US Force Pilots Used Malware-Laden USB Drives to Plan Afghanistan Missions
Mission data moved by disc
Justin Henkel, now CISO at SolarWinds, previously worked in Air Force IT security. He recalled seeing a risky practice in the early 2000s. Personnel burned CDs with mission data, then used them in classified systems to complete planning before taking the discs to aircraft, Henkel said.
Locally purchased USB drives
As thumb drives became common, pilots used them in place of CDs. Henkel said Air Force personnel bought the devices from local vendors rather than official military contractors.
In Afghanistan, he said, a drive might come from a shop in Kabul. Enemies of the US noticed the practice and began selling infected USB drives to vendors in the Middle East.
A junior worker raises concern
Henkel said he was 22 and junior in rank when he tried to warn senior officers that the practice violated security rules. He described the response as a shock. The account highlights how everyday data-transfer choices could put sensitive military mission planning at risk.
Key points
- Air Force personnel transferred mission data using CDs before thumb drives became common.
- Pilots later relied on USB drives purchased from local vendors, including shops in Kabul.
- Enemies of the US began selling infected drives to vendors in the Middle East.
- Justin Henkel said he warned senior officers that the practice violated security rules.