Juice jacking is the attack class where a public USB charging port (airport, hotel, conference) hides a data-capture or malware-injection capability behind the appearance of a charging port. The user plugs in to charge, the malicious port establishes data connectivity over the USB cable, the device exposes file-system access or accepts a payload depending on configuration. The threat was first publicly demonstrated in 2011, has been raised by the FBI in advisory posture multiple times since (most recently 2023), and remains structurally possible in the 2026 environment.
What it means in practice
The structural defense is to charge from a power-only source rather than a data-capable USB port. The threat scales with adversary capability and target value: most public USB ports are not actually compromised, but the verification that any specific port is safe is impossible without dismantling the hardware. The defenses are simple: carry your own charger and use a wall outlet (the AC outlet provides power without USB data), use a USB data blocker (a $10 dongle that physically severs the data pins on a USB cable, leaving only power), or use a portable power bank charged from a trusted source. For high-target operators, the discipline is to never charge from public USB ports, ever; the inconvenience of carrying a charger and finding a wall outlet is small compared to the consequences of a compromised device.
Where it shows up
Most relevant for: travelers in airports, hotels, conferences, and other public charging contexts, particularly journalists, lawyers handling sensitive material, NGO staff in adversarial jurisdictions, and executives whose device contains material an adversary would value. The actual deployment of malicious public USB ports is rare in routine US and EU travel; the threat is more concentrated in specific contexts (conferences with adversarial states’ intelligence presence, airports in surveillance-heavy jurisdictions, hotels frequented by specific target categories). The defensive discipline is uniform regardless of specific deployment evidence: charge only from trusted power sources, use data blockers when USB is the only option, treat any unfamiliar charging cable or port with the suspicion that the threat model justifies.
What you can change today
Three actions. First, buy a USB data blocker (PortaPow Data Blocker, $10 on Amazon; alternative brands available) and keep one in your travel kit and one in your daily-carry bag. Second, default to wall-outlet charging with your own charger; the AC outlet bypasses the data-capable USB layer entirely. Third, for high-target deployments: carry a power bank charged at home and use only the power bank during the trip, recharging the bank from wall outlets in trusted contexts (your hotel room rather than the airport lounge). The discipline is small; the protection it buys is real for the threat tier where the discipline matters.