Meh, a couple tens of thousands of dollars in destroyed equipment via a very crude vandalism attack. Sounds like a lot until you realize you can cost someone millions with a medium sized botnet and a long standing DDoS. For most large targets, a USB that fries a laptop or two is no big deal (assuming automatic backups or devserver or etc), one that installs a rootkit would be a much worse scenario.

Also, if you are talking about harming individual users, and you are the kind of person who would drop "killer" USB drives on a parking lot, how is that any different from just keying every car? You get no benefit, it only causes damage, it takes near zero sophistication and the end results is it costs people a bunch of money and police start an investigation for vandalism.

> how is that any different from just keying every car?

People will notice that some dude is walking around and keying cars. If you happen to come across a car owner, you might be in for some pretty violent payback (at least that's what I'd do with someone keying my car).

Dropping USB keys, on the other hand, won't cause any suspicion.

Most ICs can handle at least -3000V static discharge. You need to pump about -5000V to start doing real damage. Even LEDs are so robust now days as to take 3X-5X their rated forward voltage as reverse voltage regardless of what their spec sheet says; I make 120V rectifiers from strings of them all the time.

The 3 kV rating is most likely 3 kV on a human body model, which is a small capacitor (few picofarads) with a series resistor. This says nothing about what happens if you charge a large capacitor to 100v and then dump it through as low a resistance as possible into the victim port.

the killers don't do a low-current static discharge; they do high-current through the protection diodes and seriously mess things up. https://www.youtube.com/watch?v=3hbuhFwFsDU