Millions of internal US military email messages have ended up on a Malian internet server over the past 10 years thanks to a small error in typing addresses.
Personnel mistakenly typed '.ml' — the top-level internet domain for the central African nation — instead of the and Department of Defense (DoD) '.mil' suffix.
Dutch internet entrepreneur Johannes Zuurbier, whose Mali Dili company's contract to run the Malian internet country domain is about to end, has warned the Pentagon of the problem repeatedly over the past decade after taking legal advice — which he gave a copy of to his wife "just in case the black helicopters landed in my back yard."
"This risk is real and could be exploited by adversaries of the US," he wrote in a letter earlier this month.
Zuurbier has amassed a collection of almost 117,000 misdirected Pentagon emails over the years, with nearly 1,000 coming on on July 12 alone.
While much of those emails are spam and none are marked 'classified', some contain personal details of DoD staff, contractors and their families including medical data, ship crew manifests and base personnel lists, travel plans, details of criminal complaints and disciplinary procedures against service-people and photographs of defense facilities.
One email contained the full itinerary for US Army Chief of Staff General James McConville's delegation to Indonesia in May this year — including hotel room numbers.
“If you have this kind of sustained access, you can generate intelligence even just from unclassified information,” said retired Admiral Mike Rogers, a former chief if the National Security Agency (NSA) and the US Army Cyber Command. “This is not uncommon. It’s not out of the norm that people make mistakes but the question is the scale, the duration and the sensitivity of the information.”
He feared that un-named foreign powers could take advantage of the leaks to Mali, which has turned away from former colonial power France to Russia for help in fighting terrorist insurgents.
“It’s one thing when you are dealing with a domain administrator who is trying, even unsuccessfully, to articulate the concern,” Rogers warned. “It’s another when it’s a foreign government that... sees it as an advantage that they can use.”
Pentagon spokesman Lieutenant Commander Tim Gorman insisted that the DoD “is aware of this issue and takes all unauthorised disclosures of controlled national security information or controlled unclassified information seriously.”