“They didn't really think about the overall impact of classified versus unclassified systems,” Justin Henkel, now the CISO of SolarWinds, said of Air Force pilots whose mission planning practices opened a conduit for malware into sensitive systems.
How mission data moved: from CD to thumb drive to cockpit
Henkel, who previously worked in IT security for the Air Force, described a simple operational habit that bridged unclassified and classified environments. Before USB drives were common, crews burned mission data to CDs and used the same disc in unclassified systems, in classified systems, and then in aircraft. “They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel recalled. “Then they would take that disc and then put it in the airplane.”
When thumb drives replaced CDs, pilots used them “instead of discs,” Henkel said, carrying forward the same cross-domain practice without fully appreciating the new threat model: “Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware.”
Local procurement in Kabul and the supply-chain vulnerability
Henkel explained why foreign-purchased media entered the logistics chain. It was often more difficult to bring a U.S.-based computer into the nation than to buy local, he said, so personnel would visit markets and build relationships with vendors to buy bulk thumb drives. “I used to do this: go out, make relationships with the local vendors. ‘Hey I need 100 USB sticks.’”
He stressed the quality gap: drives could come from a Kabul shop rather than a U.S. contractor — “it wasn’t exactly the equivalent of Best Buy” — and adversaries noticed. According to Henkel, enemies of the United States began selling infected USB drives to local vendors in the Middle East, turning ordinary retail supply chains into vectors for compromise.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAgent.BTZ and the 2008 compromise of US Central Command
The documentary thread Henkel describes has a documented crescendo: in 2008 the Department of Defense was infected after an infected USB flash drive was attached to a laptop with access to U.S. Central Command. The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers.
A 2016 report from the FBI and DHS later attributed the malware to “one or more Russian groups.” The injection of Agent.BTZ required a prolonged response: it took the Pentagon 14 months to scrub the malware from its systems.
Policy reaction: a ban, enforced transfers, then a limited return
The Agent.BTZ incident triggered an immediate operational response. In 2008 the Pentagon banned the use of USB drives and forced data transfers to go through more secure systems. That ban was not permanent: “Eventually, in 2010, the drives were allowed again under certain circumstances,” the record shows.
Henkel’s recollection of military resistance to his warnings — “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation” — underlines a familiar tension between operational convenience and centrally imposed security rules.
What this means for technologists, policymakers, and procurement leaders
- Technologists and security teams: The chain from local retail media to classified systems is an explicit example of a removable-media threat. The Agent.BTZ cleanup — 14 months to scrub — illustrates the high operational cost when policy and hygiene fail.
- Policymakers and regulators (the Department of Defense): The timeline — a 2008 ban followed by a 2010 conditional reinstatement — shows how incident-driven policy can change quickly and then be relaxed under operational pressure, with consequences that are recorded and measurable.
- Procurement leaders and field units: Sourcing practices that relied on local vendors in Kabul created an avoidable supply-chain risk. Henkel’s account that drives were bought locally because importing U.S. systems was difficult is a concrete procurement constraint that translated into a cybersecurity gap.
The documented sequence — routine cross-domain use of physical media, local procurement in conflict zones, the 2008 Agent.BTZ infection, a 14-month remediation, a ban, and a later partial reinstatement — forms a compact case study: simple habits at the tactical edge can produce strategic consequences. The record in this instance is clear and specific. The next question, left implicit in the documented events, is whether operational procedures, procurement controls, and technical mitigations now align tightly enough to prevent a repeat of a compromise that once took more than a year to erase.
