CNN
—
Millions of emails intended for Pentagon employees were inadvertently sent to email accounts in Mali over the last decade because of typos caused by the similarity of the US military’s email address and the domain for the West African country, according to a Dutch technologist who discovered the problem.
In some cases, sensitive information like hotel reservations for senior US military officials were revealed.
The emails were intended for owners of “.MIL” email accounts – the internet domain owned by the US military – but because of typos they were instead sent to the .ML domain, which handles email accounts in the West African country of Mali.
The email mishap reveals the security risks to US national security officials that can arise from an innocent typo. The personal information in the emails could be used to conduct targeted cyberattacks or to track the movements of Pentagon personnel – although there’s no evidence that happened in this case.
The Financial Times first reported on the issue.
Johannes “Joost” Zuurbier, a Dutch internet entrepreneur, received the emails because his company was contracted to manage the .ML domain. Since 2013, Zuurbier said, he has raised the issue with various US officials, including the US Embassy in Mali earlier this year.
“Yes, I was concerned, still am!” Zuurbier said in an email to CNN when asked about possible security risks and the misdirected emails.
Zuurbier’s contract to manage the .ML domain expired last week, he said, prompting him to raise awareness of the issue in the media.
None of the leaked emails were sent from official Department of Defense email addresses, but the department has blocked its email accounts from emailing .ml email addresses as a precaution, Deputy Pentagon Press Secretary Sabrina Singh said Monday.
She added that the “only thing that went through” were emails from personal accounts, like a Gmail or Yahoo account. The department strongly discourages using personal email accounts for official business, Singh said.
“The Department of Defense (DoD) is aware of this issue and takes all unauthorized disclosures of Controlled National Security Information or Controlled Unclassified Information seriously,” Lt. Cmdr. Tim Gorman said in a statement to CNN earlier on Monday.
The misdirected emails have grown less frequent in recent years, but still come by the hundreds per day, Zuurbier said. Many of the emails are spam, but some are sensitive.
One of the misdirected emails contained hotel room numbers for the Army chief of staff, Gen. James McConville, and his entourage on a trip they took in May to Indonesia.
And while the US government can’t prevent outside users from mistyping emails intended for the government, some of those making the typos were US government employees.
One email in Zuurbier’s stash is from an FBI agent and intended for a US Navy official, asking for personal information to process a Navy visitor to an FBI facility. The FBI agent uses the .ml domain.
CNN has requested comment from the Army and the FBI. The Navy declined to comment.
The Defense Department “has implemented policy, training, and technical controls to ensure that emails from the ‘.mil’ domain are not delivered to incorrect domains,” Gorman said in his statement.
“While it is not possible to implement technical controls preventing the use of personal email accounts for government business, the Department continues to provide direction and training to DoD personnel,” the statement continued.
The Pentagon has no control over whether third parties incorrectly type defense personnel’s email addresses, Gorman told CNN when asked about the matter.
This isn’t the first time this year that the US military has had to deal with an inadvertent email leak.
A trove of internal US Special Operations Command emails were publicly available online for about two weeks in February because of an IT misconfiguration. The Pentagon fixed the issue after a private security researcher discovered the leak.
