☰Series Navigation (13 parts)
The U.S. military runs a set of computer networks that are supposed to be untouchable. SIPRNet carries classified traffic. Another system carries the communications of the top intelligence agencies. Neither one connects to the public internet. They’re air-gapped, sealed off by design, for the same reason Iran sealed off Natanz: if the outside world can’t reach them, the outside world can’t attack them.
In 2008, that seal was broken by the cheapest attack in this entire series. No billion-dollar development program, no shell company built over years, no four zero-day exploits. Just some infected USB drives scattered in a parking lot and the reliable fact that a human being who finds a USB drive will, sooner or later, plug it in.
I find this one hard to laugh at, even though it sounds like a joke. The person who plugged in that drive did what curious people do, and the people who built a classified network that trusted any drive a soldier carried in should have known better. Blaming the soldier in the parking lot is the easy move, and I think it lets the institution off the hook for a design that assumed nobody would ever be curious.
What kind of malware was Agent.btz?
Agent.btz was a worm, a self-copying program, and by the standards of this series it wasn’t sophisticated. It was a variant of an existing piece of malware that spread by copying itself onto removable drives and then onto any computer those drives were plugged into, and back onto the next drive, and so on. Depending on how it was set, it could scan machines for data, open a back door, and try to send what it found to a remote server.
What made it a catastrophe was where the code ended up. In late 2008, the Army found Agent.btz crawling through SIPRNet, the classified Secret-level network, and through the system used by the top U.S. intelligence agencies. The Pentagon called it the most serious breach of its classified computer systems to that point. The press called it “the worm that ate the Pentagon.”
The deputy defense secretary at the time, William Lynn, later described it in stark terms. The malicious code, he wrote, spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead from which data could be transferred to servers under foreign control. He called it a network administrator’s worst fear: a rogue program operating silently, poised to hand operational plans to an unknown adversary.
What stands out to me in that description is the word poised. Nobody could say for certain what, if anything, had already left, and I think that uncertainty does its own damage, because a commander who can’t rule out that his plans were read has to act as if they were.
How did a worm get onto an air-gapped military network?
The same way Stuxnet got into Natanz. A person carried it across.
The reported origin is almost insultingly simple. Infected USB flash drives were left in the parking lot of a U.S. military installation in the Middle East.
Someone picked one up, and at some point plugged it into a laptop connected to the Department of Defense network. That was the whole entry. From there the worm did what worms do: it copied itself from that machine onto every drive that touched it and every computer those drives later met, working its way inward until it reached the classified networks.
Look at what defeated the air gap, because it’s the same thing every time: a person, with no technical marvel involved.
Curiosity and habit bridged the gap between the sealed network and the outside world. Security people call the technique baiting, and it works because people are helpful, curious, and busy. An organization that answers it with a memo and a scolding is copping out. Curiosity doesn’t respond to memos, so the defense has to be built into the machines, starting with ports that refuse drives nobody approved.
I taught security awareness for years, and the dropped-USB trick is the oldest live-fire test in the book.
You scatter branded drives in a parking lot or a lobby and count how many get plugged into company machines. The number is always higher than management wants to believe. The military isn’t exempt from human nature, and in 2008 it learned that the hard way, on its most sensitive networks.
Why did it take 14 months to clean up?
Anyone who has worked a real incident will recognize this, and it’s what made the whole episode so influential.
The Pentagon spent roughly 14 months on Operation Buckshot Yankee, the effort to get Agent.btz out of its networks. Fourteen months, for a worm that experts described afterward as relatively benign. Why so long? Because when the incident started, the military couldn’t answer the most basic questions about its own networks. The general who ran U.S. Strategic Command later said that during the cleanup he asked simple things, like how many computers were on the network and how they were configured, and couldn’t get an answer for over a month.
The most powerful military on earth got hit by an unsophisticated worm and discovered it didn’t have an accurate picture of its own systems. You can’t clean an infection out of machines you can’t count. Every reinfection came from a drive or a computer nobody had accounted for, so the worm kept coming back and the cleanup dragged on long past when anyone expected it to end. An inventory that far off is a leadership failure, and any executive who treats asset tracking as clerical work is setting one up.
I lived smaller versions of this for twenty years. The breach is rarely the hard part. The hard part is that when you finally go looking, you find you never really knew what you had: the forgotten server, the undocumented laptop, the contractor’s machine nobody put on the list.
Agent.btz was benign and still took over a year, purely because the defenders were fighting half-blind. A worse worm on the same blind networks would have been a disaster of a different order.
Was Agent.btz the work of a foreign government?
This has never been settled, and I’ll lay out the uncertainty instead of picking a villain.
Pentagon officials publicly tied the attack to a foreign intelligence service, and William Lynn framed it that way in print. Some analysts pointed to Russia. Others noted that Chinese hackers had used code resembling Agent.btz before.
But people who worked the cleanup themselves have long been skeptical that it was a polished state operation at all, because the attack was so crude. As one official put it, why would a capable spy service launch such a limp attack? No one has ever publicly proven who scattered those drives or why, and the forensics never produced a name the government was willing to stand behind in detail.
I find the ambiguity more instructive than a clean attribution would be. It didn’t matter whether the attacker was a superpower or an opportunist. The damage, the fear, and the 14-month cleanup were the same either way, because the failure that mattered was on the defensive side: an air gap that people crossed daily with removable drives, and a network the defenders couldn’t fully see.
Why does Agent.btz matter for the AI Force debate?
Because it’s the direct ancestor of an argument happening in Washington right now, and the ancestor teaches the lesson the argument keeps missing.
In the end, Agent.btz did more than embarrass the Pentagon. The pain of Operation Buckshot Yankee convinced the leadership that defending military networks needed its own dedicated organization, and in 2009 and 2010 that conviction produced U.S. Cyber Command, the military’s unified body for defending its networks and conducting offensive operations. A crude worm on a thumb drive created a new branch of the American military apparatus.
I agree with that decision more than anything else in this story. Executives keep lumping cybersecurity in with IT, and I think it needs its own department, possibly with its own reporting line: IT usually answers to the CFO, and security might answer to the COO, so neither one’s priorities bend the other’s. IT thinks about IT issues and forgets the people. At the national retailer where I ran computer operations, security sat inside IT, and it caused problems because people put their own IT issues ahead of security.
I’ve written elsewhere about the newly announced AI Force, and the comparison cuts both ways. Cyber Command is proof that a serious incident can produce a real institution instead of just a name, and it’s also proof of what makes the difference.
Cyber Command was built around concrete jobs: know what’s on the network, detect intrusions, respond to them. It came out of an operation where the defenders had learned, painfully, exactly which capabilities they lacked. An institution built the same way, around mandatory reporting, real visibility, and the authority to act, is worth having. An institution that’s only a name on a door isn’t, and the difference is written all over the 14 months of Buckshot Yankee.
A person carried Agent.btz across an air gap, and no organization ever finishes solving that. You manage it forever, by controlling what crosses the boundary and by knowing your own systems well enough to find the intruder when it gets in anyway. It took the worst breach of its classified systems up to then to teach the military what’s on its own network, and the AI Force would be foolish to wait for its own Agent.btz to learn the same thing.
The next article moves from a thumb drive to a software update, and to the day a single poisoned download did ten billion dollars of damage around the world. For the wider view, the cybersecurity hub collects the rest of my work on this.
