“Millions” of sensitive US military emails were reportedly sent to Mali due to a typo

For over 10 years, millions of emails associated with the US military have been getting sent to Mali, a West African country allied with Russia, due to a typo, according to a report from the Financial Times. Instead of appending the military’s .MIL domain to their recipient’s email address, people frequently type .ML, the country identifier for Mali, by mistake.

Johannes Zuurbier, a Dutch entrepreneur contracted to manage Mali’s domain, tells the Financial Times that this has been happening for over a decade despite his repeated attempts to warn the US government. When Zuurbier began noticing requests for nonexistent domains, like army.ml and navy.ml, he set up a system to catch these misdirected emails, which the Financial Times reports “was rapidly overwhelmed and stopped collecting messages.”

Since January alone, Zuurbier has reportedly intercepted 117,000 misdirected emails, several of which contain sensitive information related to the US military. According to the Financial Times, many of the emails include medical records, identity document information, lists of staff at military bases, photos of military bases, naval inspection reports, ship crew lists, tax records, and more.

Some of the misdirected emails were sent by military staff members, travel agents working with the US military, US intelligence, private contractors, and others, the Financial Times reports. For example, an email from earlier this year reportedly contained the travel itinerary for General James McConville, the US Army’s chief of staff, for his visit to Indonesia. The email included a “full list of room numbers,” along with “details of the collection of McConville’s room key at the Grand Hyatt Jakarta.”

“The Department of Defense (DoD) is aware of this issue and takes all unauthorized disclosures of Controlled National Security Information or Controlled Unclassified Information seriously,” Tim Gorman, a spokesperson for the Office of the Secretary of Defense, says in an emailed statement to The Verge. Gorman adds that emails sent from a .mil domain to Mali are “blocked” and that the “sender is notified that they must validate the email addresses of the intended recipients.”

Gorman acknowledges that this doesn’t stop other government agencies or those working with the US government from mistakenly sending emails to Malian addresses, though. Still, he notes that “the Department continues to provide direction and training to DoD personnel.”