Typically on classified systems, USB ports that aren’t being used for keyboard and mouse are disabled. When someone unplugs a keyboard or mouse to plug in that USB drive will have it logged, an email sent to sysadmins, and the port gets disabled until someone clears it. There was a hack years ago, before I left the IC that involved those that I’ve got a story about that I can’t discuss here. Even in the unclas world that I live in now, we’re instructed that any / all USB drives aren’t to be used (although I have one that I’m allowed to use for imaging some special purpose devices, that I have permission to have).
3 Likes