In fall 2011 Windows computers used load and store data associated with unmanned ariel vehicles at Indian Springs Air Force Base were infected with key loggers.
It appears to me (former USAF navigator) that the infected computers were used for mission planning, not for directly controlling the aircraft. It's very possible that these computers could access the civilian internet. In any case, Stuxnet showed how to extract captured data from an air gapped facility. The Air Force has to assume that data entered in to the infected computers has been compromised.
The other known security fiasco associated with the Air Force UAV program was the fact that the UAV video downlinks were for a long time unencrypted and could be monitored with civilian TV satellite receivers. Rumor has it this vulnerably was discovered during interviews with captured Iraqi insurgents.