Details regarding Pakistan's nuclear arsenal are kept secret for security and strategic reasons, but experts agree on a range of assumptions and educated guesses. Pakistan is believed to have between 90 and 110 nuclear devices of both uranium and plutonium materials. They have two main delivery platforms: ground-to-ground ballistic missiles controlled by the army and slightly modified F-16 aircraft controlled by the air force. Pakistan also has a 10,000-strong security force under the Strategic Plans Division dedicated to protecting the nuclear weapons.
Individual states usually employ the same measures in securing their weapons, though the details and degree of sophistication can vary. The fissionable part of the weapon is stored separately from the detonation device, and at least one of these devices is not attached to the delivery platform. It is believed that the fissionable component is kept in a hardened structure nearby while the detonation device is stored in a separate structure or kept on the delivery vehicle itself. The Pakistanis have reported that their devices also require codes for activation once assembled. Stratfor extensively covered the network that controls nuclear stockpiles when this question first arose.
Nuclear weapons are generally kept under multiple layers of security because they are a strategic asset, and no government wants to leave their main deterrent so vulnerable that a small team could neutralize it. This means that anyone trying to access these weapons on a base would need massive intelligence capabilities to be able to locate all the necessary components, to defeat security personnel and to gain access to those components (which are stored in hardened structures behind additional layers of security), and then would have to breach the storage site.
If they were somehow able to access all of the components, they would still need the technical knowledge to assemble them as well as access to arming codes — or the ability to bypass these codes — and this would still only allow them to detonate a device. Programming, launching and delivering an armed nuclear device, if that were the intent, would be harder still.
Stealing the components from the base presents problems as well. Most of these high-profile attacks have involved eight to 15 attackers with small arms and suicide vests. The level of their equipment and execution suggests that they only planned to conduct an infiltration. On most military bases, this is not as difficult as it might seem. Bases, especially airfields, are large and have a very long perimeter physically secured by a fence. A lot of equipment and manpower are needed to secure an entire perimeter, so many facilities do not extend the effort. Even facilities that attempt to secure the entire perimeter experience failures. For example, New York City's John F. Kennedy airport is equipped with a $100,000 security system designed by Raytheon, yet it recently failed to detect a stranded jet skier walking across runways.
It is also a mistake to equate a breach of the perimeter with a breach of all the additional physical layers of defense around the nuclear devices within the post. To steal a nuclear weapon would take significantly more than eight men and would also require precise intelligence and the ability to get the team and the weapon — activated and responding with its full security component — off the post.
So far, these attacks have not demonstrated this capability and their tactics point to small teams whose main goal is to get on the post and create as much chaos and damage as possible. Their goal is to disrupt, to display the perceived vulnerability of the Pakistani security forces, and to demonstrate the attackers' striking ability. These base attacks will have to be exponentially more advanced before they can successfully steal, arm and deliver a nuclear weapon.
Attacks such as the Aug. 16 assault do highlight major deficiencies in the Pakistani security apparatus. The director of counterterrorism of the Interior Ministry's National Crisis Management Cell issued a notification Aug. 2 that an attack was in the works that would target air bases. The notification was based on a tip from the intelligence arm of the Punjab police department, which is considered one of the best intelligence agencies at providing advance warnings, and was fairly elaborate in describing the attack's tactical details — yet the attack was not prevented.
This is the essence of Pakistan's problem. It has advance intelligence of pending attacks, but that actionable intelligence somehow does not get processed in a way that would allow security forces to interdict an attack before it happens.
Still, the attackers were only able to cause minimal damage and were contained quickly (one such attack led to a 23-hour standoff) because the base's security personnel responded rapidly. The nuclear weapons were never in any serious danger of being stolen or detonated. Nuclear weapons security would be more likely to become a real concern if Pakistan were threatened by potential state collapse — echoing concerns about Syria and its chemical weapons stockpiles — and even then, Western nations would almost certainly take measures to secure the state or the weapons themselves before the devices fell into the wrong hands.