According to Justin Henkel, a former Air Force IT security officer who now serves as CISO at SolarWinds, pilots in the early 2000s routinely carried mission data on removable media. They first used CDs and later USB flash drives, moving the same device between unclassified and classified systems without fully grasping the security implications.
Henkel told The Register that personnel bought their drives from local markets in places like Kabul rather than from official military suppliers. Adversaries noticed this habit and began selling infected drives to those vendors. In 2008, an infected USB drive attached to a laptop with access to US Central Command spread the Agent.BTZ worm, which the FBI and DHS later attributed to Russian groups. It took the Pentagon 14 months to scrub the malware from its systems.
The incident led the Pentagon to ban USB drives in 2008, then allow them again in 2010 under specific conditions. Henkel said that as a junior officer he had warned senior officers that the practice was a violation, but his concerns were dismissed at the time.