Because of a tiny typing error, millions of US military emails were transmitted to Mali, a Russian ally.
For years, emails meant for the US military’s “.mil” domain have been routed to the West African country with the “.ml” extension.
Some of the emails allegedly contained sensitive information such as passwords, medical records, and high officers’ travel plans.
The Pentagon stated that it had taken steps to fix the problem.
The problem, according to the Financial Times, was spotted more than ten years ago by Dutch online entrepreneur Johannes Zuurbier.
He has held a contract to handle Mali’s national domain since 2013 and has apparently collected tens of thousands of misdirected emails in recent months.
None were tagged as classified, but they included medical data, maps of US military bases, financial records, and planning documents for official trips, as well as some diplomatic letters, according to the newspaper.
This month, Mr Zuurbier issued a letter to US officials to raise the alarm. He stated that his contract with the Mali government was about to expire, implying that “the risk is real and could be exploited by US adversaries.”
On Monday, Mali’s military administration was set to take control of the domain. Mr Zuurbier was contacted for comment.
According to current and former US officials, “classified” and “top secret” US military communications are routed through separate IT networks, making it unlikely that they will be accidentally compromised.
However, Steven Stransky, a lawyer who previously served as senior counsel to the Department of Homeland Security’s Intelligence Law Division, believes that even seemingly innocuous material could be beneficial to US adversaries, especially if it includes specifics on individual employees.
“Those kinds of communications would imply that a foreign actor could begin compiling dossiers on our own military personnel for espionage purposes, or could try to persuade them to reveal information in exchange for financial benefit,” Mr Stransky explained. “It’s information that a foreign government could use.”
Lee McKnight, a Syracuse University professor of information studies, believes the US military was lucky that the issue was brought to its attention and that the emails were directed to a domain used by Mali’s government rather than cyber criminals.
He went on to say that “typo-squatting” – a sort of cybercrime that targets individuals who misspell an internet domain – is rampant. “They’re hoping that a person will make a mistake, and that they can lure you in and make you do stupid things,” he explained.
When contacted by the BBC, a representative stated that the defense department was aware of the situation and was taking it seriously.
They stated that the department had taken procedures to guarantee that “.mil” emails were not sent to wrong domains, such as banning them before they left and informing senders that they needed to authenticate intended recipients.
Human errors, according to both Mr McKnight and Mr Stransky, are major problems for IT professionals working in government and the business sector.
“Human error is by far the most significant security concern on a day-to-day basis,” Mr Stransky explained. “We simply cannot control every single human being, every single time.”
