Each panel below is a working miniature of a site that could run at this address: navigation, hero, product screen and proof numbers, followed by a plain note on how that business would position the name. All twenty stay on screen at all times; a lane simply marks its own. The domain sits in the browser bar of every one of them, whole and unbroken, because the name is the thing being sold.
01
The Sentence On The Agency's Own Page
What the central federal advisory actually says
DataBlockerHQ
AdvisoryQuoteDate
Read the page
The warning and
the denial sit on
the same page.
The federal consumer advisory on this subject tells travelers to avoid public USB charging. Four sentences later it says the agency is not aware of any confirmed instance of the thing happening. Both sentences are live today. We quote the second one in full, because a page that quotes only the first is a page a buyer can break.
FEDERAL COMMUNICATIONS COMMISSION CONSUMER ADVISORY · READ OCTOBER 1, 2026VERBATIM
Although “juice jacking” has been demonstrated to be technically possible as a proof of concept, the FCC is not aware of any confirmed instances of it occurring.SENTENCE 8 OF 14 ON THE PAGE, QUOTED WHOLE
Incidents, airports, case numbers or arrests named on the pagewe checked each0
Publication or update date printed anywhere on the pageno byline, no last-reviewed line0
Hedged verbs in the agency's own voicemight, could, can, any potential6
Times the page uses the phrase “data blocker”it recommends a charging-only cable instead0
WHY WE WILL NOT GIVE THIS PAGE A DATE, EVEN THOUGH ITS HISTORY IS KNOWNAn agency spokesperson has told reporters the page was first issued in 2019 and updated in 2021, and contemporaneous coverage records a further update in April 2023. But the page carries no date of its own, and its text has changed since April 2023: two sentences that were quoted from it then are no longer on it. So we date our reading, not the page.
THE AGENCY RECOMMENDS A CHARGING-ONLY CABLE FROM A TRUSTED SUPPLIER. IT HAS NEVER USED THIS PRODUCT'S NAME.ITS WORDS
0confirmed instances
6hedged verbs, its own voice
0dates printed on it
How they position itA buyer in this category has read the warning. Almost nobody has read sentence eight. Owning the address that prints both is the difference between a storefront and a reference.
02
Eight Bodies, And What Each One Cited
The complete US advisory record, instrument by instrument
DataBlockerHQ
FederalStateCited
See the record
Eight offices
warned. None
cited a case.
Five federal and three state or county offices have told Americans to avoid public USB charging. We read every source and recorded two things about each: what kind of instrument it is, and what evidence it points to. Not one points to an incident, a case number, a complaint figure or an arrest.
EVERY US GOVERNMENT SOURCE WE COULD FIND · INSTRUMENT TYPE AND EVIDENCE CITEDREAD IN FULL
FCCConsumer advisory web page, undatednoneSAYS IN ITS OWN TEXT IT HAS NO CONFIRMED INSTANCE. CARD 01.
FBI DENVER FIELD OFFICEOne social post, April 6, 2023. Not a national advisory.noneCALLED IT A STANDARD PSA POST THAT STEMMED FROM THE FCC PAGE
CISATwo travel pages. Neither uses the term at all.noneADVISES AGAINST CHARGING FROM EQUIPMENT YOU DO NOT CONTROL
NSATwo best-practice documents for government personneln/aA FLAT PROHIBITION, AND NOT WRITTEN FOR CONSUMERS. CARD 04.
TSAA 2025 post on its own social page. Not a rule, directive or advisory.noneHEDGED ITS OWN TERMINOLOGY: “WE'VE BEEN TOLD THAT'S CALLED”
LOS ANGELES COUNTY DISTRICT ATTORNEYFraud alert dated November 8, 2019noneTOLD A REPORTER IN 2019 IT HAD NO CASES ON ITS BOOKS
MICHIGAN ATTORNEY GENERALPress release, April 17, 2023noneCITES THE TWO FEDERAL SOURCES ABOVE. NO STATE CASE OR COMPLAINT COUNT.
NEW YORK DIVISION OF CONSUMER PROTECTIONConsumer alert, June 5, 2023noneTHE ONLY US GOVERNMENT SOURCE THAT NAMES “A USB DEVICE CALLED A DATA BLOCKER”
8BODIES THAT WARNED
0THAT CITED AN INCIDENT, CASE NUMBER OR COUNT
1THAT NAMES THIS PRODUCT
WHAT THESE EIGHT ENTRIES ARE NOT, STATED BEFORE ANYONE ELSE SAYS ITNone of this is a finding that any office acted improperly. The FCC says it acted on consumer complaints, the FBI calls its post routine public-service amplification, the district attorney calls its alert fraud education. Those are legitimate stated bases for a warning. Our job here is to report what each instrument is and what each one cites, not to grade them. And the New York alert, useful as it is for naming the product, describes the mechanism in skimming terms that do not fit this attack, so we cite it for the name only.
A NINTH SOURCE CATALOGS RATHER THAN WARNS: NIST'S MOBILE THREAT CATALOGUE ENTRY PHY-1. ITS EXPLOIT-EXAMPLES FIELD IS A 2013 WRITE-UP OF A RESEARCH DEMO AND ITS CVE FIELD READS NOT APPLICABLE.CATALOGED
8bodies that warned
0that cited a case
1that names this product
How they position itNobody has assembled this table. A buyer who sells into this category needs it on day one, and it is the kind of asset that makes an address the one that gets linked to.
03
Five Days In April 2023
The week the subject came back, and why
DataBlockerHQ
Apr 6Apr 11Asked
See the timeline
Each one cited
the other.
Five days apart.
A field office posted on April 6. The FCC posted on April 11. The field office told three outlets its post stemmed from the FCC's existing page; the FCC told one of them its update was prompted by the field office post. Both are accurate descriptions of ordinary interagency awareness-raising. We print the sequence and stop.
