DOD loosens restrictions on thumb drives

By LEO SHANE III | STARS AND STRIPES Published: February 19, 2010

WASHINGTON — The Defense Department will allow troops to use thumb drives and other removable memory cards on military computers, but only in tightly controlled circumstances and only as a last resort.

In November 2008, U.S. Strategic Command banned use of any flash drives or other removable media because of concerns that viruses and similar malicious programs had infiltrated parts of the defense computer network.

But the move has been unpopular with many troops, especially those in combat locations where large data files are more easily transferred through portable drives than over a heavily tasked network.

Vice Adm. Carl Mauney, deputy commander of U.S. Strategic Command, said this week that the change came after months of researching how to safely use the drives without opening the department’s systems to hackers.

“After extensive testing of mitigation measures, DOD decided to make this technology available again on a strictly controlled basis,” he said in a statement. “Removable media use will be limited to mission-essential operations, and only after strict compliance requirements are met.”

Now, department-owned drives which have undergone virus scans and checks from network administrators will be made available to troops for use “only when other authorized network resources are not available.”

Mauney said STRATCOM already has begun sending thumb drive kits to units in Afghanistan and Iraq, the first troops to receive the department-approved removable media. The kits include software and hardware for preparing and using the drives. “This isn’t going to be like going to the neighborhood store, picking up a 1-gigabyte drive and plugging it into the computer,” he said.

Mauney could not say how much each kit costs, and said the first test run would include several dozen kits. Units in noncombat areas will receive their kits in the coming months, after the need in Afghanistan and Iraq is filled.

The drives will not be allowed on any non-military networks, and troops still will not be allowed to use personal thumb drives on military computers. Both users and the removable media will be subject to “periodic auditing” to make sure regulations are being followed.

Mauney said officials have been enforcing the ban on removable media and training troops on the potential danger to network security. In addition, “network administrators have the capability to monitor and audit activity on [department] networks, including files that may be introduced through removable devices.”

The policy applies to memory sticks, thumb drives, camera flash memory cards and even portable mp3 players.

In issuing the ban in 2008, STRATCOM officials said the portable media “have given the adversary the capability to exploit our poor personal practices and have provided an avenue of attack.”

The new order also specifies that the individual services and combatant Commands may issue additional restrictions on the removable drives as they look into the need for such items.