HomeNewsArticle Display

AF ban on USBs still in effect

  • Published
  • By Mike W. Ray
  • Tinker Public Affairs
TINKER AIR FORCE BASE, Okla. --  If you plug a smartphone or a thumb drive into a government computer at Tinker Air Force Base, the odds it will be noticed and you will receive a warning are incredibly high. You will be violating the USB Banned Policy -- an Air Force-wide policy enforced at Tinker.

These policies aren't anything new. The USB policy has been in place since Feb. 2, 2009.

Gen. Donald Hoffman, commander of Air Force Materiel Command, issued instructions four months ago to Communications Directorates to track down USB violations on government-owned computers at all Air Force bases.

A USB, or universal serial bus, is an industry standard defining the cables, connectors and protocols used for connection, communication and power supply between computers and electronic devices. USB ports are used to connect printers, FAX machines, scanners, digital cameras, Blackberries, personal digital assistants, MP3 players, external hard drives and other hardware to computers.

The Air Force is concerned about misuse of USBs because, "I could put a virus on a USB device and, once it's introduced into the system, I pretty much own your system and can do whatever I please," Information Technology Specialist Jamell Mejia said.

Whenever someone logs onto a computer connected to the Air Force Network, a blue screen appears with a warning that memory sticks, thumb drives and camera flash memory cards are "unauthorized on all NIPR, SIPR and JWICS connected computers" using Windows operating systems. In addition, devices such as iPods, computer tablets such as iPads, MP3 players and non-government-issued PDAs "are also prohibited for use on Air Force networks..."

Nevertheless, virtually every day someone plugs a smartphone or a flash drive into a USB port on a computer at Tinker AFB.

The danger is that flash memory enables the user to write to or download data from a computer. A smartphone is impermissible because, "You could download a document from your computer to your 'phone or spread a virus," Mr. Mejia explained. "It doesn't take long at all" to write a new computer virus, or for a "script kiddie" to modify an existing virus, he added.

About 60 percent of the estimated 26,000 computers at Tinker AFB are monitored 24/7 to track the kinds of devices plugged into them, said Mr. Mejia, an ITT Tech graduate who earned a bachelor's degree in computer science -- information security systems. That number is increasing daily until full monitoring is achieved.

Once a week Mr. Mejia receives a report that lists every instance in which a USB port was used on a government-owned computer at every Air Force base worldwide.

From that list he narrows the scope to just Tinker. A recent report listed 4,200 incidents in one week; by eliminating duplications, Mr. Mejia whittled the list to 3,196 items.

Filtering further, eliminating permissible devices, Mr. Mejia reduced the list within 20-25 minutes to about 40 unauthorized devices that included digital cameras, iPhones, Android 'phones, MP3 players, and Garmin GPS units. Tinker averages 40 violations a month, which is 40 too many, "There is no reason or excuse for user's to violate this highly-publicized policy," Mr. Mejia said.

His Excel spreadsheet listed the identity of each specific computer on which the violation occurred, the date and time when the violation occurred, the type of unauthorized device inserted into the USB port, and the person to whom that computer is registered.

Mr. Mejia sends an e-mail to each violator's Information Assurance Officer, who notifies the violator's supervisor and command, "and they are the ones who decide what action to take," further explained Mr. Mejia. The consequences range from a verbal warning to information assurance training, perhaps a letter of counseling or, in the extreme, a letter of reprimand.

The IAO has 48 hours to respond to Mr. Mejia's warning. Otherwise, the violator is locked out of the Air Force Network and must officially request reinstatement.

Violations at Tinker occur "across-the-board," among military and civilian personnel alike, Mr. Mejia said. No particular Air Force unit is worse than any other. Most violations are inadvertent, and very few violators are repeat offenders, he said.

Most smartphones can be plugged into a USB port and come equipped with a wall adapter that can be plugged into an electrical outlet in the wall, Mr. Mejia pointed out.

When the device needs to be recharged, "Plug it in with the wall jack instead of into the computer," he said. "Just because you left your adapter at home isn't a reason to plug your phone into the computer so you can charge it."

Anyone with questions about what devices may or may not be plugged into a USB port on a government-owned computer at Tinker AFB should contact their Information Assurance Officer or the 72nd Air Base Wing Information Assurance Office at 734-2241 or email at 72 ABW/SCXS Information Assurance.