I kinda thought the same thing about flash-drive viruses, and why Bruce wasn't using CDs/DVDs instead. Then I realized if he was really serious, he wouldn't say what he's really using, and he'd have a USB honeypot plugged into his network-facing computer.

Note that he didn't say what software he's running on the new air-gapped computer. The difference between locking down one air-gapped PC running only software required for encryption and locking down the entire network of PCs running the wide variety of software required to do everything everyone needs to do on the SIPRnet is huge.

Named "Iocane Powder" of course.

"i'd bet my life on it..."

Another approach might be to set up an old-fashioned serial link between the machines. It's easy enough to observe and audit all the traffic that passes through a serial cable.

SD cards have a physical switch you can flip for read-only.

The switch is electrical and advisory. The SD card reader is free to ignore it.

Search for "Bootable SD Card Method" here: http://chdk.wikia.com/wiki/Prepare_your_SD_card (I have a Canon camera that runs CHDK. Those instructions work, and the camera can write to the SD card.)

The SD card switch is actually read by an external physical sensor (a tiny button like the write-protect buttons inside of ancient 3.5" floppy drives), at least on most SD cards. I had an SD card whose switch wasn't quite thick enough to trigger the writability sensor of an SD card reader, so I had to wrap it in tape.

In a completely unrelated area, you just saved me a pile of effort and time with that tape trick. Kudos.

Yeah and my old Intel 486 Gateway 2000 had a Turbo button. What's your point?