APRIL 2023 · RECONSTRUCTED FROM CONTEMPORANEOUS REPORTING AND THE SOURCES THEMSELVESSEQUENCE
APR 6, 2023The FBI's Denver field office posts a warning on its social account. It names no incident, no location and no data. It is a field-office post: not a national advisory, not an IC3 public service announcement, not a private industry notification, not a Flash.
APR 11, 2023 · 5 DAYS LATERThe FCC posts about the same subject. Its underlying consumer page already existed and dated to 2019.
ASKED FOR THE BASISThe field office tells 3 separate outlets the post was routine and derived from the FCC page. The FCC tells one of them its update was prompted by the field-office post.
A SECOND FIELD OFFICEFBI Boston declined to amplify it and said there had been no local reports. Boston Logan's operator separately said it had received none either.
It was a standard PSA-type post - nothing new.THE FBI DENVER SPOKESPERSON, QUOTED IDENTICALLY BY THREE OUTLETS
THE ONE THING WE WILL NOT DO WITH THIS TIMELINEDescribing it as a circular citation makes it a story about institutional failure. It is not one. Agencies routinely amplify each other's consumer guidance, and that is what both offices said happened. The sequence is worth knowing because it explains why the subject surged in one week and reverted in five, which card 19 measures. It is not worth knowing as an accusation.
NO FBI NATIONAL ADVISORY AND NO IC3 PRODUCT ON THIS SUBJECT HAS EVER BEEN ISSUED. WE SEARCHED BOTH DOMAINS.CLEAN NEGATIVE
2023-04-06the field office post
5days to the FCC post
3outlets told the same thing
How they position itThe person who buys this name will be asked where the warning comes from, probably by a reporter. Having the answer already published, with the sequence straight, is leverage.
04
The Strongest Language, And Its Audience
A flat prohibition that was not written for consumers
DataBlockerHQ
ProhibitAudienceArchived
Read both
One agency
prohibits it
outright. Not
for you.
The most directive federal sentence on this subject is a prohibition, not advice. It appears in NSA guidance for government personnel carrying government-issued devices, and in one case specifically for travel outside the country. Quoting it as if it were consumer advice is the single most available error here, so we label the audience before the quote.
TWO NSA PRIMARY DOCUMENTS · AUDIENCE STATED FIRST, QUOTE SECONDAUDIENCE MATTERS
MOBILE DEVICE BEST PRACTICESGovernment personnel, government devices“Only use original charging cords or charging accessories purchased from a trusted manufacturer. DO NOT use public USB charging stations.”WE DO NOT PIN THIS ONE TO A CONFIDENT DATE. THE POSTED COPY AND THE DOCUMENT'S OWN REVISION LINE DISAGREE.
BEST PRACTICES WHEN TRAVELING OCONUSUS Government personnel abroad“Do not charge your devices by connecting them to charging stations, computers, televisions, DVRs, etc. Use only issued chargers or those acquired with sufficient OPSEC.”MAY 2018, U/OO/163759-18. AUDIENCE NAMED ON THE DOCUMENT ITSELF.
AND A SECOND AUDIENCE PROBLEM, ON A DIFFERENT AGENCY'S PAGECISA's November 2019 travel alert is the one most often cited for this. It is still online and it now carries CISA's own banner marking it archived content containing outdated information that may not reflect current policy or programs. The non-archived holiday-travel page says the same thing and is the one to cite. Neither page uses the term juice jacking at all; both advise against charging from any computer or charging station you do not control. Saying CISA warned about juice jacking puts a word in its mouth that is not on either page.
GUIDANCE WRITTEN FOR GOVERNMENT TRAVELERS CARRYING GOVERNMENT DEVICES IS NOT EVIDENCE ABOUT RISK TO THE PUBLICSTATED PLAINLY
2NSA documents
2018the overseas one
0written for consumers
How they position itAn address that gets the audience of each federal quote right is an address a corporate or government buyer can cite in a procurement memo. That is a different class of buyer from a storefront.
05
The One Request Anybody Filed
A freedom of information request, open since 2020
DataBlockerHQ
FiledReferredOpen
Read the docket
One request.
Filed 2019.
Still open.
In December 2019 a reporter asked the Department of Homeland Security for documents describing incidents, statistics or concerns about this. The request was referred to CISA in January 2020 and an extension was invoked. The public docket's last entry is that referral. There is no determination, which is a weaker and different fact from no records.
PUBLIC FOIA DOCKET · TWO AGENCY CASE NUMBERS · READ OCTOBER 1, 2026NO DETERMINATION
DEC 20, 2019Filed with the DHS Privacy Office, case 2020-HQFO-00394. The request, as written: documents describing incidents, statistics, or concerns about the practice of using cell phone charging as a cyberattack vector, produced since January 1, 2019.
JAN 23, 2020Referred to CISA as case 2020-NPFO-00086. A ten-business-day extension is invoked.
SINCE THENNothing. No records released, no denial, no determination of any kind. Estimated completion, as the docket prints it: none.
THE WORDING WE REFUSE TO USE, AND WHY IT MATTERS MORE THAN IT LOOKSIt would be easy and wrong to write that DHS or CISA searched and found nothing. The docket does not say that. It says the request was referred and then went quiet. “Never answered” is what the record supports. “No records exist” is a stronger claim the record does not support, and it is exactly the kind of upgrade that makes a whole page untrustworthy once somebody checks one line of it.
SIX YEARS, NINE MONTHS AND COUNTING. IT IS STILL THE ONLY REQUEST ON THIS SUBJECT WE COULD FIND.OPEN
2019-12-20filed
2020-01-23last docket entry
0determinations
How they position itA page that distinguishes an unanswered request from a negative finding is signaling the standard it holds itself to. That signal is what a serious buyer is actually shopping for.
06
Four Contacts, Two Interrupted
The whole product, at the level of the specification
DataBlockerHQ
PinoutTable 6-1Attach
See the pinout
Four contacts.
The product
interrupts two.
A legacy USB connector has four contacts and a shield. The specification assigns them by number and even by wire color. Power is contacts one and four. All data is contacts two and three. This entire product category is one decision: interrupt two of those four and pass the other two through.
