Air Force Pilots Used Unvetted USB Drives for Classified Mission Planning in Afghanistan

US Air Force pilots operating in Afghanistan used commercially purchased USB drives to plan classified missions, according to Justin Henkel, the current CISO of SolarWinds. Henkel, who previously served in Air Force IT security, described the practice as a significant failure to understand threat vectors during the early 2000s. The personnel involved did not source their storage media from official military contractors, creating a direct bridge between unsecured local markets and sensitive defense operations.

Henkel stated that the pilots did not consider the security implications of using the same physical device for both classified and unclassified systems. They failed to recognize that malware could be written onto a USB drive and subsequently read by mission-critical computers. This lack of awareness regarding the threat picture allowed potentially compromised hardware to interface directly with systems containing navigation data and threat intelligence for aerial operations.

Operational Practices and Supply Chain Risks

Before the widespread adoption of thumb drives, the standard procedure involved burning mission data onto compact discs. These discs were inserted into classified systems for planning and then transferred into aircraft for use during flights. The data contained essential navigation instructions and information on potential threats the pilots might encounter. When flash drives became available, personnel adopted them as replacements for optical media, but the security protocols did not evolve to match the new technology’s risks.

According to Henkel, it was often more difficult to bring US-based computers into Afghanistan than to purchase equipment locally. Consequently, Air Force personnel bought their flash drives from local vendors in regions such as Kabul. These stores were not equivalent to regulated US retail environments like Best Buy. The ease of accessing local hardware led to the integration of unvetted devices into the military’s operational workflow, bypassing established supply chain security measures.

Impact on Data Security

The primary risk identified by Henkel was the cross-contamination of classified and unclassified networks through shared physical media. By using the same USB drive for different security levels, personnel created an avenue for malware to move between systems. The pilots did not understand that a drive could be infected in an unclassified environment and then introduce that malware into a classified system. This practice undermined the integrity of the mission planning process and exposed sensitive data to potential compromise.

Henkel noted that this behavior would not be tolerated in modern security environments. The incident highlights a historical gap in security awareness among field personnel who prioritized operational convenience over strict adherence to data handling protocols. The reliance on locally sourced hardware in a conflict zone introduced variables that military IT security had not adequately addressed at the time.

What should you do?

Organizations should audit their policies on removable media usage, ensuring that devices are never shared between systems of different security classifications. Security teams must verify that all hardware is sourced from approved vendors and undergoes rigorous inspection before being connected to internal networks. Employees should receive training on the risks of using unvetted storage devices, particularly in high-risk environments.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: US Air Force

• Enforce strict separation of duties for devices used in classified versus unclassified environments.
• Prohibit the use of commercially purchased storage media in sensitive operational systems.
• Implement technical controls that block unauthorized USB devices from connecting to critical networks.
• Conduct regular training on supply chain security risks associated with local hardware procurement.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why did Air Force pilots use local USB drives?

It was more difficult to bring US-based computers into Afghanistan, so personnel bought drives from local vendors in Kabul.

What was the security risk of this practice?

Pilots used the same drives for classified and unclassified systems, risking malware transmission between networks.

Who revealed this information?

Justin Henkel, CISO of SolarWinds and former Air Force IT security official, described the practice in an interview.