USAF Afghanistan Ops Risked Classified Data via Pilots' Unvetted USB Drives
Pilots bought flash drives from local vendors and used them on classified systems, creating a risk of malware transfer between network environments.
Key points
- US Air Force personnel purchased unvetted USB drives from local vendors in Afghanistan.
- These drives were used on both unclassified and classified systems for mission planning.
- The practice allowed the potential transfer of malware between network environments.
US Air Force pilots in Afghanistan used commercially purchased USB drives to transfer mission data between unclassified and classified systems, according to Justin Henkel, CISO at SolarWinds. This practice created a risk of malware transfer. Henkel noted that personnel did not understand the threat of reading and writing malicious code onto these shared devices, compromising the integrity of mission planning workflows.
How did the risk enter the systems?
The vector was physical media acquired outside official supply chains. According to Henkel, who previously worked in Air Force IT security, personnel bought flash drives from local vendors in Afghanistan rather than sourcing them from official military contractors. He stated that it was often more difficult to bring US-based computers into the nation than to buy local hardware. These drives were then inserted into classified systems.
What data was at risk?
The drives contained mission planning data, including navigation information and details about potential threats pilots might encounter. Henkel explained that pilots would write data to a CD or USB drive on an unclassified system, then insert that same media into a classified system to complete planning. Finally, the disc or drive was loaded into the airplane. This workflow meant that malware on the device could access sensitive tactical information.
Why did this practice persist?
The behavior stemmed from a lack of understanding regarding the separation of classified and unclassified networks. Henkel said pilots did not think about the overall impact of using the same device for both environments. They failed to recognize that a USB drive could be used to read and write malware, bridging the air gap between systems. This oversight persisted from the early 2000s, when CDs were common, through the transition to thumb drives.
What is the current status of this risk?
Henkel described this incident as a practice from the early 2000s that "wouldn't fly today," implying that current protocols have changed. However, the report highlights the enduring risk of supply chain compromises via removable media. No specific CVEs or patches were mentioned for this historical incident, as it represents a procedural failure rather than a software vulnerability. The lesson remains relevant for any organization relying on physical media for data transfer.
What analysts watch for
Teams usually monitor for unauthorized removable media connections on endpoints that handle sensitive data. Analysts examine audit logs for unexpected file transfers between classified and unclassified networks. They check whether devices are sourced from vetted suppliers and verify that write protections are enforced on media used in secure environments. Incident responders look for indicators of compromise that match known malware signatures found on external drives, ensuring that physical vectors do not bypass network defenses.
What to do and how to stay safe: US Air Force
- Enforce strict policies prohibiting the use of commercially purchased removable media on classified or sensitive systems.
- Implement technical controls that block unauthorized USB devices and log all media connections for review.
- Train personnel on the risks of cross-connecting devices between different security domains.
- Audit supply chains to ensure all hardware, including storage media, comes from trusted, vetted vendors.
Step-by-step guide: Ransomware Incident Response: 6 Common Misreadings Corrected
General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the US Air Force patch this vulnerability?
The report describes a historical procedural failure from the early 2000s, not a software bug requiring a patch. Henkel indicates the practice is no longer acceptable today.
Where did the pilots buy the USB drives?
According to Justin Henkel, personnel bought flash drives from local vendors in Afghanistan, such as stores in Kabul, rather than from official military contractors.
What kind of data was on the drives?
The drives contained mission planning data, including navigation information and details about threats pilots might encounter during their missions.