USB 2.0 SPECIFICATION, APRIL 27, 2000 · SECTION 6.5.2, TABLE 6-1 · TERMINATION ASSIGNMENTPRIMARY SOURCE
CONTACT 1VBUS · the five volt rail · typical wire color redPASSES
CONTACT 2D minus · half of the differential pair · whiteCUT
CONTACT 3D plus · the other half · greenCUT
CONTACT 4GND · the return path · blackPASSES
SHELLShield · drain wirePASSES
THE PART THAT GETS LEFT OUT OF EVERY EXPLAINER, AND IT IS THE INTERESTING PARTAttachment and speed are announced on the data pair, not on the power rail. A downstream port holds fifteen kilohm pull-downs on both data lines; a device announces itself with a pull-up on one of them. Cut the pair and the host does not see a device it refuses to talk to. It does not see a device at all. There is no attach event to refuse.
THERE IS NO SEPARATE CLOCK CONTACT. TIMING IS RECOVERED FROM THE SAME TWO WIRES THIS PRODUCT CUTS.ONE PAIR
4contacts, plus shield
2interrupted
2000-04-27the specification date
How they position itThis is the simplest product in consumer electronics and almost nobody who sells it can describe it at this level. The address that can is the one an engineer and a buyer both trust.
07
A Maximum With No Minimum
The one design choice that decides your charging speed
DataBlockerHQ
BC 1.2OpenShorted
See both cases
One unpublished
design choice.
Fifteen times
the current.
Whether one of these costs you charging speed on a legacy port comes down to a choice no manufacturer publishes: leave the two data pins open, or tie them together. The charging specification says a dedicated charger must bridge those pins through no more than two hundred ohms, and sets no lower bound at all. A dead short is compliant, which is exactly why the trick works.
USB BATTERY CHARGING SPECIFICATION REV 1.2 · SECTIONS 3.2 AND 4.4.3, TABLES 5-2 AND 5-3THE HINGE
STEP 1 · OPTIONALData contact detect. A seven to thirteen microamp source on D plus, to confirm the data pins have actually mated.SKIPPABLE
STEP 2 · PRIMARYThe device drives 0.5 to 0.7 volts onto D plus, sinks current from D minus, and compares D minus against a reference of 0.25 to 0.4 volts.DECIDES
STEP 3 · SECONDARYDrives D minus, reads D plus, and separates a dedicated charger from a charging host port.SEPARATES
THE BRIDGE A CHARGER MUST HAVETable 5-3 gives the resistance across the two data pins a maximum of 200 ohm and states no minimum at all, so a dead short is compliant. “Shorted through no more than 200 ohm” is the correct phrasing; “a 200 ohm resistor” is not.200 ohm max
Since a DCP is required to short D+ to D- through a resistance of R_DCP_DAT, the device will detect a voltage on D- that is close to the voltage it is driving on D+.THE SPECIFICATION, SECTION 3.2.4, CONDENSED TO ONE LINE AND OTHERWISE ITS OWN WORDS
PINS LEFT OPENThe step above reads nothing on D minus. The device classifies the port as a plain downstream port. That ceiling is 500 milliamps, and 500 requires a configuration step that cannot happen with the pair cut, so the strict value is one unit load.100 mA · 0.5 W
15xapart
PINS TIED TOGETHERThe same step reads the driven voltage coming back. The device classifies the port as a dedicated charger and may draw the charging ceiling. The adapter has recreated the charger signature deliberately.1.5 A · 7.5 W
AND THE CONDITION THAT CREATES, WHICH NOBODY SELLING THESE MENTIONSWhen the adapter asserts that short, the signature no longer describes the port behind it. A phone can be told dedicated charger, draw one and a half amps, while physically plugged into a laptop port rated for five hundred milliamps. That is an overdraw condition created by the adapter, not by the charger, and it is a real engineering cost of the better-charging design.
200 ohmthe stated maximum
nonethe stated minimum
15xspread between the two cases
How they position itTwo numbers, fifteen times apart, decided by a detail no product page states. An address that explains the choice is the address a buyer in this category needs and cannot find.
08
The Fast Charging Is On A Different Wire
Why the usual criticism is right about one connector and wrong about the other
DataBlockerHQ
CCPD240 W
See the split
Modern power
negotiation does
not use the
data pins.
On the current connector, power delivery messaging is carried on the configuration channel, not on the data pair. An adapter that interrupts only the data contacts leaves that negotiation completely intact. The claim that these devices kill fast charging is accurate for the legacy connector and for the proprietary schemes, and not accurate here.
USB TYPE-C SPECIFICATION RELEASE 2.5 · SECTION 2.3.5 · AND POWER DELIVERY REV 3.2PRIMARY SOURCE
The USB PD Bi-phase Mark Coded (BMC) communications are carried on the CC wire of the USB Type-C cable.USB TYPE-C SPECIFICATION, VERBATIM, ONE SENTENCE
SURVIVES A DATA-PIN CUTEverything on CCAttach and detach detection. Plug orientation. Host-to-device data role. Power delivery messaging, configurable up to 48 volts and 5 amps, which is 240 watts at the top of the extended range. And the connector's own current advertisement, which reaches 3 amps at 5 volts with no power delivery negotiation at all.
LOST WITH THE DATA PINSBattery charging 1.2 detectionCard 07's whole mechanism. On the current connector that detection is capped at 5 volts and 1.5 amps anyway, so for a phone and charger that both speak power delivery the cost of losing it is effectively zero. On the legacy connector it is the only mechanism there is, and losing it is the whole penalty.
AND THE OTHER THING THAT DIES WITH THE DATA PINS, WHICH IS NOT IN ANY STANDARDThe proprietary fast-charge schemes signal by putting specific voltages on those same two pins. Those are licensed programs, not published standards, and the voltage levels are documented in authorized test-lab notes and in silicon datasheets rather than in any specification. Cut the pair and the device falls back to plain 5 volts. We cannot put a figure on that loss for any particular phone, and nobody honestly can, because it is device-specific and unspecified.
