I must confess that I plug in unknown USB sticks quite frequently, and even knowing the risk, I probably won't stop. I work part-time at a reception desk (the

I must confess that I plug in unknown USB sticks quite frequently, and even knowing the risk, I probably won't stop. I work part-time at a reception desk (the computer has access to nothing important). The assumption seems to be that found USB sticks are suspicious, but they actually show up quite frequently. People lose their USB stick--usually in one of the lab computers. The overwhelming majority seem to be personal drives that people have lost. Often there are obviously non-confidential files ("Econ101Paper.odt") on the drive, and it's easy to contact the owner to let them know where they can find their lost drive. The average user simply doesn't see USB sticks as malicious (recall how much pain it took until people generally recognized unknown email attachments as dangerous!) and is occasionally exposed to lost USB sticks that they can helpfully return. This is a problem that will not be fixed by user education, except perhaps in secure facilities where USB devices are prohibited completely.