U.S. Air Force personnel used commercially purchased USB drives to move Afghanistan mission data between unclassified and classified systems and aircraft, according to a former Air Force security officer whose account highlights the operational risks that preceded the Pentagon’s 2008 Agent.BTZ outbreak.
Justin Henkel, now chief information security officer at SolarWinds and formerly an Air Force security specialist, said personnel initially used burned CDs to transfer mission-planning information. As flash drives became common, pilots and other personnel used the same removable media across security boundaries and inside aircraft, where the files could include navigation data and information about potential threats.
Henkel said deployed personnel sometimes bought drives from local vendors, including shops in Kabul, rather than using government-procured hardware. That created an obvious supply-chain and malware risk: a drive that touched an unclassified computer could later be connected to a classified system or mission computer. The practice also relied on users recognizing the difference between merely copying files and allowing a writable device to carry malicious code between networks.
The danger became concrete in 2008, when the worm known as Agent.BTZ spread through U.S. Defense Department networks after an infected removable drive was connected to a military computer. A Congressional Research Service account describes the incident as a major breach involving a thumb drive and says the resulting cleanup was code-named Operation Buckshot Yankee. Agent.BTZ could propagate through flash drives and beacon information from infected systems, turning routine data transfer into a mechanism for persistence and espionage. Congressional Research Service [27]
U.S. Strategic Command responded in November 2008 by suspending the use of USB drives, memory cards, CDs and other removable media on Defense Department networks. The restrictions were not lifted wholesale: a February 2010 order restored limited use only for mission-essential operations, approved government-owned devices and systems that met specified security requirements. Personally owned drives remained prohibited, according to the command’s clarification. U.S. Strategic Command [1]
The episode remains a warning for organizations handling sensitive data. Removable media should be treated as an untrusted transfer path, inventoried and organization-owned, scanned before use, restricted by policy and technically blocked wherever it is not operationally necessary. Public U.S. government accounts have linked Agent.BTZ to Russian activity, but the Army’s historical review notes that Washington never formally assigned the 2008 intrusion to a specific actor; that distinction matters when separating documented evidence from later attribution claims. U.S. Army Cyber History [18]
References
- Federal Times clarification – USB policy – U.S. Strategic Commandwww.stratcom.mil › Media › News › News-Article-View › Article › federal…
- Older Than You Realize Teaching Branch History to Army …
- Cyber Operations in DOD Policy and Plans: Issues for …