THE MOBILE PLATFORM'S OWN COMPATIBILITY DOCUMENT NOW STRONGLY RECOMMENDS AGAINST PROPRIETARY SCHEMES THAT MODIFY THE SUPPLY VOLTAGESHRINKING
240 Wthe extended range ceiling
3 Aon CC with no PD at all
1specification sentence
How they position itThe strongest objection to this product is that it slows charging. Being the address that explains exactly when that is true and when it is not turns the objection into the reason to come here.
09
The Standards Body Built This Connector Itself
Two notes that define a power-only receptacle, and name its cost
DataBlockerHQ
Note 16Note 17Cost
Read the notes
The specification
solved this, and
printed the
trade-off.
Two notes in the current connector specification define a power-only plug and a power-only receptacle. The receptacle shorts the two data contacts together inside the connector and does not route them to the board. The same note then says a sink built that way cannot run battery-charging detection. That is the standards body stating this product's exact trade-off in its own text.
USB TYPE-C SPECIFICATION RELEASE 2.5, MARCH 2026 · SECTION 3.2, NOTES 16 AND 17VERBATIM
WHAT THE SPECIFICATION ACTUALLY DEFINESTWO PARTS
POWER-ONLY PLUG, NOTE 16A depopulated plug. Contacts for the configuration channel, the supply rail and ground “shall be present”; physical presence in the other fifteen contact locations is optional. 9 contacts in all, no data contacts at any position. The note restricts it to a non-charger captive cable application and requires the configuration channel to be implemented.
POWER-ONLY RECEPTACLE, NOTE 17Here the data contacts are present, and then: “The D+ and D- contacts shall be shorted together inside the receptacle and not terminated to the board.” The same note, in the same breath: when used on a sink, “it will not support implementing USB BC 1.2.”
WHY THIS IS THE BEST SINGLE CITATION IN THIS WHOLE SUBJECTNo vendor is involved. The organization that writes the connector standard looked at the problem of passing power without data, chose the short-the-pins approach that card 07 describes, and in the next clause wrote down what it costs. Short the pins so a charger presents the dedicated-charger signature, and accept that a device built this way cannot run the detection sequence, because detection requires driving and measuring the two lines independently.
THE SAME SPECIFICATION STATES THAT RECEPTACLE-TO-LEGACY ADAPTERS ARE EXPLICITLY NOT DEFINED OR ALLOWEDSAME DOCUMENT
2specification notes
9contacts on the power-only plug
2026-03the release we read
How they position itA buyer selling into this category gets asked whether it is a real engineering approach or a gadget. The answer is two notes in the governing specification, and this address is where they are printed.
10
The Legacy Shape Is On A List Titled Prohibited
The unflattering fact about the category, printed rather than buried
DataBlockerHQ
6.46.4.4Logo
Read the list
The legacy form
is listed under
Prohibited Cable
Assemblies.
A legacy data blocker is an A plug on one end and an A receptacle on the other. The specification names exactly that assembly first in a section called Prohibited Cable Assemblies, and its stated reason is interoperability rather than safety. This is the least flattering fact available about the category, which is precisely why it belongs on the page and not off it.
USB 2.0 SPECIFICATION · SECTIONS 6.4 AND 6.4.4 · AND THE CERTIFICATION RECORDAGAINST US
This specification describes three USB cable assemblies … Any other cable assemblies are prohibited.SECTION 6.4, VERBATIM. SECTION 6.4.4 THEN LISTS THEM.
Authorized cable assembly types, totalstandard detachable, high and full speed captive, low speed captive3
Position of the matching entry under Prohibited Cable Assembliesan assembly providing a Series A plug with a Series A receptacle1st
The specification's stated reasonmay work in some situations, cannot be guaranteed to work in allinterop
Certification programs covering this productthere are programs for the buses, the connectors, cables, chargers and authentication0
Logo categories covering a charge-only cable or an adapterlogo use requires a license agreement, certification and a listing0
Data conductors required in a certifiable cabletwo data lines at 28 AWG, plus a power pair2
READ THIS AS WHAT IT IS, WHICH IS NEITHER A SAFETY VERDICT NOR A DISMISSALThe prohibition is about guaranteed interoperability, and the specification says so. It is not a finding that any such device is unsafe, and it is not a finding about any manufacturer. What it does mean is concrete and worth saying out loud: these are sold as adapters, they cannot carry a certified logo, and the legacy geometry sits outside the assemblies the specification authorizes. A category that admits that is a category a buyer can build a credible brand in.
CARD 09 IS THE OTHER HALF OF THIS. THE SAME ORGANIZATION DEFINED A CONNECTOR THAT DOES THE JOB PROPERLY.BOTH TRUE
3authorized assembly types
1prohibited entry that matches
0certification programs
How they position itPutting the governing specification's own prohibition on the page is the move that separates this address from every storefront in the category. It is the credential, not the liability.
11
For A Decade The Answer Was A Prompt
Where the trust-this-computer dialog came from
DataBlockerHQ
2013iOS 7Quiet
Read the origin
The fix was
asking the owner
to tap yes.
The 2013 research that injected software into a then-current phone over a charger ended in a recommendation: require the owner's consent before a host can pair. The vendor shipped it the next release. For about a decade that prompt was the whole defense, and the published research on charger attacks went quiet.
THE ORIGIN OF THE CONSENT DIALOG · AN INDUSTRY BRIEFING WITH A WHITEPAPER, NOT A REFEREED PAPERDATED
AUGUST 2011A village installation at a hacker conference offers free charging and flips to a red warning screen on connection. It captured nothing, by design, and its own screen said so. The term for the attack was popularized by a reporter's write-up of it.
JULY 2013Six researchers at a university lab show injection of arbitrary software into a current device with no jailbreak and no owner interaction. Roughly 60 seconds connected. A passcode-locked phone had to be unlocked at least once while attached. The hardware was a small development board; the whitepaper states no cost, so neither do we.
