The Bunker Fallacy
Growing up in the 90s I spent many hours playing the iconic video game series fallout. The game is premised on a future where civilisation has been destroyed by nuclear holocaust. The world has become a mutilated deformed hellscape of banditry and techno-violence the only exception being a small group of society that have locked themselves away in ‘nuclear proof’ bunkers to ride out bad years until the earth can once again be terraformed. A compelling narrative for sure, which has earned its television series realised decades later however even with it’s popularity it was always based on one large misconception. The bunker fallacy.
I’m reminded of the Bunker fallacy again and again, whether it’s due to fundamentally flawed depictions in Hollywood, or posts you see around the internet from preppers. I remembered that I also saw “The bunker project” talked about in the EA community so I decided to write down my thoughts in the hope that someone else has trod this path before and can point me into the direction of actual scientific research and rational discourse on the topic. On the off-chance that I’m the first one to question Bunkers—here’s my take on the Bunker Fallacy :
--
The fallout bunker scenario was always a narrative fallacy and remains so to this day, one that countless wealthy people subscribe to and millions of dollars have been wasted on. In reality, if the planet was to be destroyed by nuclear holocaust, a rogue comet, a lethal outbreak none of these bunkers would provide the sanctity that is promised or the capability to ‘rebuild’ society.
The reason?
They’re all focussed on solving the wrong problem.
Modern bunkers are a solution to this problem :
“how to build a service that delivers value in the event of a planetary catastrophe”
Which makes initial sense, until you start to really think about it and you realise the key to building something that provides actual sanctity and the ability to rebuild society is:
“How to build a service that allows us to iterate on providing value now but could also provide value in the event of a catastrophe.”
There’s a subtle but important difference in the framing of the problem. To explain, let’s change the premise slightly, to illustrate the point.
Instead of building shelters here on earth, let’s imagine we’ve built a self-sustaining colony on the moon.
Instead of bunkers the wealthy have invested in personal rockets in their back gardens that in the event of an extinction level event they can use to quickly launch themselves out of the atmosphere and arrive at the colony on the moon to start a new life until they can return to earth to pick up the pieces. Now here comes the interesting part. Even though the rich have lavished substantial investments in these rockets
- THEY’VE NEVER FULLY TESTED THEM.
Not once end to end tested. Ok, maybe they’ve run a few engine tests here and there, tested the seats are comfy and that they can climb to the upper stage, but they’ve never actually used the rockets to escape earth’s gravity in the event of an emergency. They’ve not tested how they will get to the rocket to escape or whether they can fly to the moon through the vacuum of space, or checked if they can land on the moon in the right place or validated they can disembark and travel to the moon colony.
Are there even space suits in the rocket? Does the rocket have thrusters that allow it to do a propulsive landing? Do the stages of the rocket even separate? Is there actually still viable fuel in the rocket?
All of this is unknown and you only find out when there is a planetary catastrophe.
Let me repeat that:
YOU ONLY FIND OUT IF THIS COMPLEX SYSTEM WORKS WHEN THERE IS A PLANETARY CATASTROPHE.
And this is the problem shared with our modern day bunkers.
“They are complex solutions to a set of wicked problems that can ONLY BE TESTED WHEN THERE IS A PLANETARY CATASTROPHE.”
And this is the trap of the bunker fallacy, that no one seems particularly interested in talking about.
There are however a lot of other interesting problems to solve when looking at bunkers:
How do people pay for the bunker?
Who gets priority to get in the bunker?
How do we get the right people into the bunker before a catastrophe?
How do we vet people for long terms or contagious diseases before entering the bunker?
Where do people live in the bunker?
How do we keep the air fresh?
How do we provide power?
How do we feed people?
How do we recycle water and nutrients?
How do we provide light?
How do we construct the shelter?
What kinds of construction does the bunker need to protect people from different outside environments?
How do we govern the bunker?
How do we provide education in the bunker?
How do we provide recreation and entertainment in the bunker?
How do we provide medical care in the bunker?
What happens when the population of the bunker increases?
How do we do research and development in the bunker?
