The military services are working out security policies for thumb drive use

The Air Force does not expect to have a policy governing the use of flash media such as thumb drives in place until October and will allow their use only under carefully controlled circumstances, the service's team leader responsible for flash media said.

The Army and Navy could not provide a date when their flash media policies would go into effect, but spokesmen for both services emphasized they are taking a slow and deliberate approach, evaluating technical as well as financial issues.

The Strategic Command, which has responsibility for cybersecurity throughout the Defense Department banned the use of flash media on military computers and networks in November 2008 because adversaries had found ways to use gadgets such as thumb drives to infect Defense networks with software containing malicious bugs.

In February, STRATCOM revised its policy to allow flash media as a "last resort for operational requirements." The revised policy required the services to develop their own guidelines.

Lt. Col. Mark Wood, team leader for flash media at the Air Force Space Command, which is responsible for the service's network security, said he expects the final version of the Air Force policy "to approve use of flash media on a case-by-case basis, and only for mission-essential use while under strict enforcement controls."

The potential threat flash media poses is a concern and Air Force Chief of Staff Gen. Norton Schwartz has taken a conservative approach, Wood said, adding, "the majority of individual airmen should not expect to use thumb drives in their day-to-day jobs."

STRATCOM guidance allows the use of flash media only for missions in which DVDs or CDs are not an option -- a policy the Air Force intends to adopt, Wood said. But the service will not follow STRATCOM's lead in allowing users to transfer data between computer systems on different security platforms, he noted. The Air Force will not "approve the use of flash media for crossing security classifications," he said.

Developing thumb drive policies is likely to take time at the other military services as well. The Army is "taking a deliberate and measured approach in overcoming the technical and policy challenges associated with returning flash media to service," spokeswoman Margaret McBride said.

The use of flash media in the Army will be carefully controlled through a strong usage policy, McBride added, but she declined to provide any further details due to security concerns.

The Navy still needs to resolve numerous hardware, software and financial issues as it develops its flash media policy, according to spokesman Lt. Myers Vasquez.

A spokesman for STRATCOM's Joint Task Force-Global Network Operations declined to provide details on which thumb drives meet standards for operation on Defense networks, but he did say they would cost $50 or less.