THE FIXIn the authors' own account, the vendor's next beta implemented one of their recommendations: require owner consent before the device pairs with an unknown host. That is the dialog everyone has tapped since.
ONE SENTENCE THAT GETS MISREAD CONSTANTLY, SO WE LABEL IT BEFORE QUOTING ITThe 2025 paper's abstract says that since the countermeasure was introduced, no new USB-based attacks with comparable impact have been found. That is a statement about the research literature. It is not a statement that phones were safe, and it is not a statement that phones were vulnerable all along. Converting it into either one is the easiest error in this subject.
THE 2013 RESULT TARGETED AN OS VERSION NOW 13 YEARS OLD AND THE SPECIFIC MECHANISM WAS CLOSED. IT IS NOT EVIDENCE ABOUT A CURRENT PHONE.EXPIRED
2013the research
60 sconnection time needed
1recommendation adopted
How they position itThis category sells against a threat whose history almost nobody gets right. The address that dates every claim correctly is the one that survives being fact-checked by a buyer's counsel.
12
The 2025 Paper That Taps Yes For You
The first published result to get past the consent prompt
DataBlockerHQ
ThreeElevenLab
Read the result
A charger that
confirms its
own prompt.
At USENIX Security in August 2025, four researchers from Graz University of Technology and A-SIT Austria showed that a malicious charger can supply the confirming input the prompt is waiting for. Eleven devices, eight vendors including the top six by share, every one susceptible to at least one of three techniques. It is the first published work to get past that mitigation.
CHOICEJACKING · 34TH USENIX SECURITY SYMPOSIUM, AUGUST 2025 · PEER REVIEWED, WITH ARTIFACT EVALUATIONREFEREED
TECHNIQUE ONEAccessory protocolThe charger acts as a USB host and sends accessory-protocol control requests, exploiting flaws that permit input injection while a data connection is being initiated. Runs on commodity hardware that supports host mode.
TECHNIQUE TWOPower role swap raceThe charger uses a USB Power Delivery data-role swap and floods the input dispatcher with crafted key events during the role transition. Succeeded on 9 of the 10 devices it applied to.
TECHNIQUE THREEBluetooth inputThe charger first pairs its own integrated Bluetooth input device, then switches to host mode to raise the consent prompt, then accepts that prompt over Bluetooth. 10 of 11 devices, across both platforms.
11DEVICES, ALL SUSCEPTIBLE TO AT LEAST ONE
8VENDORS, INCLUDING THE TOP 6 BY SHARE
133 msBEST CASE, ONCE THE PRECONDITION BELOW IS MET
On most evaluated devices, gaining data access through these attacks requires the victim device to be unlocked at some point during charging.THE PAPER, ON ITS OWN PRECONDITION. QUOTED BECAUSE IT IS THE LIMIT THAT MATTERS.
FOUR LIMITS ON THIS RESULT, EVERY ONE OF THEM FROM THE PAPER ITSELFAll evaluations were carried out in a lab, on dedicated research devices. The paper makes no claim that this or any charger attack has been observed in the world. Exactly one Apple device was tested, an iPad Pro 2022 on iPadOS 17.4.1, and only the third technique applied to it; the paper states it focuses on variants of Android, so nothing here can be generalized to iPhones or to any iOS version it did not test. And the authors' own recommended fix is on the device, not in an accessory: consent prompts for every kind of USB access, host, device and accessory mode alike.
THE THREAT MODEL NAMES AIRPORT STATIONS, CAFE PORTS, RENTABLE POWER BANKS AND HOTEL WALL SOCKETS. THAT IS THE SCENARIO THE PAPER ASSUMES, NOT A SURVEY OF DEPLOYED HARDWARE.ASSUMED
11devices tested
8vendors
133 msbest case, once unlocked
How they position itThe strongest technical fact in this category is a year old and almost nobody selling the product has read it. Owning the address that has is a durable advantage.
13
Two CVE Numbers And A Patch Level
This is a disclosed and partly fixed finding, not an open hole
DataBlockerHQ
CVEsPatchedResponse
See the record
Disclosed,
assigned, and
patched on a date
you can look up.
The reports went in during the middle of 2024. Two vendors assigned numbers. The higher-severity one was fixed at a published Android patch level that November. A fully patched current phone is not the phone the paper tested, and a page that leaves that out is a page a buyer's security team will dismantle in one afternoon.
DISCLOSURE AND REMEDIATION RECORD · REPORTS FILED JUNE TO JULY 2024FIXED IN PART
THE TWO ASSIGNED IDENTIFIERSBOTH PUBLIC
CVE-2024-43085 · ASSIGNED BY GOOGLESeverity high. Component framework, type elevation of privilege, reference A-353712853. Listed against AOSP 12, 12L, 13, 14 and 15. Fixed at Android security patch level 2024-11-01, in a bulletin published November 4, 2024. This is the flaw behind the locked-device file access found on two vendors' devices.
CVE-2024-20900 · ASSIGNED BY SAMSUNGAssigned for the attack principle and rated moderate by Samsung, with first improvements rolled out to its USB mode selection implementation.
All but one (including Google, Samsung, Xiaomi, and Apple) acknowledged our attacks and are in the process of integrating mitigations.THE PAPER'S ETHICS SECTION, VERBATIM. IT DOES NOT NAME THE ONE, SO NEITHER WILL WE.
THREE THINGS THIS CARD DELIBERATELY DOES NOT DOIt does not name or guess the vendor that did not acknowledge, because the paper does not and a guess would be unfair and unsupported. It does not identify the two vendors whose locked devices leaked files, and does not treat them as the insecure ones: all 11 devices from all 8 vendors were susceptible to at least one technique, Google's and Samsung's flagships included, and the differences come from how each vendor customized its USB stack. And it does not state the locked-device result without the patch level that closed it, because that pairing is the only honest way to print it.
