WASHINGTON, - New guidelines from U.S. Strategic Command officials allow servicemembers to use "thumb drives" and other flash media to store computer data under specific circumstances.
Strategic Command officials banned use of thumb drives and flash media in November 2008, after the use of the media infected a number of Defense Department computer systems. Computers users had to turn to alternative means to transfer data from one machine to another.
Now, the command has lifted the ban on the devices under carefully controlled circumstances, said Navy Vice Adm. Carl V. Mauney, Stratcom's deputy commander.
The command issued an order Feb. 12 that allows "a return to limited use of removable devices under very specific circumstances and guidelines," Mauney said.
"This is not a return to 'business as usual,'" the admiral emphasized. "There remain strict limitations on using these devices."
In a telephone interview, Mauney said units in active operations in Afghanistan, Iraq and elsewhere will get priority in implementation of the new guidelines.
"In terms of the mechanics, we've put together several small kits of the equipment that's needed and we'll be transitioning those to people out in the theater – in Afghanistan in particular – to help certain groups facilitate their use," Mauney explained. The kits will contain hardware and software to ensure the safe use of removable media, he added, and scans and filters are included in the process.
After extensive testing of mitigation measures, Defense Department officials decided to make the technology available again on a very limited and strictly controlled basis, the admiral said.
"Since the order restricting use of removable media, [the Defense Department] developed capabilities and processes that allow safe use of these devices," Mauney said. "Removable media use will be limited to mission-essential operations, and only after strict compliance requirements are met."
The order calls on combatant commands, the services and Defense Department agencies to establish approval authorities for determining whether flash media may be used.
"The commanders and directors can decide that the measures that we're using already meet their needs," Mauney said. "In fact, when we're traveling, ... we look to see how people are doing in moving around their information. People have trained themselves and are able to do it, and are effective and efficient. I think, initially, some will look at this and say they are good with what they are doing. It's proven, and they may opt not to do this."
The removable media will be a tremendous help in Afghanistan and Iraq, Mauney said. "We think there will be some ground to be gained there," he added.
Use of the devices under the new guidelines is restricted to operational mission requirements, Mauney said, and only properly inventoried, government-procured and –owned devices will be allowed for use in Defense Department information systems. Servicemembers and civilians will not use personally owned devices on any Defense Department network or in any Defense Department computer, he said.
Computer users also will not use Defense Department thumb drives and flash media on nongovernment networks or computers without authorization from an approval authority, the admiral said.
Defense Department officials say they're urging all computer users to be responsible and to do the right thing for cybersecurity. Mauney said the Defense Department has the means and the right to scan the department's computers, and randomly selected users and drives will be subject to periodic auditing.
Joint Task Force Global Network Defense is the operational command that will oversee the program.
Ban on USB devices in Army remains - for now
C. Todd Lopez
Army News Service
WASHINGTON (2/19/10) - The ban on using USB devices on military computers remains, for now, in the Army - despite a partial lift of the original ban by U.S. Strategic Command.
USSTRATCOM issued a tasking order to services and concerned parties, Feb. 12, that allows the services to loosen restrictions on use of USB and flash media devices. Individual services, however, may continue the ban until they feel their networks are adequately equipped to deal with the threats posed by the portable storage devices.
The official word from the Army Global Network Operations Security Center is "we are currently conducting mission analysis in order to provide guidance for the Army's safe return of thumb drives and flash media."
According to the AGNOSC, there are conditions that must be met prior to the lift of the ban. Those conditions include, but are not limited to ensuring that users are only using government-approved and purchased devices and that Army networks are properly configured.
The U.S. Strategic Command implemented a ban on USB storage devices in November 2008, to include such things as memory sticks, thumb drives, and camera memory cards. That ban was partially lifted by their tasking order Feb. 12.
The USSTRATCOM commander has "approved a Communications Tasking Order directing that the limited use of memory sticks, thumb drives, and camera memory cards (commonly called 'flash media,') be restored on Department of Defense computers after the verified implementation of certain procedures and operational practices," according to guidance from the U.S. Strategic Command.
The procedures are meant to ensure that malicious code that can be present on USB memory devices is prevented from infecting DOD computers.
"Until all conditions are met, the ban on the use of removable flash drives will remain," said AGNOSC.