By: Micaela Burrow, Daily Caller News Foundation
A massive number of U.S military emails concerning highly sensitive items, including passwords to intelligence networks, have leaked to a domain held by a Russian ally in Africa through a “typo,” the Financial Times reported.
Johannes Zuurbier, a Dutch internet expert, identified the problem a decade ago when he began a 10-year contract with the Malian government to manage its country code, ML, and has been trying with little success to alert the U.S. government of the potential risks if the issue does not get resolved, according to the FT. On Monday, control of the .ML domain will revert from Zuurbier back to Mali, potentially allowing a country where Russia boasts a major foothold to access the accidental messages.
“This risk is real and could be exploited by adversaries of the U.S.,” he wrote in a July letter to the U.S., according to the FT.
Since January, Zurrbier, managing director of Amsterdam-based Mali Dili, has collected roughly 117,000 misdirected emails caused by senders mistyping .ML in email suffixes instead of .MIL, the domain identifier for all U.S. military and Pentagon email addresses, according to the FT. Zuurbier hoped documenting the misdirected emails would persuade the U.S. to finally mitigate the problem.
Zuurbier has approached White House and U.S. defense officials, the defense attaché in Mali and a senior adviser to the U.S. national cyber security service, several times throughout the years without success.
The Department of Defense “is aware of this issue and takes all unauthorized disclosures of controlled national security information or controlled unclassified information seriously,” Pentagon spokesperson Lt. Cmdr Tim Gorman told the FT. Emails sent directly from the .MIL domain to .ML addresses “are blocked before they leave the .mil domain and the sender is notified that they must validate the email addresses of the intended recipients,” he added.
Most emails Zuurbier has received are marked as spam and none appear to contain classified information, according to the FT.
When he began managing Mali’s country code in 2013, he noticed requests to contact domains such as army.ml, which appeared to be a mistyping of, for example, army.mil, according to the FT. He set up a system to capture all the requests, suspecting them to be emails, but it became overwhelmed and stopped accepting correspondence.
Zuurbier told the outlet he sought legal advice and provided his wife with a copy “just in case the black helicopters landed in my backyard” before attempting to contact U.S. authorities.
Some emails appear to originate from travel agents working for the DOD, while others contain misspellings from DOD staff corresponding between themselves, according to the outlet. But others are more serious.
One email contained a travel itinerary and lodging details for Army Chief of Staff Gen. James McConville ahead of his trip to Indonesia in May, according to the FT.
An FBI agent forwarded documents marked “For Official Use Only” and an alert from the Turkish embassy about intelligence on potential terrorist operations. About a dozen individuals had passwords for an unnamed intelligence community system sent to a .ML address, while others sent requests for the key to enter a password-protected secure DOD file exchange.
“If you have this kind of sustained access, you can generate intelligence even just from unclassified information,” former NSA director retired Adm. Mike Rogers told the FT.