A CVE NUMBER AND A PATCH LEVEL ARE FAIR TO PRINT. “VENDOR X LEFT USERS EXPOSED” IS NOT, AND WILL NOT APPEAR HERE.THE LINE
2CVE numbers assigned
2024-11-01the patch level
2024-11-04bulletin published
How they position itSecurity buyers test a vendor by whether it publishes the patch that weakens its own pitch. Doing that on the landing page is the fastest credibility there is.
14
What The Same Authors Say About This Product
The paragraph a seller would bury, printed whole
DataBlockerHQ
PassageCostsLimits
Read the paragraph
They name
two costs.
Both are
printed here.
The paper that broke the consent prompt has a paragraph on data blockers. It lists them among the mitigations that may be effective, then names two limits: the device only helps someone who already knows to carry one, and it interferes with modern power negotiation and slows charging. We print the paragraph whole, because a seller who hides it hands the buyer the argument.
THE SAME PAPER AS CARDS 12 AND 13 · ITS SECTION ON EXISTING MITIGATIONS · VERBATIMAGAINST US
USB Data Blockers. A frequent suggestion for mitigating malicious chargers are USB data blockers, which break USB data lines. However, this mitigation assumes that the user is aware of the potential for attacks, rendering it ineffective for the average end user. Data blockers also interfere with modern power negotiation schemes, thereby degrading charge speed.QUOTED IN FULL, WITH NOTHING CUT
READ IT PRECISELY, BECAUSE THE PRECISE READING IS BETTER THAN THE LOOSE ONEThe authors place blockers among existing mitigations that may also be effective. Their two criticisms are an adoption criticism and a charging-performance criticism. Neither is a finding that the device fails to stop the attack.
AND THE INFERENCE WE WILL LABEL AS AN INFERENCEThe paper does not test data blockers against its own attacks. That breaking the data lines prevents a USB data connection is sound reasoning from cards 06 and 08. It is reasoning, not a tested result, and anyone who prints it as a finding is overclaiming.
WHAT THEY RECOMMEND INSTEAD, WHICH WE ALSO PRINTConsent prompts for every kind of USB access, implemented on the device. No researcher in this literature recommends this product, and we will not attribute a product recommendation to any of them.
CARD 08 IS WHERE THE CHARGE-SPEED COST GETS QUANTIFIED AS FAR AS THE SPECIFICATIONS ALLOW. CARD 20 IS WHY WE PUT NO NUMBER ON IT.CROSS-REFERENCED
1paragraph
2stated costs
0omitted here
How they position itThe single most valuable thing this address can own is the honest version of its own worst citation. Every competitor in the category is one search away from being caught without it.
15
The Job The Phone Is Taking Back
What both platforms now do on their own, caveats included
DataBlockerHQ
HourPixel 6Caveats
See the controls
The platforms are
moving this job
into software.
Both mobile platforms now gate data connections behind the lock screen, and one of them times out after an hour. The newest control disables USB data while locked. None of it is on by default everywhere, each ships with published caveats, and the researchers' own objection to the software route is that it still waits on a person reading a screen correctly.
APPLE AND GOOGLE'S OWN DOCUMENTATION · QUOTED, WITH THEIR OWN CAVEATS ATTACHEDCURRENT
APPLE · FROM THE PLATFORM SECURITY GUIDE1 hour. “If more than an hour has passed since the iPad or iPhone has locked or since an accessory's data connection has been terminated, the device won't allow any new data connections to be established until the device is unlocked.” Activating one then takes Face ID, Touch ID or a passcode. An accessory connected while unlocked is remembered for 30 days, and always-on data connections can be switched back on in Settings.
GOOGLE · USB PROTECTION, FROM ITS OWN SUPPORT PAGEIt blocks unauthorized access over USB while the screen is locked, and charging continues. Google's own 4 caveats, in its words: it is available on Pixel 6 and later; it turns on only when device protection is enabled in Advanced Protection; a data connection started while unlocked stays active after locking; and USB remains unprotected until the boot process completes. Fast charging may not begin until the screen is unlocked.
AND THE RESEARCHERS' OBJECTION TO THE SOFTWARE ROUTE, IN THEIR WORDSOn the lock-screen approach: “As soon as the device is unlocked, USB connectivity is re-enabled. Most CHOICEJACKING attacks operate while the device is unlocked.” On the authentication approach: the screen “does not provide any clue about the operation it is needed for” and “might look like an innocuous screen unlock, which they routinely authenticate to.”
THE HONEST SHAPE OF THIS, WHICH CUTS BOTH WAYS AND SHOULDThe platform baseline is moving toward doing this job in software, which shrinks the product's remaining ground over time. Android's own compatibility document already says a device with a USB port should support disabling data signaling over USB. What a physical interrupt still does that none of the above does is hold regardless of OS version, patch level, vendor USB-stack customization, or whether a tired traveler read a dialog correctly at the gate. Both halves of that are true, and a page that prints only one of them is selling rather than informing.
1 hourthe lock-screen timeout
30 daysan accessory is remembered
4caveats the vendor publishes
How they position itA buyer's real question is whether this category has a future. Answering it with both platforms' own caveats, rather than a pitch, is what makes the address worth more than the product.
16
Zero For The Phrase, Two That Lapsed
What the trademark register says, reported and not interpreted
DataBlockerHQ
SearchedLapsedNeutral
Read the record
Nothing on file
for the phrase.
Two names for it,
both lapsed.
A buyer should know what the public register says before spending anything. We queried it on one day. The generic phrase returns nothing as a mark in any index we searched, and it is not even an entry in the office's goods manual. The two branded names this product has carried were both registered and both have lapsed.
USPTO RECORD · SEARCHED OCTOBER 1, 2026, AGAINST AN INDEX CURRENT TO THAT MORNINGRECORD ONLY
THE TWO BRANDED NAMES, BOTH NOW CANCELEDFULL RECORDS
THE SLANG NAME · CANCELED AUGUST 8, 2025Filed September 20, 2013, registered January 27, 2015 on the Principal Register, Class 9, filed on actual use with first use sworn to September 13, 2013. The word USB was disclaimed. Both the five-year and the six-year maintenance filings were accepted. It then went out under Section 8 at the ten-year mark, after a full term.