What kinds of things need to be stored to enable the reconstruction of society?
How do we store knowledge in the bunker?
etc.
And people love to get hung up on whatever they feel most able to contribute to (Parkinson’s law of triviality) but all of these problems, yes all of them are lower priority than the question of :
How can we construct a shelter that provides value—right now—so we can iterate on it?
Anyone who builds things especially software knows this premise all too well. As soon as you build something, it’s starts to rot whether it’s physical or digital (and especially the latter). The only way to have real confidence in a product is to launch it, to start getting user feedback on it, to start getting it to produce value - then you can address how iterate on it and to make sure it survives and grows. To never launch is a guarantee of failure and the Bunkers talked about in modern day discourse are premised on exactly that—never launching.
So what can we actually do to answer that question?
The answer can be found by going back to our imagined moon base scenario. Ok, so let’s assume the wealthy are not as incompetent as our bunker builders. They’ve realised they need to test their Earth escape vehicles. So when the rocket systems are completed they hop in and take a joyride to the moon colony and back. Champagne is broken, the test was a success. Now what? Well we don’t know when our earth extinction level event is going to take place, maybe in one year, our rocket probably still works? Maybe two years, maybe ten years, maybe one hundred years, maybe one thousand years?
Well our rocket definitely won’t work in one thousand years if we don’t maintain it, refuel it and regularly test it, but maintenance, refuelling and testing are expensive.
What if we run out of money?
What if we die and the rocket is passed on to our kids?
How will they know whether the rocket works or be able to afford its maintenance?
Maybe it will bleed them dry of all their inherited wealth?
Wouldn’t it be better if the rocket could pay for itself?
Indeed it would and indeed that’s the major breakthrough of the modern space industry and things like the ISS. The initial investment doesn’t just deliver value at some unspecified point in the future—it delivers value now, and that value creates an ecosystem of continued investment, a virtuous circle that allows iterative developement for an unspecified amount of time and encourages continuous testing.
That’s the secret that allows the space industry to grow and that same instrument can be exploited in the bunker industry. The question is not how we can technically achieve bunkers but how do we create a product and service that allows us to iterate on a solution that delivers value now and creates an ecosystem around it that allows it to pay for itself and deliver value long into the future—hopefully long enough that when an extinction level event does transpire it can continue to deliver value in a fully tested way.
I propose we consign the name bunker to the scrap heap of failed ideas—as a technical solution to a redundant problem and move towards “Citadelle’ as a product that provides an ongoing service with immediate value and with the long term goal of making civilization more robust by improving it’s fault tolerance, availability and disaster recovery capabilities.
Let’s imagine what our citadele could be like. The Kings School in Canterbury, UK is 1427 years old—perhaps the oldest educational institution in the world. So our citadele needs to be built keeping in mind that it could be in operation for at least one and a half thousand years, if not an order of magnitude longer. In order to keep it operational it will require a surface level town and community to maintain and improve it. It must be built symbiotically with this town providing vital services from day one to keep it relevant. Some examples of services it could provide immediately, subterranean sustainable vertical greenhouse style food growth, town water treatment, health care and recreation facilities, thermal power & electricity generation, commercial storage, military storage, research and development working spaces.
The town itself could provide a high quality education facility thus that in the time of an extinction level event, talented, educated young individuals can be rapidly moved into the bunker for safety. At the heart of this each town and educational institution needs a practical understanding and deep experience of subterranean tunnel building and continuous expansion, perhaps with the ideal of one day networking the citadelles so they form not one isolated bunker but an emergent network of specialised underground hubs. All this goes way beyond a bunker, but when you start thinking about a bunker as a self-sustaining product—these are the issues you would need to start addressing, the rest will fall into place as you go.
