Sneakernet updates for air-gapped AI: hash, sign, scan, log

An air gap is only as good as the process for crossing it. Every model, patch and script that goes in, and every report that comes out, follows the same steps.

1. Dedicated, labeled media

Use media that only ever moves between the staging machine and the sneakernet station. Prefer write-protect switches for inbound media. Never plug personal USB sticks into control-network machines.

2. Hash and sign on the connected side

Hashes catch corruption; signatures catch tampering. Sign with a key that lives on the staging side.

sha256sum * > SHA256SUMS
gpg --armor --detach-sign SHA256SUMS      # creates SHA256SUMS.asc

3. Scan at the station

The sneakernet station is a separate Linux machine that mounts media read-only, scans it, and copies only the approved files.

sudo mount -o ro,noexec,nosuid,nodev /dev/sdX1 /mnt/in
clamscan -r --infected /mnt/in      # use signatures updated via this same process
gpg --verify /mnt/in/SHA256SUMS.asc /mnt/in/SHA256SUMS
cd /mnt/in && sha256sum -c SHA256SUMS

Import the staging public key once, in person, and record its fingerprint. Some sites also require a second, different scanning engine.

4. Log the crossing

Append one line per transfer: date, person, media ID, file names, hashes, purpose, approver. This feeds your audit log.

printf '%s\t%s\t%s\t%s\n' "$(date -Is)" "$USER" "MEDIA-07" "$(sha256sum SHA256SUMS)" \
 | sudo tee -a /var/log/sneakernet.log

5. Outbound is reviewed too

Bot-written reports leaving the zone are reviewed by a person for process secrets before export. Prefer plain text or PDF; never carry out raw historian exports unless approved.

6. Consider a data diode

If data must leave the control network continuously (historian replication), a hardware one-way gateway enforces direction physically. The bot sits on the receiving side.

Questions

Is a hash enough?

A hash proves the file did not change in transit, not who made it. Pair it with a signature you verify against a key fingerprint recorded in person.

Should the bot box mount USB directly?

No. Only the sneakernet station handles removable media; the bot box receives files from it.

Where these facts come from

ISA/IEC 62443 series: zones, conduits and security levels for industrial automation
NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) security
CISA: Industrial Control Systems: advisories and recommended practices
Modbus Organization specifications: function codes and the TCP transport
OPC Foundation: OPC UA specifications and security modes
llama.cpp on GitHub: building and running local GGUF models on Linux

Checked Oct 29, 2026. Tutorials are educational. Follow your site's safety procedures, management-of-change process and the equipment maker's manual. Never test against live production equipment without authorization.

Industrial control with bots: all lessons → Next: 4. Read Modbus TCP data with a bot (read-only) →