USB Flash Drives: The Story Behind the Ban

The culprit in the case of the DoD’s banning of USB flash drives was a worm virus known as "Agent.btz.” The worm was spreading itself by copying itself to USB flash drives. When the drive was plugged into a second computer, the worm would replicate itself again – this time on the PC. The worm seriously degraded computer performance by then copying itself to multiple programs.

In order to eradicate this problem, the DoD banned the use of USB flash drives. It applied to both the secret SIPRNet (secure internet protocol router network) and unclassified NIPRNet (Non-secure internet protocol router network). After this, the government began to look more seriously at proactive measures to protect data-at-rest. It became more apparent that personal identity information or sensitive government information stored on devices such as laptops, USB flash drives and PDAs is often unaccounted for and unprotected, and can pose a problem if compromised.

The Office of Management and Budget (OMB) Memorandum 06-16, “Protection of Sensitive Agency Information,” states that information stored on mobile computers and/or devices including USB flash drives must be encrypted. Two months after OMB issued its memo, a special data-at-rest protection agency was developed to address technical requirements. This agency established stringent technical and information assurance requirements that vendors must meet before government employees can use their product. For USB flash drives, the two main requirements are:

1. The data on the drive must be encrypted, and
2. Anti-virus software must be embedded in the device

<< Back to Overview

Next: The Solution: SG FIPS >>

See suggested reading: Alert! Is your USB secure?

Complete product information.