In conclusion, the transition from the old paradigm of isolated, untested bunkers to a new concept of a something like a Citadelle represents a profound shift in how we approach resilience and sustainability in the face of potential global catastrophes. By integrating these sanctuaries into the fabric of daily life, we not only prepare for the unknown future but also enhance our current existence with services that benefit us today. This approach ensures that our efforts in building a safer world are not wasted on speculative, dormant assets but are instead invested in living, breathing ecosystems that thrive on innovation, community, and continuous improvement. The Citadelle concept transcends mere survival, aiming to elevate humanity’s capacity for adaptability, learning, and growth, regardless of the challenges we may face. It allows us to move forward, not with fear, but with the wisdom to build infrastructures that serve us now and stand ready to protect future generations. The legacy of a Citadelle could very well be a testament to our foresight, ingenuity, and commitment to nurturing a resilient and flourishing human civilization.
You might be interested in some of the discussion that you can find at this tag: https://forum.effectivealtruism.org/topics/refuges
People have indeed imagined creating something like a partially-underground town, which people would already live in during daily life, precisely to address the kinds of problems you describe (working out various kinks, building governance institutions ahead of time, etc). But on the other hand, it sounds expensive to build a whole city (and would you or I really want to uproot our lives and move to a random tiny town in the middle of nowhere just to help be the backup plan in case of nuclear war?), and it’s so comparatively cheap to just dig a deep hole somewhere and stuff a nuclear reactor + lots of food + whatever else inside, which after all will probably be helpful in a catastrophe.
I think your essay does a pretty good job of pointing out flaws with the concept of bunkers in the Fallout TV + videogame universe. But I think that in real life, most actual bunkers (eg constructed by militaries, the occasional billionare, cities like Seoul which live in fear of enemy attack or natural disasters, etc) aren’t intended to operate indefinitely as self-contained societies that could eventually restart civilization, so naturally they would fail at that task. Instead, they are just supposed to keep people alive through an acute danger period of a few hours to weeks (ie, while a hurricane is happening, or while an artillery barage is ongoing, or while the local government is experiencing a temporary period of anarchy / gang rule / rioting, or while radiation and fires from a nearby nuclear strike dissapate). Then, in 9 out of 10 cases, probably the danger passes and some kind of normal society resumes (FEMA shows up after the hurricane, or a new stable government eventually comes to power, etc—even most nuclear wars probably wouldn’t result in the comically barren and devastated world of the Fallout videogames). I don’t think militaries or billionaires are necessarily wasting their money; they’re just buying insurance against medium-scale catastrophes, and admitting that there’s nothing they can do about the absolute worst-case largest-scale catastrophes.
Few people have thought of creating Fallout-style indefinite-civilizational-preservation bunkers in real life, and to my knowledge nobody has actually built one. But presumably if anyone did try this in real life (which would involve spending many millions of dollars, lots of detailed planning, etc), they would think a little harder and produce something that makes a bit more sense than the bunkers from the Fallout comedy videogames, and indeed do something like the partially-underground-city concept.
> But on the other hand, it sounds expensive to build a whole city (and would you or I really want to uproot our lives and move to a random tiny town in the middle of nowhere just to help be the backup plan in case of nuclear war?)
- I agree, it seems the obvious solution would be to build the citadelle on existing infrastructure and an existing town so no one need to move to the middle of nowhere. A sensible approach might be to pick towns with one existing relatively well established educational facility, and then start progressively constructing services underground to replace aging infrastructure above ground of the town like water recycling, power generation, food production, slowly making the town infrastructure more resilient and incrementally adding the extra capabiliites in as it becomes prudent.
> even most nuclear wars probably wouldn’t result in the comically barren and devastated world of the Fallout videogames
- That’s probably true, but as I understand it even a nuclear war between India and Pakistan would cause a nuclear winter large enough to cause a famine that would kill 1/3rd of the worlds population—in which case underground vertical farming—would be pretty helpful...
Executive summary: The concept of isolated, untested bunkers for surviving catastrophic events is flawed; instead, we should develop “citadelles”—self-sustaining, continuously operating facilities that provide value now and can support long-term survival if needed.
Key points:
Bunkers focused solely on post-catastrophe survival are untested and likely to fail when actually needed.
Key challenges of bunker survival (supplies, governance, population growth, etc.) are often overlooked.
To be viable, a survival facility must continuously operate and provide value to support itself over time.
