A major Pentagon malware crisis did not begin with a sophisticated phishing campaign or a nation-state exploiting a zero-day vulnerability. It reportedly began with a routine workflow: personnel carrying USB drives between computers that were never supposed to share data.
A Workflow Nobody Flagged as a Threat
An ordinary data-transfer habit reportedly created a security gap that no technical barrier was in place to close.
According to The Register, former Air Force security specialist Justin Henkel said personnel used CDs and later USB drives to move mission-planning data between unclassified systems, classified systems, and aircraft. Henkel said that data could support navigation and provide information about threats encountered during missions, The Register reported.
The supply-chain risk compounded the cross-domain problem. Henkel told The Register that personnel sometimes purchased drives from local vendors in Afghanistan rather than obtaining military-issued, controlled media. Those drives carried an inherent supply-chain vulnerability: their origin and integrity could not be verified before they touched sensitive systems.
Personnel also held a deeper technical misunderstanding that made everything worse. According to The Register’s reporting, Henkel said personnel did not fully grasp that a USB drive could be written to by malware, not just read from. A drive used on an unclassified machine could pick up malicious code. The same person could then walk that drive across the room and introduce it directly into a classified environment.
Henkel described himself as a junior security employee at the time, and he said his warnings were not accepted by senior personnel, according to The Register.
Agent.BTZ and a 14-Month Cleanup Operation
The malware that followed spread through Defense Department networks and triggered a remediation effort that consumed more than a year.
In 2008, someone connected an infected USB drive to a laptop with access to U.S. Central Command systems, according to historical accounts documented by Brookings. The malware, identified as Agent.BTZ, could collect data from infected machines and communicate with remote servers.
Agent.BTZ spread through Defense Department networks, and the Pentagon spent approximately 14 months working to remove it. That effort was called Operation Buckshot Yankee, according to Brookings.
The Defense Department banned USB drives and other removable media starting in November 2008. That restriction remained in place until February 2010, according to Brookings. Removable media were later permitted again under tighter controls.
Attribution for Agent.BTZ remained a point of debate. A joint FBI-DHS analysis published in 2016 linked the malware to one or more Russian civilian or military intelligence services. Brookings reporting noted, however, that some insiders disputed whether the available evidence conclusively established a foreign intelligence operation.
The Failure Pattern That Outlasted the War
The conditions that enabled Agent.BTZ were procedural, not exotic, and similar gaps persist in organizations well beyond military networks.
The breach was instructive because of its ordinariness. The reported initial entry point was a USB drive, not a cracked encrypted server or a compromised senior official. A physical object reportedly crossed the boundary between classified and unclassified systems repeatedly, as a matter of operational habit, according to Henkel’s account in The Register.
That failure pattern remains relevant beyond military networks. Many hospitals, industrial facilities, and government agencies operate environments where removable media still move between systems with different trust levels. The controls that matter most are not always technical: sometimes they are a junior staffer’s warning that actually gets heard.
