No traditional security measure can fully protect your data if someone catches you with your computer on and a session open. Authorities are well aware of this and try to catch suspects red-handed, but the USBKill project blocks that factor in a simple way: if a USB device is connected or the USBKill flash drive is removed from its port, the computer shuts down immediately.
If a user is absolutely convinced that they will eventually receive a surprise visit from the authorities, the logical thing is to do everything in their power to protect themselves in advance, but many have paid a heavy price for that lack of preparation. Take the case of Ross William Ulbricht, the famous Pirate Roberts linked to the Silk Road marketplace. Ulbricht was arrested in a public library in San Francisco, where he was found with his laptop on, and all the agents had to do to access it was keep it that way. This is accomplished with a small USB device that automatically 'wiggles' the mouse cursor, preventing it from going to sleep or activating the screensaver. Ulbricht was found guilty of all charges and faces a minimum of 20 years in prison. The authorities managed to find him because he made several previous mistakes, but the powered-on computer did nothing to help his defense. With this in mind, USBKill was born.
The developer registered on GitHub as hephaest0s explains that USBKill's function is to wait for any change in the state of the USB ports, and as soon as it detects something, it immediately disables the computer. When we say 'change', it can be either the connection of a device or the removal of the flash drive containing USBKill. In fact, hephaest0s suggests that the flash drive should be tethered to something, so that if an officer decides to pick up the computer, the drive disconnects and USBKill does its job. From a technical point of view, USBKill is a simple Python script that induces the death of the computer, and although it may seem incredible, it is very effective... as long as the conditions are right.
What I mean by this is that USBKill doesn't work magic. For its effectiveness to be real and complete, the computer's disk must be encrypted, so that when they try to restart it, agents are met with the 'insert password' they so detest. In other words, USBKill doesn't literally kill the computer; it just turns it off or hangs it, and the information stored on the internal drive remains intact. Now, anyone who wants a truly destructive USB flash drive already has at least one option available...
