US Air Force Pilots Bought USB Drives From Kabul Markets for Mission Planning in Afghanistan

A former Air Force IT security chief reveals that pilots in the early 2000s purchased USB drives from local Afghan vendors to move mission data between classified and unclassified systems, bypassing official supply channels. The practice persisted until the 2008 Agent.BTZ worm infection forced a Pentagon-wide USB ban that lasted 14 months.

In 2008, the US Department of Defense banned USB drives after the Agent.BTZ worm infection. Now a former Air Force IT security chief recounts that years earlier, pilots were buying those devices from local vendors in Afghanistan without understanding the risk of bridging classified and unclassified systems.

Key Takeaways

In the early 2000s, US Air Force pilots switched from CDs to USB drives to transfer mission-planning data, without assessing the rewrite capability as an infection vector.
Personnel purchased the drives from local vendors in Kabul and other Afghan cities rather than through official military channels, in typical lots of about 100 units per order.
Justin Henkel, then a 22-year-old security staffer, tried unsuccessfully to warn senior officers that the practice violated system-separation policies.
The 2008 Agent.BTZ incident forced the Pentagon into a 14-month cleanup and led to a USB ban that was only partially lifted in 2010.

From CD to USB: The Unauthorized Transition

In the early 2000s, US Air Force pilots used compact discs to move mission-planning data between unclassified computers and classified systems installed on aircraft. The arrival of USB drives simplified the operation but introduced a variable the staff did not measure: the rewritability of the media.

According to former Air Force IT CISO Justin Henkel, the pilots "didn't really think about the overall impact of classified vs. unclassified systems." The same storage unit moved from environments with external connectivity to isolated networks, with only physical separation guaranteeing the perimeter. No integrity checks, no traced provenance.

Procurement followed operational logistics. "It was harder to bring a US-based computer into the country than to just buy locally," Henkel said. Personnel therefore turned to vendors in the Kabul market and other Afghan cities. Henkel describes his own role as intermediary: going out, building relationships with local vendors, ordering lots of roughly 100 USB drives.

The Hierarchy That Ignored the 22-Year-Old Tech

Henkel tried to stop the practice by reporting it to superiors. The reaction, he recounts, was disbelief from those who grasped the risk: "It was just a shock... I was a young 22-year-old kid, very junior in the hierarchy, trying to tell colonels and majors that what they were doing is a violation."

The source does not specify whether Henkel's reports were documented in writing or were informal conversations. No infrastructure overlaps link the Afghan-purchased drives to the Agent.BTZ worm: they are correlated in the narrative but distinct in verified facts. The source mentions that "enemies of the US noticed and started selling infected USB drives," but does not document specific infections in the Air Force units described by Henkel.

"They didn't really think about the overall impact of classified vs. unclassified systems... Using the same device for both, they didn't understand that you could read and write to a USB drive with malware. They didn't really understand the big picture of threats." — Justin Henkel, former Air Force IT CISO

Agent.BTZ and the Cost of 14 Months of Cleanup

In 2008, the US Department of Defense was infected by the Agent.BTZ worm after an infected USB drive was plugged into a laptop with access to US Central Command. The malware, attributed to Russian groups by a 2016 FBI/DHS report according to the source, had information-gathering capabilities and communication with remote servers.

The Pentagon took 14 months to eradicate Agent.BTZ from its systems. The severity of the incident imposed an immediate USB ban in 2008, with conditional reauthorization only from 2010. The source does not detail the conditions of reauthorization or the controls introduced.

The temporal discrepancy is significant: the practices described by Henkel date to the early 2000s, while Agent.BTZ surfaced in 2008. If the Afghan drives had actually been an infection vector in that interval, the source does not document it. The Agent.BTZ case functions as an institutional catalyst, not as retroactive confirmation of the specific Air Force missions.

Why It Matters

Military documents, FOIA responses, or independent verification of the systemic spread of the practice are absent.

The source does not detail the type of malware potentially present in the local USB drives before 2008, nor establish technical correlations with Agent.BTZ. The attribution to Russian groups cited for the 2008 worm comes from a 2016 FBI/DHS report: the source does not clarify whether this attribution was known at the time of the ban or emerged later.

The value of the account lies in the mechanism, not the single infection. The use of removable devices purchased from untrusted channels to cross physical and logical security boundaries remains relevant for BYOD policies, IT procurement in conflict zones, and the persistent vulnerability of the physical air gap. Henkel's testimony documents a cultural pattern — hierarchy overriding the junior technician — more than a catalog of exploits.

The incident illustrates how an uncontrolled hardware supply chain in critical operational contexts can compromise the separation between environments. The lesson is not in the specific malware but in risk management as a decision-making process, not a technical configuration.

Sources

Sources and references

Get DeafLetter