A “citadelle” integrates into a town, providing services like food production, utilities, healthcare, and research.
A network of specialized, interconnected citadelles could provide long-term resilience against global catastrophic risks.
Shifting to the citadelle concept moves us from speculative survival to building robust, living systems that serve our needs now and in the future.
This comment was auto-generated by the EA Forum Team. Feel free to point out issues with this summary by replying to the comment, and contact us if you have feedback.
One problem here is that a solution that operates continuously and provides “value way before an extinction level event plays out” is likely to be much more complex—and have considerably more points of potential failure—than a simpler solution.
Imagine I have a requirement that I be able to receive radio transmissions during an emergency. I could build a fairly simple emergency radio and pressure-test it. It doesn’t provide me any value in ordinary times, so it just sits there on the shelf between pressure tests. It’s cheap, so I could build several for redundancy. I could also build a smartphone with radio capacity—this would be operated continuously and provide value in normal times. It is also much more complex and has many more failure modes than a simple radio. Many of those failure modes are common to both the ordinary-times use and the emergency-times use. But some are less so—I might not be using the radio feature on my cellphone much at all in normal times because that particular function doesn’t provide much if any pre-emergency value.
I think you’re likely accepting a significantly higher level of failure modes for a better opportunity to detect and fix them. It’s not clear to me if this is a good tradeoff or not. If you go back to the cellphone analogy, most things have to evolve and grow to continue providing enough value to justify their maintenance and operation. Maybe we could have a super-high-reliability smartphone if we locked in 2010 capabilities and worked on iterating the flaws out of it. But a 2010-level smartphone isn’t going to get much use. And adding new features and capabilities adds new points of failure, so manufacturers are stuck playing a never-ending game of whack-a-mole.
I’m reminded of the troubles that the US government has had with getting cell phones up to the point that they can handle classified information. The poor user experience of cell phones approved for even secret information famously contributed to getting a former Secretary of State into some trouble. As of 2016, phones appeared to have only been approved to the secret level (not top secret, or ~”above top secret” like certain SCIs). In contrast, we’ve had landline devices cleared for all security levels since at least 1987 (I didn’t check older devices). The security reliability risks are apparently a lot easier to manage with the simpler devices.
For similar reasons, the solution with pre-emergency value will likely be much more expensive to develop and operate. All critical components need to be hardened / highly reliable. The more you expect those components to do, the bigger / more complex they are going to be. If the power facility needs to power a small town, it will be much more expensive to harden than a solution for a bunker. If you rely on a different power solution for emergency situations and only harden that solution, then a critical system isn’t going to be regularly operated. It’s probably going to be considerably more expensive to run and maintain a hardened system than a standard one even in normal times—so normal-time operation is likely to also require some significant subsidies. As a result, you’re going to have to put a lot of eggs in a single basket for cost reasons alone.
If I take the power plant for example, let’s imagine you want to build a hardened geothermal power plant in some kind of significantly sheltered (maybe underground) environment as part of the citadelle concept. So you want a 40mwh power plant to support @30k people in the refuge. Well in normal times—that power goes straight into the grid and earns back revenue. Yes, it’s probably cheaper to build a field of solar, but not that much cheaper, Dinorwig Power Station was built in the 70′s in a mountain and that’s still cost effective today even though it’s slightly harder to build.
This is where the paradox of scale economics comes into play, the more you do something at scale, actually the lower it costs and the more simple it becomes. It’s like using rare minerals—the more you use, the greater the demand, the more get’s found in new reserves.
I do agree that you have a valid point regarding the mobile phone vs. simple radio analogy. I wonder if there’s principle that could be adopted to beat this complexity problem though—what your essentially saying is the goods produced by the modern world value chain are ill suited to a disaster scenario due to their dependency on components that could be impossible to source in a different context. Maybe a principle along the lines that any goods used in the refuge must be able to be 100% fabricated in the refuge by materials available to the refuge. The Mormons have been doing something fairly similar for decades and it seems to work quite well for them.
