The Second That Has Never Been Subtracted

On June 29, 2022, Earth finished one rotation 1.59 milliseconds early — the shortest day ever recorded since atomic clocks began keeping score. [S1] Four weeks later, on July 26, it nearly broke its own record at minus 1.50 milliseconds. [S1] The people who run the world's clocks have been quietly bracing for impact ever since.

Here is the situation. Atomic time — TAI — does not wobble. Earth time — UT1 — does, because Earth does. UTC is the diplomatic compromise that splices them together: a clock that ticks at the atomic rate but is yanked back into agreement with the planet by one-second corrections called leap seconds. For five decades every single one of those corrections has been an addition, because tidal friction from the Moon has been bleeding rotational energy out of Earth. [S1]

Then the planet started speeding up.

Duncan Agnew, a geophysicist at Scripps, published a paper in Nature in March 2024 working out what this means. [S1] His finding: if the current drift continues at roughly 0.09 seconds per year, the world will need to subtract a leap second — a negative leap second, the first in history — around 2029. [S1] The mechanism is a roughly fifty-year acceleration in Earth's liquid outer core. [S1] What is hiding the full size of that acceleration is, of all things, Greenland and Antarctic ice melt: meltwater redistributes mass from the poles toward the equator, and a fatter equator spins slower, the way a skater slows by extending her arms. [S1] Without that ice loss, Agnew calculates, the negative leap second would already be due in 2026. [S1]

Climate change is the reason we have a three-year stay of execution.

Not everyone agrees we will use it. Judah Levine, the NIST physicist who maintains U.S. civil time, told NPR that short-term trends in the core "come and go," that "past is not a good predictor of the future" here, and puts the probability of a negative leap second in the next decade at roughly 30 percent. [S4] Three other scientists in the same story called Agnew's evidence compelling. [S4] The disagreement is real, and the people having it run the actual clocks.

What is not in dispute is what happens if the call comes.

A negative leap second means that at the end of some UTC day, the clock skips from 23:59:58 directly to 00:00:00. [S6] The timestamp 23:59:59 — which has appeared every single day for the entire history of computing — does not exist on that one day. Agnew's paper notes the operational status plainly: a negative leap second has never been added or tested. [S1] Linux, Windows, GPS receivers, financial-exchange matching engines, electrical-grid protective relays, NTP daemons, the database row that records when the row was written: none of them have ever seen this.

We do know what happened the last time the clock did something unusual. On June 30, 2012, a positive leap second inserted the timestamp 23:59:60. A Linux kernel bug in the hrtimer subsystem livelocked CPUs when the time-adjustment path re-entered itself, and Reddit, Mozilla, LinkedIn, Yelp, FourSquare, Gawker, and StumbleUpon went down. [S5] Amadeus Altea, the airline-reservation system used by Qantas and Virgin Australia, was offline for about an hour; ground staff checked passengers in by hand. [S5] Engineers had been explicitly warned the leap second was coming. [S5]

The 2017 positive leap second produced a subtler failure that is the closer analogue to 2029. At Cloudflare, custom DNS resolver code in Go used time.Now() to compute round-trip time to upstream resolvers. When the leap second was applied, time.Now() briefly returned an earlier value than the previous reading, and the rtt went negative. [S3] That negative number was passed into rand.Int63n, which panics on non-positive arguments. [S3] About 0.2 percent of DNS queries failed at peak across 102 data centers; the fault was contained in 90 minutes. [S3] The fix was a single character: a == 0 check on rttMAX became <= 0. [S3]

One character. In a codebase written by some of the best systems engineers on the planet. Triggered the first time wall-clock time briefly ran backwards.

A positive leap second at least produces a new legal value — 23:59:60 — that parsers have to handle. A negative one produces no new values; it just deletes one.

Now apply that bug class — wall-clock time running backwards — to every retry-and-backoff loop, every TTL calculation, every "has this token expired" check, every sequence of database commits that assumes timestamps are monotonic. A positive leap second at least produces a new legal value, 23:59:60, that parsers have to handle; a negative one produces no new values, it just deletes one. The bug surface is everything that assumes the deleted second will exist.

There is a workaround, sort of. Google's Public NTP uses what it calls a leap smear: clocks are slewed across a wide window around the event so no single second is ever skipped. [S6] For a negative leap second, the smear runs from noon to noon UTC and speeds clocks up across 86,399 seconds. [S6] This works inside Google. It breaks the moment your fleet is heterogeneous, because smeared time is not legal UTC, and Google's noon-to-noon window does not match AWS's smear, which does not match Meta's. [S6] A bank with servers in three clouds and GPS-disciplined market-data feeds will, during the smear, see up to roughly a second of skew between machines that are nominally telling the same time. [S6] Google's own documentation acknowledges that the smear is a workaround, not a fix. [S6]

In November 2022, the world's metrology authorities agreed. At the 27th General Conference on Weights and Measures, the CGPM passed Resolution 4: the maximum tolerated difference between UT1 and UTC will be widened, in or before 2035, to a value large enough that the change is "imperceptible to most users." [S2] The ITU ratified it at WRC-23 in December 2023. [S2] The leap-second mechanism is being retired.

One country voted no: Russia. [S2] The reason is buried in spacecraft design. GPS broadcasts a separate offset from UTC and ignores leap seconds entirely, which is why your phone does not crash twice a decade. [S4] GLONASS, the Russian equivalent, broadcasts UTC directly, leap seconds baked into the signal, and Russia reportedly asked the CGPM for an extension to 2040 to give the constellation time to migrate. [S4] The vote went against them.

Which leaves the timeline nobody planned. The mechanism is being retired in 2035. [S2] Agnew's central estimate says we need the first-ever negative leap second around 2029. [S1] If Agnew is right and Levine is wrong, every computer connected to the internet will execute, exactly once, an unprecedented operation — and then, six years later, the rule that demanded it will be repealed. If Levine is right, the engineering panic was for nothing and the mechanism quietly sunsets without ever firing in reverse.

Nobody knows which it will be. The core's recent excursion has not been seen before in the atomic-clock era. [S1] The ice-melt mask is itself an active, changing signal. [S1] The only people who could tell you for sure are the people whose code has never been run.