How a Typo Exposed US Military Secrets to Mali: A Lesson in Cybersecurity

In a startling incident that underlines the potential perils of the digital age, a typing error led to millions of sensitive messages meant for US defense employees landing in email accounts in Mali, a country known for its close ties with Russia. This embarrassing blunder has inadvertently laid bare personal information, including passwords and medical records. The episode not only sparks immediate security concerns but also emphasizes how the most unassuming of human errors can blow holes in the stringent walls of cyber defenses.

Cause: Human Error

In a recent report by the Financial Times, it has been revealed that millions of sensitive messages intended for US defense employees were mistakenly sent to email accounts in Mali due to a typographical error. The cause of this alarming breach was attributed to a simple typing error, wherein the emails were inadvertently directed to accounts with the “.ml” suffix instead of the correct “.mil” domain, leading them to individuals residing in the West African nation.

The consequences of this accidental data leakage were severe, as some of the misdirected messages contained personal information, including passwords and medical records of military personnel. Even more troubling,

…one of the emails exposed the hotel room number and itineraries of Gen. James McConville, the US Army Chief of Staff, during his trip to Indonesia earlier this year.

The incident highlights the potential risks of such data leaks, particularly when adversaries of the US may use seemingly harmless information to build dossiers on military personnel or attempt to extract valuable information for espionage purposes.

Upon discovering the issue, the US Department of Defense (DoD) promptly took action to address the problem. As a precautionary measure, they blocked all “.ml” email accounts, both before they left their servers and upon arrival in Mali. Additionally, the senders were notified to validate the intended recipients of their emails to prevent any further mishaps.

First Raised Ten Years Ago

Ironically, the problem of misdirected emails has been known for over a decade, with Dutch internet entrepreneur Johannes Zuurbier first discovering the issue more than ten years ago. Back in 2013, Zuurbier was contracted to manage Mali’s internet domain and stumbled upon tens of thousands of misdirected emails from the US. His recent collection of nearly 117,000 misdirected messages, with almost 1,000 arriving in a single day, prompted him to alert US officials about the ongoing issue.

When .ML is used instead of .MIL the Malinese government receives sensitive info instead of the US military. Dutch contractor has tried to raise the issue >> Typo leaks millions of US military emails to Mali web operator ↘️ https://t.co/DLxBgfLkSg

— Marietje Schaake (@MarietjeSchaake) July 17, 2023

Concerned about the risk it poses, he recently wrote a letter to US officials to raise the alarm, emphasizing the potential exploitation of the situation by adversaries of the US. Moreover, he also stated that his contract was about to end, and with Mali’s military government scheduled to take control of the domain heightens security concerns given its close alliance with Russia. This fact adds an additional layer of potential security implications.

Mali-Russia Relations

In recent years, the relations between Mali and Russia have garnered attention due to various engagements and developments. In February 2023, Russian Foreign Minister Sergey Lavrov visited Mali and announced increased military support for the Malian army junta. Moscow’s assistance is aimed at aiding Mali in its efforts to combat an Islamist insurgency in the Sahel region. This visit marked the first time a head of the Russian Foreign Ministry had visited Mali, while it was Lavrov’s third trip to Africa since July 2022. Russia’s engagement in Africa is part of a broader strategy to expand its presence on the continent following international isolation resulting from its invasion of Ukraine last year.

It is important to note that the meeting between Russian officials and the Malian junta occurred in the context of ongoing concerns about human rights violations and possible war crimes. The United Nations recently called for an independent investigation into alleged war crimes and crimes against humanity by both Malian government forces and the Russian private military contractor, Wagner Group, in Mali. This underscores the complex dynamics of the Mali-Russia relationship, where military and defense ties are coupled with concerns about human rights and accountability.

In addition to military and defense cooperation, Mali also seeks to strengthen its economic ties with Russia and gain preferential access to essential products. The desire for enhanced economic cooperation reflects Mali’s aspirations for economic development and diversification of its trade partnerships.

The evolving relations between Mali and Russia reflect a mix of strategic interests, security concerns, and economic objectives. As these dynamics continue to unfold, it is essential to closely monitor developments and their implications for both countries and the broader regional context.

A Wake-Up Call for Vigilance

While classified and top-secret US military communications are transmitted through separate IT systems, mitigating the risk of accidental compromise, experts have highlighted the potential security risks associated with seemingly harmless information. Even seemingly innocuous details about individual personnel could prove useful to US adversaries, allowing them to build dossiers for espionage purposes or coerce individuals into disclosing critical information in exchange for financial benefits.

Security experts, including Steven Stransky, a former senior counsel to the Department of Homeland Security’s Intelligence Law Division, have emphasized that human error poses significant risks in both government and private sector IT environments.

Lee McKnight, a professor of information studies at Syracuse University, has noted that the US military was fortunate that the misdirected emails ended up in a domain used by Mali’s government rather than falling into the hands of cybercriminals. The incident highlights the prevalence of “typo-squatting,” a cybercrime technique targeting users who incorrectly misspell internet domains, exploiting their mistakes to deceive and potentially compromise them.

As experts underscore the significance of human error as a primary security concern on a daily basis, it becomes clear that continuous training, stringent cybersecurity measures, and heightened vigilance are paramount to safeguarding sensitive information. This incident serves as a stark wake-up call for the US government and other organizations to stay ahead of emerging threats, fortify their cybersecurity defenses, and remain steadfast in their commitment to national defense and data integrity.