The Honey Stick Project, Fifteen Years On: What Changed and What Didn't
Fifteen years ago we did something that sounds, in hindsight, almost quaint. We loaded a batch of USB memory sticks with harmless tracking software, scattered them around public places, and waited to see how many people would pick one up and plug it into a computer. We called it the Honey Stick Project, and the idea was simple: measure, with real numbers, what people actually do when a free and mysterious gadget lands in their path.
The answer, as anyone who has read the Phase 1 results knows, was that a lot of people plug them in. Not a fringe minority. Not just the careless or the clueless. Ordinary, intelligent, busy people picked up a stick of unknown origin and connected it to machines that held their email, their files, and in some cases their employer's data. Curiosity won. It usually does.
Fifteen years is a long time in technology. It is almost no time at all in human nature. So it seems worth asking: what actually changed, and what stayed exactly the same?
What changed: the hardware got old, the trick got cheaper
Start with the obvious. The USB stick itself is no longer the star of the show. In the years since the original drops, a few things have made the physical attack less central.
- Operating systems stopped trusting removable media by default, and autorun features that once executed code the moment a stick was inserted have been largely neutered.
- Corporate IT departments learned to lock down USB ports, either with policy, with software, or occasionally with glue.
- Cloud storage made the stick itself less interesting. When your files live in a browser, a 4 GB freebie in a parking lot has less pull than it did when storage was scarce and expensive.
- Awareness training began to feature the "found USB" scenario specifically, because experiments like ours and several that followed made it famous.
That is genuine progress, and we should say so. The specific attack we modelled is harder to pull off today than it was then. If you dropped a hundred sticks outside an office block this week, you would still get bites, every later study confirms that, but the payload would meet more resistance on the way in.
Here is the catch, though. Attackers did not give up when the USB port got harder. They moved to a delivery channel that is cheaper, faster, and infinitely scalable: the link.
What didn't change: the person holding the stick
The Honey Stick Project was never really about USB sticks. It was about a decision made in about two seconds by a person with no technical context. Something free and intriguing appears. It might be useful. It might reveal something about its owner. It costs nothing to look. The hand moves before the brain convenes a security committee.
That exact decision now happens dozens of times a day, except the object on the pavement is an email, a text message, or a direct message on a social platform. The modern honey stick is a link that says your parcel could not be delivered, your account shows unusual activity, or your colleague has shared a document with you. Same hook, new bait shop.
Think of it this way. A USB drop was like leaving one fishing line in one pond and hoping a fish swam past. Phishing is a trawler. One attacker can drop a million lures before lunch, at a cost of roughly nothing, and the lures can be rewritten in minutes when one stops working. The economics did not just improve for the attacker, they transformed.
And the psychology we measured fifteen years ago transferred over intact:
- Curiosity: what is on this stick became what is in this document.
- Urgency: a lost stick implied an owner who needed it back, a phishing message manufactures a deadline out of thin air.
- Authority: a stick labelled "HR Salaries" worked frighteningly well, and an email that appears to come from HR works for the same reason.
- Low perceived cost: plugging in felt harmless, and clicking feels even more harmless, because a click seems like such a small thing.
None of that aged a day. The lesson of the project was never "beware of USB sticks." It was "beware of anything engineered to make acting feel easier than thinking." That lesson got more relevant, not less.
The two-second pause, still the best defence we know
If we were running the project again today, the drops would be digital, but the advice at the end would be nearly word for word what we wrote back then. Security for ordinary people does not come from memorising threat names. It comes from installing one small habit: a two-second pause between the impulse and the action.
Before you plug in, before you click, before you reply, ask the street-level questions. Who benefits if I do this? Did I ask for this thing to arrive? Is someone trying to make me hurry? A stranger offering a free gadget on the pavement and a stranger offering a free prize in your inbox deserve the same raised eyebrow you would give a stranger offering you a free drink from an open bottle.
The pause works because it attacks the one thing every one of these schemes depends on: speed. A phishing message read slowly falls apart. The sender address is odd. The greeting is generic. The deadline makes no sense. The link points somewhere that only resembles the real site. Fifteen years of technical change, and the fraud still cannot survive a calm second look.
There is one more modern twist worth naming. The reconnaissance that once required stealing a stranger's files can now be done in the open, because so many of us publish our lives voluntarily. An attacker crafting a convincing lure no longer needs your lost USB stick, they need your public profiles. We have written separately about social media security, and it pairs naturally with this retrospective: the less raw material you hand out, the clumsier the lures aimed at you become.
Where this leaves us
So, fifteen years on, the scorecard reads something like this. The technology improved, genuinely. Ports got locked, autorun died, filters catch a lot of junk before you see it. The attackers adapted, completely. The human being at the centre of it all remained exactly who they always were: curious, busy, helpful, and persuadable in the two seconds before the pause kicks in.
That is not a counsel of despair. It is the whole reason this site exists: street smarts transfer. The instincts that keep you safe in an unfamiliar neighbourhood, noticing what feels off, declining unsolicited gifts, refusing to be rushed, are the same instincts that keep you safe online. They worked against the honey sticks for everyone who walked past one. They work against phishing links today.
If you took part in the original experiment era, or you have a story about a found stick or a near-miss click you learned from, we would genuinely like to hear it. You can reach us through the contact page. The hardware will keep changing. The conversation about the person holding it is the one worth continuing.