Machines with classified information are not connected to any network containing unclassified machines, and definitely not the internet.
...the spy can be easily identified.
USB drives are the most likely way to get info off a classified machine, which is precisely why they're forbidden.
Wow, I'd like to see the value of X that can fit all of those parameters!
Bell Labs Unix -- Reach out and grep someone.