Millions of US military emails have been mistakenly sent to Russian ally Mali due to a minor typo, The Financial Times reported. A Dutch entrepreneur contracted to manage Mali’s domain, Johannes Zuurbier, told the outlet that this has been happening for over 10 years despite his attempts to warn the US government.

What is the typo?

Even after receiving repeated warnings, emails continue to flow to the .ML domain, the country identifier for Mali, due to people mistyping .MIL, the suffix to all military email addresses in the US.

Some of the emails reportedly contain sensitive information such as passwords, medical record and itineraries of top officials.

117,000 misdirected messages

Zuurbier says he has been collecting the misdirected emails since January in hopes to convince the US to make the matter seriously. He claims he holds 117,000 such emails. Out of these 1,000 emails arrived on Wednesday last week. In his letter to the US early this month, Zuubier wrote, “This risk is real and could be exploited by adversaries of the US.” None of the emails collected by Zuubier were marked classified, but they reportedly included medical data, US military facilities’ maps, financial records and planning documents for official trips.

One misdirected email this year included the travel plans for General James McConville, the chief of staff of the US army.

Domain’s control to go to Mali government

The control of the .ML domain was due to go to the Mali government on Monday as Zuubier’s 10-year management contract expires. This would allow the Malian authorities to gather the misdirected emails.

Also Read
Bilateral South Korea-US consulting group meets in response to North Korean nuclear threats 

A spokesman for the Pentagon, Lt. Cmdr Tim Gorman, said the government “is aware of this issue and takes all unauthorised disclosures of controlled national security information or controlled unclassified information seriously”.

He added that the emails sent directly from the .MIL domain to Malian addresses “are blocked before they leave the .MIL domain and the sender is notified that they must validate the email addresses of the intended recipients”.