Typo Sends Millions of US Military Emails to Mali

Over the years, millions of emails intended for the U.S. military have instead gone to the West African country of Mali, an ally of Russia, because of a minor typing error that changes the emails’ domain name. 

Emails that have been intended to head to the military’s “.mil” domain have gone to Mali, whose country’s email ends with the “.ml” suffix, for more than 10 years, with some of the messages containing sensitive information like medical records, passwords, and top officers’ itineraries, reports the BBC. 

The Pentagon has said it has taken steps to address the issue, but Dutch internet entrepreneur Johannes Zuurbier identified the problem more than 10 years ago, according to The Financial Times, which first reported the story. 

Zuurbier said he’s had a contract since 2013 to manage Mali’s country domain and that in recent months, he has collected tens of thousands of emails that were misdirected because of the typo. 

None of the emails were marked classified, but still included medical data, diplomatic messages, financial records, and maps of U.S. military facilities, The Financial Times reported. 

Zuurbier has written a letter to U.S. officials on the issue, and said that as his contract with Mali’s government is finishing soon, “the risk is real and could be exploited by adversaries of the U.S.” 

The government of Mali was due to take control of the domain Monday. 

According to former and current U.S. officials, military communications that are marked as classified or top secret go through separate systems, making it unlikely they will be compromised, but Steven Stransky, a lawyer who previously served as senior counsel to the Department of Homeland Security’s Intelligence Law Division, said that even information that seems harmless could prove useful to the country’s adversaries. 

“Those sorts of communications would mean that a foreign actor can start building dossiers on our own military personnel, for espionage purposes, or could try to get them to disclose information in exchange for financial benefit,” he said. “It’s certainly information that a foreign government can use.”

A Department of Defense spokesperson, when contacted by the BBC, said the department is taking the situation seriously and is taking steps to ensure that military emails aren’t going to the wrong domain. 

These steps include blocking the messages before they leave and notifying people sending them that they must validate the intended recipients.