You've Got (Wrong) Mail: Missing an 'i' in mail address for US military sends thousands of communications to Mali

A misplaced ‘i’ led to thousands of emails that were intended for the US military being accidentally sent to Mali. Pentagon is currently looking into the matter. The suffix used in the email address of US military includes ‘.mil’ and leaving the ‘i’ out resulted in the mail getting redirected to ‘.ml’, the domain used by the West African nation Mali. “Since 2015, the Department of Defense has been aware that typographical errors could result in the misdirection of unclassified emails intended for a ‘.mil’ recipient to the ‘.ml’ domain,” a US Department of Defense spokesperson Lt Commander Tim Gorman told ABC News. According to reports, some of these emails that were accidentally sent to Mali contained sensitive information including diplomatic documents, passwords and the travel itinerary of top defense officers. Pentagon spokesperson Sabrina Singh said that US officials are “aware of these unauthorized disclosures of controlled national security information.” Johannes Zuurbier, a Dutch internet entrepreneur who has a contract to manage Mali’s domain told Financial Times that he had identified the issue almost a decade ago. Zuurbier said that he has collected over 117,000 misdirected messages just to flag the problem to US officials. He received over 1,000 misdirected emails in a day as a result of the typo. The emails, however, were not marked “classified,” he said. “The Department takes all disclosures of Controlled National Security Information or Controlled Unclassified Information seriously and the Defense Information Systems Agency (DISA) began blocking .ml lookalike domains immediately,” Gorman said. “By 2023, the Defense Information Systems Agency (DISA) was blocking outbound emails to 135 .ml domains and subdomains. In July 2023, DISA began blocking outbound email to the entire .ml domain with the ability to allow legitimate emails,” he added.