Early in the 2000s, US Air Force pilots and mission planners faced a practical headache in Afghanistan. They needed to move data between unclassified computers and secure systems, then load it into aircraft computers for navigation and threat awareness.
Compact discs worked at first: crews burned the mission files onto a disc, loaded it onto the classified network to finish the plan, then put the disc in the jet. Then flash drives arrived.
Justin Henkel watched this shift with growing alarm. Now chief information security officer at SolarWinds, he served as an Air Force security specialist during those years. He saw pilots adopt USB sticks without grasping the new dangers. They crossed security boundaries with the same device. The same stick that touched unclassified systems went into classified ones and straight into aircraft mission computers.
“They didn’t really think about the overall impact of classified versus unclassified systems,” Henkel told The Register. “Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.”
The sourcing made matters worse. Official military suppliers proved hard to use in theater. Personnel bought drives from local Afghan vendors instead. Shops in Kabul. Markets in other cities. Henkel did it himself. He’d build relationships with sellers. Order in bulk. “Hey I need 100 USB sticks.”
But enemies paid attention. Adversaries began seeding the local supply chain with infected drives. A stick bought for convenience could arrive pre-loaded with malware. One that had touched an unclassified laptop might later reach a classified network. Or an airplane. The risks stacked up fast.
Henkel raised objections. As a young officer in his early 20s, he confronted higher ranks. Colonels. Majors. He called the practice a clear violation. The response left him stunned. “It was just a shock,” he recalled to The Register. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation.”
Nobody listened. Operational tempo in Afghanistan left little room for theory, and the convenience of removable media won out.
In 2008 the warnings materialized on a larger scale. An infected USB drive plugged into a laptop connected to US Central Command. The worm, Agent.BTZ, spread rapidly. It collected data. It phoned home to remote servers. A 2016 FBI and Department of Homeland Security report attributed it to one or more Russian groups.
Cleanup took 14 months. The Pentagon responded with a blanket ban on USB drives across the force. Data transfers shifted to stricter, controlled channels. The era of casual sneakernet on classified networks ended. At least officially.
Details of the Air Force’s earlier practices surfaced this week through Henkel’s account. SparTech Software reported on the same revelations October 15, noting how mission data for Afghanistan included navigation details and threat profiles. The same drives moved between security levels and ended up inside cockpits. A Congressional Research Service document later described the Agent.BTZ event as a major breach. It triggered Operation Buckshot Yankee.
Yet the underlying habits predated that incident. They grew from real pressures. Importing American computers into Afghanistan carried its own hassles. Local purchase offered speed and relationships with vendors. Mission demands outweighed abstract security lectures from a junior officer.
Henkel understood the mechanics. USB devices don’t just carry files. They accept writes. Malware can hide in autorun files or exploit the way Windows handles removable media. A drive that looks innocent on one system turns malicious on another. Connect it to a classified machine and the infection crosses the air gap. Plug it into an aircraft and the risks multiply.
That reality echoes today. Recent analysis from September shows Pakistan-linked APT36 still uses USB-spreading tools to reach air-gapped government networks in India and Afghanistan. Their Rust-based malware watches for new drives, copies malicious shortcuts, and delivers backdoors. The technique persists because the temptation remains.
Convenience and operational necessity can blind even experienced personnel to basic risks. Pilots focused on the mission. They saw the USB as a tool, not a vector. They bought what was available, not what was verified. And they carried the same stick from low to high.
Modern militaries invest heavily in secure data transfer. They deploy hardware security modules, encrypted channels, and strict policies on removable media. But the human element lingers. A drive bought in haste. A policy ignored under pressure. The pattern repeats if leaders forget how it started.
Henkel’s account arrives at a moment when supply-chain attacks and insider habits draw fresh scrutiny. His assessment is blunt: the pilots simply didn’t see the full picture. They treated writable media like read-only discs. That single misunderstanding opened doors adversaries were ready to exploit.
The Pentagon eventually learned. The ban came after infection, not before. In February 2010, U.S. Strategic Command restored limited use of removable media for mission-essential operations on approved, government-owned devices. Personally owned drives stayed banned.
US Air Force Pilots Plugged Locally Bought USB Drives Into Classified Systems for Afghanistan Flights first appeared on Web and IT News.