A History of Dead Man's Switches: Brakes to Bitcoin

The Long, Strange Career of the Switch That Fires When You Stop

In 1872, George Westinghouse patented an air brake for trains that had a counterintuitive design choice baked into it. If the engineer let go of the handle, the brakes engaged. If the brake line was severed, the brakes engaged. If the train broke in half, the brakes engaged. The system was designed so that the default state — the state when nobody was actively keeping it from happening — was the safe state.

Westinghouse called it a fail-safe. The rest of the world eventually called it a dead man's switch (or, just as often, a dead man switch — the apostrophe drifts in and out across the literature), and the concept has spent the next 150 years quietly underpinning some of the most consequential systems humans have ever built.

This is a tour of where it came from, where it ended up, and why an idea that started with steam-era railroad safety is now the most interesting primitive in digital estate planning.

1872 — The Train That Stops When You Let Go

Before Westinghouse, train brakes worked the way most things in the 19th century worked: a human turned a wheel and hoped. Each car had its own brake. Slowing the train down required a coordinated team of brakemen, balanced on top of moving cars, manually applying brakes one car at a time. Accidents were constant.

The Westinghouse air brake replaced all of that with compressed air running through a single line down the length of the train. Pressure in the line kept the brakes off. Lose pressure — for any reason — and the brakes slammed on at every car simultaneously.

The genius wasn't the mechanism. It was the inversion. Safety became the default. Action was required to override it. Negligence couldn't fail dangerously, because negligence and danger were on opposite sides of the lever.

1900s — The Cockpit and the Dead Man's Handle

The phrase "dead man's handle" itself comes from electric trains. The London Underground in the early 1900s ran trains driven by a single operator. If the driver had a heart attack or fell asleep, the train would keep accelerating into the tunnel.

The fix was a spring-loaded handle. The driver had to actively hold it. Let go — for any reason at all, including the obvious one the name implied — and the train cut power and braked.

Aviation picked up the same idea decades later. Modern airliners have what's called an alerter or pilot-incapacitation monitor. If no control surface moves and no button is pressed for some interval, the system asks the pilots if they're awake. If they don't answer, it escalates.

The pattern is the same one Westinghouse hit on. You don't ask the human to remember to stay alive. You ask the human to actively assert that they're still here, and you assume the worst if they don't.

1985 — The Soviet Dead Hand

The most famous dead man's switch in history isn't supposed to exist. The Soviets called it Perimetr. The Americans, when they eventually learned about it, called it Dead Hand.

The scenario it was designed for was the one neither side wanted to talk about: what happens if a first strike decapitates the Soviet leadership before they can authorize retaliation? The Soviets' answer was a system of seismic sensors, radiation sensors, and pressure sensors monitoring the major Soviet cities. If those sensors detected what looked like a nuclear strike, and if the Soviet leadership stopped responding to a heartbeat signal for long enough, Perimetr would launch a small command rocket. That rocket would broadcast a launch authorization code to every silo in the country.

Nobody fully agrees on whether Perimetr was ever fully automatic. The remaining ambiguity is, weirdly, the point. The whole strategic value of Dead Hand was that the other side didn't know whether decapitating the Soviets would actually prevent retaliation. The uncertainty did the deterrence work.

2010 — Insurance Files

When WikiLeaks started publishing US diplomatic cables, Julian Assange did something that made every government nervous. He published a 1.4 GB encrypted file called insurance.aes256 and seeded it on every torrent tracker that would carry it. Nobody had the key. Yet.

The implied threat was clear: if anything happens to me, the key gets released, and you get every unredacted cable at once.

This was a dead man's switch, but as a coercion device rather than a safety mechanism. The same primitive, weaponized. What made it work was the asymmetry. Distributing the ciphertext was cheap and irreversible. Releasing the key was a single Twitter post away. The cost of the threat was zero. The cost of ignoring it was catastrophic.

2020s — On-Chain and In-Browser

The descendants of Westinghouse's brake handle live on in a few places. They live in the check-in mechanisms inside services like ours, where a missed check-in eventually delivers encrypted files to the people you chose. They live in smart contracts on Ethereum that watch for owner inactivity and execute on-chain transfers. They live in legal templates law firms use for emergency-access protocols.

The substrate keeps changing. Steam, compressed air, electrical relays, ballistic missiles, BitTorrent, Ethereum. The pattern doesn't.

You don't make people remember. You make the system assume the worst if they ever stop showing up. Westinghouse figured that out 150 years ago, and the engineers building the systems your family will rely on after you're gone are still using his idea.

The deadman switch isn't new. The only thing that's new is that we finally figured out how to apply it to the part of your life that needed it most — and the part you spent the longest pretending didn't.

A History of Dead Man's Switches: From Locomotive Brakes to Nuclear Codes to Bitcoin