A BRANDED DEFENDER NAME · CANCELED JANUARY 2, 2026Filed August 25, 2014, registered June 16, 2015, Class 9. The registrant disclaimed the two category words and kept only what the remaining word added. Six-year maintenance accepted; out under Section 8 this January.
THE GENERIC PHRASE · NOTHING, SIX WAYSZero as an exact wordmark. Zero with both words in any order. Zero closed up as one word. Zero in the pseudo-mark index, zero in mark descriptions, and zero for the phrase joined to this name's suffix. It is accepted wording for Class 9 goods in four unrelated records, but it is not an entry in the office's goods manual at all.
1,945CLASS 9 DISCLAIMERS MENTIONING THE FIRST WORD
16CLASS 9 DISCLAIMERS MENTIONING THE SECOND
0DISCLAIMING THE PHRASE ITSELF
WHAT WE ARE NOT SAYING, AND WILL NOT SAY ON ANY VERSION OF THIS PAGEThose counts are our counts of search results on one day and they will drift. Nothing here is a conclusion that this name is available or registrable, or that it is not. Absence from this index is not clearance, because common-law rights need no registration and are not in it. We did not search phonetic variants, design marks, state registrations or foreign rights. And a cancellation under Section 8 is the ordinary administrative consequence of a maintenance document not being filed, not a failure by anyone; no registrant, applicant or attorney named in that record is characterized as having mishandled anything. Clearance and registrability are counsel's work.
NO PROCEEDING OF ANY KIND BEFORE THE TRADEMARK TRIAL AND APPEAL BOARD INVOLVES ANY OF THESE WORDINGSALSO CHECKED
0records for the phrase
2registrations, both lapsed
2026-10-01date searched
How they position itA buyer gets the register in writing before spending a dollar, including the two cancellations that do not flatter the category. That is what a serious seller provides and what nobody selling a domain ever does.
17
A Product With No Federal File
Four government indexes, four empty results
DataBlockerHQ
NAICSTariffRulings
Run the search
No industry code.
No tariff line.
No customs
ruling.
We searched the national industry classification index, the tariff schedule and the customs ruling database. There is no entry for this product in any of them, and no ruling has ever said which tariff line it belongs in. Every market-size figure in circulation is therefore a private model with nothing public to check it against.
FOUR FEDERAL INDEXES · QUERIES AND CONTROLS BOTH PRINTED, SO ANYONE CAN RE-RUN THEMOUR SEARCH
Industry classification index, 20,399 entries“blocker” anywhere in an entry0
Same index“data blocker”0
Control, proving the index covers this hardware family at all“USB” · both hits are flash drives, one making and one wholesaling2
Tariff schedule, full-text“data blocker” · 52 raw hits, every one a false positive on automatic data processing0
Customs ruling database, all collectionsthe product name, the slang name, and the threat name0
Control, same database“charge only” · four rulings, none about this product4
WHERE IT WOULD LAND, AND WHY THAT MAKES THE NUMBERS UNUSABLEThe plausible classifications are all catch-alls: electronic connector manufacturing and current-carrying wiring device manufacturing on the industry side, and connector, fitted-wire and parts-and-accessories baskets on the tariff side. A device like this falls into one of those alongside an enormous range of unrelated goods, which means no import, export or production statistic can be read as being about this product. The absence of a ruling also means there is no authoritative statement of which basket is the right one.
NOR IS IT AN ENTRY IN THE TRADEMARK OFFICE'S GOODS MANUAL, A SAFETY STANDARD, OR ANY CERTIFICATION CATEGORY. CARDS 10 AND 16.FOUR FOR FOUR
20,399index entries searched
0that name it
0customs rulings
How they position itProving a product has no federal file is harder than quoting a market report and worth far more. An address that has done it is the one a buyer builds a category brand on.
18
What The Register Does With Two Letters
The suffix, as the file actually treats it
DataBlockerHQ
2772Live
See the counts
The suffix is
common. It is not
routinely
given up.
Two letters at the end of a name are often assumed to add nothing. In the relevant class of the register, 277 marks end in these two letters and two carry a disclaimer that mentions them at all, and neither of those two gives the letters up on their own. That is what the file says. It is a count, not a legal conclusion, and we do not offer one.
USPTO RECORD · OUR COUNTS OF SEARCH RESULTS ON OCTOBER 1, 2026RECORD ONLY
277CLASS 9 MARKS ENDING IN THE SUFFIX, 125 OF THEM LIVE
1,769THE SAME, ACROSS EVERY CLASS
2CLASS 9 RECORDS WHOSE DISCLAIMER MENTIONS IT AT ALL
THE TWO THAT DO MENTION ITNeither disclaims the suffix standing alone. One disclaims a two-word phrase containing it; the other disclaims a longer string.0 alone
CLASS 9 RECORDS ENDING IN IT THAT CARRY SOME OTHER DISCLAIMERSo the suffix survives examination in records where other wording did not.53
LIVE CLASS 9 REGISTRATIONS ENDING IN IT, NONE DISCLAIMING ITNine of them, across farm equipment software, project tools, travel, cinema and more.9 read
ACROSS ALL CLASSES, RECORDS DISCLAIMING THE SUFFIX ON ITS OWNRoughly ten, in classes from legal services to apparel to metalworking. Two of those read it as an abbreviation for something else entirely.~10
BOTH DIRECTIONS OF CONCLUSION ARE REFUSED HERE, NOT JUST THE UNFLATTERING ONEWe will not write that the suffix is routinely disclaimed, because on these counts it is not. We will also not write that it therefore adds distinctiveness, because that is a legal judgment about a particular mark in a particular class and a database count cannot make it. Disclaimer practice is examiner-specific and record-specific. These totals describe what is in the file on one morning and nothing more.
