Typo sends millions of US military emails to Russian ally Mali

A simple typing error has resulted in millions of US military emails being misdirected to the West African nation of Mali, an ally of Russia. The issue stemmed from a common typographical error when entering the US military's domain, ".mil", which has instead been typed as ".ml" - the domain suffix for Mali.

This blunder has been ongoing for years, resulting in the unintended dissemination of sensitive non-classified information such as personnel medical records, financial documents, and high-ranking officers' travel itineraries.

The US Department of Defense, in response to the leak, has implemented measures to rectify the situation, though the specifics of these steps have not been disclosed.

Johannes Zuurbier, a Dutch internet entrepreneur and the individual responsible for managing Mali's country domain since 2013, initially discovered this typographical misdirection over a decade ago. The Financial Times, which brought the story to light, reported that Zuurbier has intercepted tens of thousands of these misdirected emails in recent months.

The emails, although not classified, reportedly contained various forms of data including medical records, financial documents, US military facility maps, and planning details for official trips. Some even included diplomatic messages.

In a letter to US officials earlier this month, Zuurbier raised concerns about his impending contract termination with the Malian government, warning of potential exploitation of this information by US adversaries. He emphasized that, "the risk is real and could be exploited by adversaries of the US".

Following the end of Zuurbier's contract, Mali's military government is set to assume control of the domain, escalating the potential risks.

US military communications that carry the "classified" or "top secret" markings are transmitted through separate, secure IT systems, mitigating the risk of them being accidentally compromised. This is according to both current and former US officials.

However, Steven Stransky, former senior counsel to the Department of Homeland Security's Intelligence Law Division, warns that even seemingly benign information can provide valuable insights to adversaries. He explained that foreign actors could use these details to build extensive profiles of military personnel for espionage purposes or for blackmail attempts.

Lee McKnight, a professor of information studies at Syracuse University, observed that the US military was fortunate to have this issue brought to their attention and that the emails were redirected to a government domain rather than to potential cyber criminals.

He also touched on the prevalence of "typo-squatting", a common cyber-crime that exploits user errors in typing internet domains. "They're hoping that a person will make a mistake, and that they can lure you in and do stupid things," McKnight commented.

The Department of Defense, when approached by the BBC, confirmed their awareness of the issue and their commitment to taking it seriously. They stated that steps have been taken to prevent ".mil" emails from being sent to incorrect domains, which include blocking them before they leave and alerting senders to validate the recipients' email addresses.

Both McKnight and Stransky concur that human errors are a major concern for IT specialists, whether in government or private sectors. Stransky summed up this sentiment, saying, "Human error is by far the most significant security concern on a day-to-day basis. We just can't control every single human, every single time."