I mention the memory stick b/c every fricking butterbar at the time, a bit over 10 years ago, were using them for EVERYTHING. They were the vector for a really bad virus that got into DoD systems in Afghanistan (likely from somewhere from the N or NE) and b/c of that they were banned from use . . . really gimped the butterbars, who were sharing Power Points all over the place.
Sometimes security gaps are systemic. I retired from the FAA after 35 years. I consider of of the FAA's major failures is its catering to the Air Traffic Controllers' union (I had been a member from its conception) because the union convinced the FAA to give retired controllers, as well as failed developmentals (trainees) the first shot at any and all job openings, prior to the openings being published. The result of this practice has been people with minimal training working as programmers, IT, maintenance, etc.
While the FAA has always displayed a mania for security, even to the point that all data lines were parallel phone lines, installed at great expense. Despite all of their theories of security, it has been my experience that most of the people in upper management looked at computers as mere word processors and overpriced typewriters. In practice, the FAA has an inordinate paranoia of the internet, and discourages employees from using FAA computers online.
The above being said, back in the day of 3.5 disks, I was trying out a demo file management program and found a text file labelled "P@sswords" and opened it. It contained the computer access passwords of every employee in the facility. Fortunately, I wasn't a malevolent hacker at the time, but this is just one example of systemic practice...
I used to write training material for the facility, and when I wanted to meet a deadline, I would take my work home to complete. The only time I have ever had a computer virus was when one was discovered on a MS Word file on my thumb drive. Literally, every computer in the facility was infected and the IT people were clueless, until I pointed it out.
In 2009, I was on shift when the FAA comm system experienced a nation-wide outage that lasted several hours. Needless to say, there has been no explanation for the outage, and its effects minimized as a "glitch". For hours, we were at the phones, handwriting flight plans, weather data and other messages, until I took the time to take a break and check out the internet. By odd coincidence, I found an internet mirror site operated by the US Air Force, which contained ALL of the data we had been handwriting. I quickly put the word out and we soon got ahead of the game. I got a whole, letter of appreciation for that day, and months later, much to my consternation, the mirror site was taken down.
Back when our computers were using Windows 7, the primary communications program we used was written in-house by the FAA, USING Windows 3.1, because the FAA didn't have to pay Microsoft any fees for using an obsolete program. Training was given by the no-talent hack who wrote the program, who was rewarded a week in Hawaii, in order to train us in using a program any child could use, except for the many flaws and restrictions, such as pull-down menus for file templates limited to three lines, even though we used dozens of files. For the template files, which were all text files, the program was unable to edit or print them -Instead, we had to use Notepad, and the programmer would not train anyone for that. Needless to say, I raked him over the coals, and informed him that FAA programmers only work for the FAA because nobody would employ them anywhere else.
