Air Force Ops Risked Data via Local USBs Blurring Classified Lines in Afghanistan
Former security chief describes how personnel bought local flash drives, blurring lines between classified and unclassified systems during operations.
Key points
- Pilots bought USB drives from local vendors in Afghanistan rather than official military contractors.
- The same physical media was used across unclassified workstations and classified mission planning systems.
- Justin Henkel, now at SolarWinds, observed this risky practice while working for the Air Force in the early 2000s.
The practice described by Justin Henkel, chief information security officer at SolarWinds, highlights a significant procedural gap in earlier military operations. Henkel previously worked in Air Force IT security and witnessed personnel using commercially available USB drives for sensitive tasks. These devices were not sourced through official military supply chains. Instead, aircrew members purchased them from local vendors in operational theatres. This procurement method introduced unknown hardware into environments handling classified information. The drives were used to transfer mission planning data between systems.
How it unfolded
- In the early 2000s, before USB drives were common, pilots used burned CDs to store mission data for both unclassified and classified systems.
- Pilots would write data to a CD, insert it into a classified system for mission planning, and then place the disc in the aircraft for navigation.
- As thumb drives became available, personnel switched to flash drives, continuing to use the same physical device across security domains.
- Henkel noted that pilots did not consider the threat of malware being read from or written to these shared devices.
Who is affected
According to Henkel, the primary concern was the lack of distinction between classified and unclassified system interactions. Pilots using these devices failed to understand the overall threat picture associated with cross-contamination. The risk applied to any Air Force personnel operating in environments where official hardware was difficult to import.
Henkel stated that bringing US-based computers into Afghanistan was more difficult than buying local equipment. Consequently, personnel relied on store-bought drives from places like Kabul. This behaviour exposed mission-critical planning data to potential compromise from unvetted storage media. No specific breaches or data losses were reported in the account.
The fix
No specific remediation or patch was mentioned in the source material regarding this historical practice. The account serves as a retrospective observation of procedural failures rather than a report of a current vulnerability requiring immediate technical mitigation. Henkel presented the story to illustrate how security concepts that are standard today were not fully understood or implemented in the early 2000s. The narrative does not confirm whether formal policies were subsequently updated to ban such practices, nor does it detail any immediate corrective actions taken by the Air Force at that time. It remains a cautionary example of supply chain and handling risks.
What analysts watch for
Teams usually examine removable media logs to identify unauthorized transfers between security zones. Analysts check whether devices were scanned for malicious code before insertion into isolated networks. Persistence mechanisms often rely on autorun features or hidden partitions on flash drives. Investigators look for evidence of data exfiltration or unexpected file modifications after media use. It is vital to verify that strict air-gap protocols were maintained and that no bridging devices were introduced. Reviewing user behaviour for deviations from standard operating procedures helps spot similar risks.
What to do and how to stay safe: US Air Force
- Enforce strict separation between classified and unclassified systems, prohibiting the use of shared storage media.
- Inspect all removable hardware for malware and firmware tampering before connecting it to any networked device.
- Audit procurement channels to ensure storage devices originate from vetted, official suppliers rather than local vendors.
- Train personnel on the risks of cross-domain contamination and the potential for data theft via physical media.
Step-by-step guide: Ransomware Incident Response: Steps to Contain and Recover
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the US Air Force confirm that data was stolen using these USB drives?
No, the source material only describes the practice and the associated risks; it does not report any confirmed data theft or breach.
Who provided the details about these USB drive practices?
Justin Henkel, the current CISO at SolarWinds, shared these observations based on his previous role in Air Force IT security.
Where did the pilots buy these USB drives?
According to Henkel, personnel bought them from local vendors in Afghanistan, such as stores in Kabul, rather than official contractors.
