Millions of US military emails have been mistakenly sent to Mali, a Russian ally, because of a minor typing error, it has been reported.
Emails intended for the US military’s “.mil” domain have, for years, been sent to the west African country which ends with the “.ml” suffix, in what has been branded a “typo leak”, the Financial Times reported.
Some of the emails reportedly contained sensitive information such as passwords, medical records and the itineraries of top officers.
One misdirected email this year included the travel plans for General James McConville, the chief of staff of the US army, and his delegation for a then-forthcoming visit to Indonesia in May, according to the FT.
Misdirected emails were also said to include naval inspection reports, contracts, criminal complaints against personnel, internal investigations into bullying, official travel itineraries, bookings, and tax and financial records.
Johannes Zuurbier, a Dutch internet specialist contracted by Mali to manage its country’s domain, told the FT that he first came across the Pentagon emails ten years ago and sounded warnings, but to no avail.
In recent months, he has reportedly collected tens of thousands of misdirected emails.
He began collecting examples and wrote to the Pentagon this month. He said that his contract with the Mali government was about to finish and warned: “This risk is real and could be exploited by adversaries of the US.”
Mali’s military government was due to take control of the domain on Monday.
Lt. Cmdr Tim Gorman, a spokesman for the Pentagon, said the Department of Defense “is aware of this issue and takes all unauthorised disclosures of controlled national security information or controlled unclassified information seriously”.
None of the misdirected emails contained classified intelligence.
US military communications that are marked “classified” and “top secret” are transmitted through separate IT systems that make it unlikely they will be accidently compromised, according to current and former US officials.