I am curious what you think of a first-principled approach to resiliency/preparedness? I wrote a blog post on this on LessWrong. I still have a feeling that from an individual, and perhaps from a nation state’s perspective, one will arrive at quite different resiliency measures if one carefully starts with the likelihood of different disasters affecting one’s loved ones, then the likelihood and cost of different interventions mitigating these disasters and in the end having a prioritized list of most cost-effective preparedness actions. It would, for example, surprise me if digging a hole would be a cost-effective way to avert death or permanent damage.
If we look at moon & mars colonization—radiation is a large risk, earth’s magnetic field means we don’t need to care about solar radiation so much, but there’s no reason that’s permanent, Mars also used to have a magnetic field. I think there’s something to be said for physical isolation, the more physical material you can put between yourself and other environments the smaller the chance that bad stuff get’s through your barrier and get’s to you.
Cost effective is another interesting question—if the cost of subterranean building decreases rapidly, it may be the most cost effective solution—certainly on paper it will probably cost less than space colonization as the materials are readily available along with an advanced value chain of goods and services.
I strongly agree with the first half of this post—bunkers and refuges are pretty bad as a defence against global catastrophes.
Your solution makes a lot less sense to me. It seems like it has many of the same problems you’re trying to avoid—it won’t be pressure tested until the world collapses. In particular, if it’s an active part of a local community, that implies people will be leaving and reentering regularly, which means any virus with a long incubation period could be in there before people know it’s a problem.
Also, I feel like your whole list of questions still applies, and I have no sense of how you imagine it’s going to answer them. In particular, I don’t see how digging underground is going it make it better at water treatment, electricity generation etc than the equivalent aboveground services.
Fwiw my take is that offworld bases have much better longterm prospects—they’re pressure tested every moment of every day; they perforce have meaningful isolation; the inhabitants are very strongly incentivised to develop the base to make it more sustainable as fast as possible; and once you have the technology for one, you have the technology for many, and are a long way towards developing the sort of technology that’s necessary for a future in which we (per Nick Bostrom’s Astronomical Waste essay) colonise the Virgo supercluster.
> it won’t be pressure tested until the world collapses.
- so I’m saying it should not only be pressure tested but be in continuous operation in order to flush out failure modes before a catastrophic scenario plays out, it needs to be providing value way before an extinction level event plays out.
- I agree about your point with the bio/virus with a long incubation time, I think the only way round this would be to have shifts like on an oil platform or mine, where different groups spend a period of time (say 1-3 months) working in isolation from the general population.
> I don’t see how digging underground is going it make it better at water treatment, electricity generation etc than the equivalent aboveground services.
- it may not make it better but would make it more resilient, an open water treatment plant for example is going to become immediately polluted with nuclear dust if is built in standard outdoor settings, where as an isolated underground facility would be protected from that risk. A geothermal power plant may not be more efficient than a wind turbine or solar panels, but again is more resilient to hurricanes or nuclear winter.
> Fwiw my take is that offworld bases have much better longterm prospects—they’re pressure tested every moment of every day;
- I agree they are better as they are pressure tested by necessity, to do this on-world we have to simulate the necessity, in my mind it’s good to have 3 options, 1) Don’t destroy earth’s ecosystem 2) Have off-world bases 3) Have Citadelles or something similar - They each address different needs, 1) Addresses Reliability, 2) Redundancy 3) Disaster recovery.
This seems to rely on an assumption that the failure modes that would exist in “normal mode” are related or correlated, to a fairly high degree, to the failure modes that could show up in “catastrophic mode.” That’s not obvious to me.
I’m not sure, if you look back at Biosphere 2 for example a large number of the failure modes were identified fairly early on. In my experience there are two things that cause unexpected failure modes, scale and duration. i.e. running something at a larger scale than was previously tested can often reveal unintuitive failure modes and running something for longer that previous can reveal failure modes.
I get what your saying that running a service in a different environment to what it was tested in can cause unforseen issues, but I think with simulation and testing like they did for bejing airport or the kind of testing they do at SpaceX—we should be aiming to test these things to failure points.