The use of USB flash drives is prohibited on Defense Department systems. Below are the most frequently asked questions:
Q. What’s the harm if I’m just using a little power?
A. Anything that plugs into a government system via USB can draw power, as well as transfer data.
Q. But I turned it off. So I’m OK … right?
A. No. USB devices supply power, and it isn’t necessary for the device to be “powered on” for data transfer to occur.
Q. But it’s not a thumb drive; so what’s the issue?
A. Hard drives, mp3 players, phones and other USB devices have internal memory storage. In many cases they also include wireless capability, which makes them an even greater liability than a USB thumb drive. Connecting these devices into DOD systems provides an avenue to introduce viruses and other forms of malware into the network and potentially across classification boundaries.
Q. But I don’t transfer data back and forth. I would never load my data onto a work computer.
A. Within seconds of plugging in a USB cable, the computer and device begin running executables and exchanging information. It’s during this “handshake” period that a virus or malware can begin its work and infect the system being used.
Q. But where would my portable device get a virus?
A. Your device could get a virus through the Internet, Bluetooth vulnerabilities, infected media, other USB charging locations … the list is endless. Not only is a device at risk of getting a virus, but so is the government system it is being connected to.
Q. Bottom line?
A. Personal devices can be charged on personal computers or with commercially available wall or car chargers. Plugging these devices into DOD systems creates vulnerabilities which lead to significant risks to our networks and warfighting information.