NO WORDMARK IN THE ENTIRE REGISTER COMBINES THE SECOND WORD OF THIS NAME WITH THIS SUFFIXZERO
277Class 9 marks ending in it
2with any disclaimer mentioning it
1,769across all classes
How they position itMost buyers assume a two-letter suffix is dead weight on the register. Showing that the file disagrees, without overclaiming in the other direction, is a real and checkable answer.
19
Which Name People Actually Type
Relative demand for three names, on one shared scale
DataBlockerHQ
IndexSharedRevert
Read the curves
The threat word
spikes. The product
word is the one
climbing.
Three names went onto a single comparison scale for 262 weeks. The threat term is zero in 205 of them and has one enormous spike that reverted inside five weeks. The product term is the only one with a real baseline, and its six highest weeks are all in the last nine months. We print the index, never a search count, because an index is what the tool returns.
RELATIVE SEARCH INTEREST · US · ONE SHARED 0 TO 100 SCALE · 262 WEEKS TO SEP 27, 2026INDEX, NOT A COUNT
“data blocker” · ANNUAL MEAN INDEX2.34.17.36.815.234.3
“juice jacking” · ANNUAL MEAN INDEX0.00.34.80.53.41.6
2021ONE AXIS, ONE QUANTITY: BOTH SERIES DRAWN AGAINST THE SAME MAXIMUM OF 34.3. BARS UNDER 1.0 ON THE INDEX ARE DRAWN AT ONE VISIBLE FLOOR; THE PRINTED VALUE IS THE NUMBER.2026
A TERM ZERO IN 205 OF 262 WEEKS: THE SPIKE, AND ITS DECAY100 · 29 · 11 · 9 · 0
THE PRODUCT TERM'S SIX HIGHEST WEEKS, ALL OF THEM IN 202661 · 58 · 57 · 55 · 54 · 54
THE BRANDED DEFENDER NAME, ALL 262 WEEKS0
THE CAVEAT THAT WEAKENS OUR OWN BEST NUMBER, PRINTED NEXT TO ITThe rising term is the bare phrase, and the bare phrase is ambiguous. It can pick up people blocking trackers, advertisements or data brokers, not only this dongle. On a separate comparison a plainer description of the same product outranks it on average. We could not trace the 2026 rise to any single dated federal action and we will not guess at a cause. And no value on this card may be compared with a value from any other comparison set, because the scale is defined by the set.
THE SPIKE WEEK IS THE WEEK OF CARD 03. THE APRIL 2023 ATTENTION LEFT NOTHING BEHIND; THE 2026 RISE IS ITS OWN EVENT.MEASURED
205 of 262weeks the threat term is zero
6 of 6top product weeks in 2026
0 of 262weeks for the branded name
How they position itA buyer wants to know whether the demand is a news cycle or a trend. Measuring both on one axis, with the caveat that cuts against the answer, is how an address earns a price rather than asking for one.
20
What This Page Will Not Say
The claims we refused, published so they can be checked
DataBlockerHQ
MethodRefusalsSources
See the list
Ten things
we would not
put in print.
Every figure here names its source and its date. These are the statements that could not be made that way, so they are not made at all, and the list is published so a buyer can hold us to it.
DELIBERATE OMISSIONS · PUBLISHED SO THEY CAN BE CHECKEDNOT STATED
01Any claim that this has been confirmed happening to anyone, anywhere in the United States. We found no named victim, incident report, police report, arrest, charge, prosecution, court record or agency case number. The regulator says the same thing about itself on its own page, and card 01 quotes it.
02And the mirror of that: any claim that the risk is fake, or that the agencies were scaremongering. Headlines in that register exist and they are journalists' characterizations, not agency statements. Live identifiers from 2024, a refereed 2025 bypass, and a flat prohibition for government travelers all sit against it. “No publicly documented case” is a statement about the public record and that is all we will make it.
03Any incidence rate, victim count, complaint count, dollar loss or market size. No federal series measures any of it, as card 17 shows, and the regulator declined to provide its complaint details when asked. The market figures in circulation trace to one proprietary model sold under license, whose method its own page describes in three generic phrases. We name no number from it.
04Any charging-speed figure for a real phone with a real adapter. The specifications set ceilings, not behavior, and what a device does on a port it cannot identify is implementation-specific and unspecified. Card 07 prints the spec ceilings and card 08 prints which ones apply. A percentage would have to come from our own bench measurement and would be valid only for the exact three parts tested.
05That a data blocker is a complete defense. Card 14 prints the two costs the researchers name, in their words, including the one that cuts against the product. Card 15 prints what the platforms now do without it.
06Any named vendor, brand, airport, hotel or charging-station operator described as compromised, negligent, insecure, effective or ineffective. Nothing in our research supports any of it. The only on-record statement from an airport is that it had received no reports. We also do not name the one vendor that did not acknowledge the 2025 disclosure, because the paper does not.
07That a 2016 law-enforcement notice about a keystroke sniffer hidden in a charger shell was a warning about this. It is a different device: it listens to wireless keyboard traffic over the air and nothing is plugged into it. The conflation is common and it is wrong.
08That the conference demonstrations are incidents. The 2011 kiosk captured nothing by design and said so on its own screen. The 2013 and 2016 results targeted operating systems and video interfaces that are a decade or more out of date, and the 2013 mechanism was closed by the vendor. They establish feasibility. Cards 11 and 12 date each one.
09That whether a public USB port carries data is knowable from the outside. We could not find a single statement from any airport authority, airline or seating and in-seat-power supplier on whether their ports are data-capable. That absence is the usable point, and we will not fill it with a claim in either direction.
10Any conclusion about whether this name is registrable or available as a trademark. We report the public record on cards 16 and 18 and stop, in both directions. Clearance is counsel's work.
EVERY NUMBER ON THIS SITE CARRIES ITS SOURCE AND ITS DATETHE STANDARD
10refused claims
0incidence numbers printed
0unsourced numbers
How they position itThe omissions list is the strongest sales asset on the page. It tells a buyer exactly what kind of operator built this and what standard the address already carries.