Thursday 15 October 2026
Evening Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

US Air Force pilots used malware-ridden USB drives for mission planning, says former security official

Justin Henkel recounts early 2000s practices that preceded a major Pentagon malware infection in 2008

By LineZotpaper
Published
Read Time2 min
US Air Force personnel in the early 2000s routinely used USB flash drives bought from local markets, including in Afghanistan, to transfer mission data between unclassified and classified systems — a practice that introduced malware into sensitive networks and ultimately led to a Pentagon-wide ban on removable media after a 2008 worm attack attributed to Russian groups.

Justin Henkel, now CISO of IT monitoring company SolarWinds and formerly an IT security officer for the Air Force, described the practice in a recent interview. He said that before USB drives became common, pilots burned mission data onto CDs that were then loaded into both unclassified and classified systems as well as into aircraft to assist navigation and threat awareness. When thumb drives arrived, pilots began using them the same way.

“They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said. “Using the same device for both, they didn't understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.”

Compounding the risk, personnel often bought flash drives from local vendors rather than military suppliers. In Afghanistan, Henkel said that meant “going out into the local market in Kabul” and building relationships with vendors. “Hey I need 100 USB sticks,” he recalled.

Henkel said he raised concerns as a junior officer but was ignored. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they're doing is a violation.”

The vulnerability was exploited in 2008 when an infected USB drive was attached to a laptop with access to US Central Command. The resulting worm, Agent.BTZ, could collect data and communicate with remote servers. A 2016 report from the FBI and DHS attributed the malware to Russian groups. It took the Pentagon 14 months to scrub the worm and led to a ban on USB drives that same year. The drives were permitted again under restricted conditions in 2010.

§

Analysis

Why This Matters

  • The incident reveals how operational convenience in combat zones can create critical cybersecurity vulnerabilities, even in the world's most powerful military.
  • The 2008 Agent.BTZ worm demonstrated the real-world consequences of such practices and shaped Pentagon policy on removable media for years.
  • The story underscores the challenge junior security staff face when trying to correct risky behavior by senior officers.

Background

In the early 2000s, the US military relied heavily on removable media to transfer mission planning data because networked classified systems were not always connected. USB drives were cheap and fast but lacked the security controls later enforced. The Pentagon eventually banned them in 2008 after the Agent.BTZ outbreak, which is widely considered one of the first major cyberattacks on US military networks attributed to a state actor. Henkel's account, published years later, provides a behind-the-scenes view of the culture that led to the breach.

Key Perspectives

[Pentagon and military command]: The Department of Defense eventually recognized the threat and imposed a comprehensive ban on removable media in 2008, later allowing USB drives under strict controls in 2010, prioritizing security over convenience. [Front-line personnel and mission planners]: Pilots and support staff needed a quick, practical way to move data between unclassified planning tools and classified mission systems, especially in forward-deployed locations where official supply chains were slow. [Security professionals and skeptics]: Critics argue the military should have anticipated the risk earlier, especially given the known threat from state actors, and that relying on locally purchased hardware in conflict zones was a serious oversight.

What to Watch

  • Whether current US military policies on removable media have evolved to address similar threats from modern attack vectors like supply-chain compromised devices.
  • Potential further details from former military personnel about other unacknowledged operational security gaps.
  • Heightened attention to the role of junior IT security staff in reporting and escalating risks within hierarchical organizations.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe