausible and credible explanation—nonetheless met with a chorus of public criticism and skepticism. Coming as it did barely a year after China shot down one of its satellites with a missile, in what struck many observers as an obvious antisatellite weapon demonstration, the U.S. shootdown was widely, but I believe incorrectly, seen as a response to that event.

To be sure, the shootdown of the U.S. satellite was an impressive feat of technology. The Navy missile launched on 21 February 2008 achieved a head-on collision with the 2.3-metric-ton USA 193, dispersing the contents of the vehicle's propellant tank [see photo, “Hydrazine Bomb”] harmlessly in space. To accomplish the intercept, military teams had to reprogram the guidance system of an antimissile missile designed to target much slower and lower missiles. That meant designing an intercept orbit that maximized the infrared brightness of the target and provided a ground track subsequent to the intercept that passed mostly over water or lightly populated regions for the first few hours. It also meant training the missile's onboard computer not only to home in on the rapidly approaching target outline but also to shift position at the last possible millisecond to hit a “sweet spot,” behind which the fuel tank was installed.

Photos: Heesoon Yim/AP Photo; Right: U.S. Navy

HYDRAZINE BOMB: This is the near-spherical 1.04-meter-diameter tank that held toxic hydrazine fuel, which could have reentered the atmosphere and hit Earth as a liquid, still largely coherent mass.

“We were operating on the margins of a system well engineered for a different job,” a high official at the U.S. Department of Defense's Missile Defense Agency told IEEE Spectrum, with a request that his name not be used. No wonder reporters and the sources they tend to rely on were so quick to dismiss the official story.

John Pike, who has been one of Washington's most frequently quoted space technology specialists for two or three decades, told reporters that “the claim there was a danger from the fuel is not the most preposterous thing the Pentagon has ever said—but it seemed to be a bit of a stretch.” Science commentator Noah Shachtman, blogging for Wired magazine approvingly quoted an unnamed space security expert‚ who told him: “The cynic in me says that the idea that this was being done to protect the lives of humans is simply a feel-good cover story tossed to the media. Having the U.S. government spend millions of dollars to destroy a billion-dollar failure to save zero lives is comedic gold.”

Despite the superficial plausibility of such attitudes, a careful reconstruction of the analyses and reviews that led to the shootdown decision shows that the official explanation was in fact the real explanation and that compelling considerations of health and safety required that the satellite be taken out.

NASA administrator Michael Griffin, whose specialists performed an independent hazard analysis of US 193 that confirmed the Pentagon's conclusions, stated the reason for the shootdown. “The analysis that we've done is as certain as any analysis of this type can be,” he told a press conference on 14 February. “The hydrazine tank will survive intact [because] the hydrazine in it is frozen solid. Not all of it will melt. So you will land on the ground with a tank full of slush hydrazine that would then later evaporate.”

How did NASA and the Pentagon arrive at that conclusion? To find out I talked with the two top space officials involved in the deliberation: General Kevin Chilton, commander of the U.S. Strategic Command, Offutt Air Force Base in Nebraska, and Nicholas Johnson, chief scientist for orbital debris at NASA's Johnson Space Center in Houston.

Gen. Chilton says he was first approached in a hallway at Cape Canaveral while attending a December 2007 military summit meeting on satellite launch costs. The head of the National Reconnaissance Office, Scott Large, wanted to discuss a problem satellite. “I'm worried about the reentry,” Chilton recalls Large telling him. “My experts tell me it's going to survive reentry.”

Large told Chilton he had already approached the Missile Defense Agency commander to alert him to the problem. Soon Chilton and his space staff would be sucked into a Christmas holiday crash-study project. Within weeks, they were briefing the National Security Council, and then the president.

When they got to work, NASA's Johnson points out, there was already a long-standing risk-level metric for satellite operations. Hazard mitigation efforts are deemed necessary beyond a certain threshold number—a 1:10 000 chance of human fatality.

In the past, some heavy satellites with faltering control systems, such as the Compton Gamma Ray Observatory in early 2000, were deliberately deorbited over open ocean before control was lost and a random fall became inevitable. In the case of Compton, NASA had estimated from the beginning that the chances of human casualties from a random fall were 1:1000, 10 times as high as the safety threshold.

