Sensitive US military emails misrouted to Mali for a decade due to typo

Sensitive US military emails have reportedly been sent to Mali for over a decade due to a typo, according to a report from the Financial Times.

The error occurs when individuals mistakenly type .ML, the country identifier for Mali, instead of appending the military's .MIL domain to the recipient's email address.

Johannes Zuurbier, a Dutch entrepreneur contracted to manage Mali's domain, has been trying to alert US military officials to the leak for years. Despite his efforts, the problem remains, and classified information related to the U.S. military is intercepted.

Zuurbier set up a system to catch misdirected emails, but it became overwhelmed and stopped collecting messages. Since January alone, Zuurbier has intercepted 117,000 misdirected emails, including medical records, identity documents, staff lists, photos of military bases, naval inspection reports, and tax records. Some of the emails were sent by military staff members, US intelligence, private contractors, and travel agents working with the US military.

One concerning example mentioned in the report was an email containing the travel itinerary for General James McConville, the US Army's chief of staff, during his visit to Indonesia. The email included details such as room numbers and the collection of McConville's room key at a specific hotel.

However, Zuurbier's contract with Mali is set to expire soon, and authorities in Mali will gain access to the intercepted emails.

The US Department of Defense (DoD) acknowledges the issue and takes unauthorized disclosures of sensitive information seriously. The DoD blocks emails sent from a .mil domain to Mali and notifies the sender to validate the email addresses of the intended recipients.

However, there is still a risk of other government agencies or individuals working with the US government mistakenly sending emails to Malian addresses.