Because of such considerations, for most of the space age, almost all of the heaviest satellites—the Soviet Salyut space stations, U.S. military reconnaissance birds, Russian supply drones, and so on—have used their rocket engines to terminate their flights safely. Yet a lot of supposedly expert commentary failed to recognize the prevalence of that active safety measure. “In the history of the space age, there has not been a single human being who has been harmed by man-made objects falling from space, [so] there has to be another reason behind this,” said Michael Krepon, a founding member of the Henry L. Stimson Center in Washington, D.C.

Just how dangerous was USA 193? Lt. Gen. Henry Obering, head of the U.S. missile defense effort, announced the quantitative reasons for the likelihood of human casualty from the satellite's reentry in a television interview on 20 July: “It varied depending on which experts we talked to, but [we got] anywhere between [a] 1 in 45 and 1 in 25 chance,” he said.

“Clearly nothing prior to USA 193 rose to that level,” Johnson had told me earlier. “The risk posed was much higher than any risk we've ever seen.”

What made US 193 so singularly dangerous was its toxic fuel payload. “If it had just been hardware, we would never have considered these extraordinary measures,” says Chilton. The presence of the toxic chemical, in a tank that was completely full because the payload had failed immediately after launch, was the unusual driving factor, Johnson concurs.

A graphic illustration of the nightmare scenario preoccupying Johnson and Chilton occurred in October 2004, when an off-course Chinese spy satellite's film canister smashed through the roof of a four-story apartment building in the village of Penglai in southwest Sichuan. But with USA 193, could the hydrazine have actually reached the surface in a sufficient concentration to hurt anyone? Wouldn't the tank be consumed by the heat of atmospheric entry and disintegrate high above Earth? Here, much press commentary was led astray by a popular misconception.

There is a widespread notion that meteorites falling to Earth arrive red hot, sometimes releasing superheated fumes or setting brush fires, as a result of the tremendous heating during their passage through the atmosphere. But this is untrue. Small meteorites actually fall to the ground cold, and under humid conditions they can even briefly form frost on their surfaces. Though a thin outer layer is briefly exposed to very hot air, for most of the descent that air is thinner than the purest vacuum inside thermal-shielding thermos bottles.

NASA's Johnson explains the factors used by his team to calculate the likely thermal history of the hydrazine in the satellite's tank and conclude that it would still be frozen on reentry. Heat coming into the structure would be absorbed by the thermal inertia of the ice, or if it reached sufficient levels, by the heat of the fusing chemical itself as it partially melted. “Hydrazine requires a tremendous amount of energy to go from solid to liquid,” he points out.

Those results are described in a paper by a NASA contractor and have withstood the scrutiny of independent specialists. Andrew Higgins, an associate professor of mechanical engineering at McGill University, in Montreal, researched the scenario and published his results online. Claims that the tank would be destroyed were “written in apparent ignorance of well-established heat transfer relations for spacecraft reentry,” he said. “Simple estimates of the total heat transfer to the tank upon reentry, available in any number of aerospace textbooks, show that the heating of the tank would probably not have been sufficient to melt the hydrazine entirely, much less vaporize or ignite it.”

When it came to making the final decision, Chilton and Johnson refer to what they call the “regret factor”—the issue of what might follow from a decision to simply do nothing. “At the end of the day,” asks Chilton, “how could we look somebody in the eye who had relatives killed or injured?”

Chilton attended the White House briefings where President George W. Bush was given the options and the odds, and he remembers Bush's specific directive that if something could be done to mitigate the risk to human life, it had to be done. But what about the risk of people saying it's really an antisatellite test, Chilton recalls asking the president. He says Bush responded, “I don't care what people will say. We're doing it for the right reason, and it's transparent.”

If amateur experts were quick to express skepticism, real experts knew better. Anatoly Perminov, a former Russian general once in charge of his country's military space program and now the head of the civilian Russian Federal Space Agency‚ told Russian reporters on 16 February: “In the given situation—if the satellite is indeed out of control—destroying it is the inevitable and right thing to do, I think.”

Despite such statements from people not always trusting of U.S. motives, the U.S. press to a great extent echoed those portraying the USA 193 shootdown as aggressive and militaristic, an excuse to threaten China, or a backdoor gimmick to test space weapons. As a result, a well-defined and thoroughly researched technological hazard assessment—of a kind that someday, for better or worse, will be needed again—has wound up buried in obscurity and obfuscation. This is not an encouraging starting point for the next time such analyses might be invoked.