28 votes

Typo leaks millions of US military emails to Mali web operator

10 comments

  1. spit-evil-olive-tips
    Link
    archive link

    archive link

    Despite repeated warnings over a decade, a steady flow of email traffic continues to the .ML domain, the country identifier for Mali, as a result of people mistyping .MIL, the suffix to all US military email addresses.

    Zuurbier has been collecting misdirected emails since January in an effort to persuade the US to take the issue seriously. He holds close to 117,000 misdirected messages — almost 1,000 arrived on Wednesday alone. In a letter he sent to the US in early July, Zuurbier wrote: “This risk is real and could be exploited by adversaries of the US.”

    24 votes
  2. fefellama
    Link
    Reading the title I really thought it was going to be a typo of 'mail' to 'mali' but the '.mil' to '.ml' makes a lot more sense.

    Reading the title I really thought it was going to be a typo of 'mail' to 'mali' but the '.mil' to '.ml' makes a lot more sense.

    13 votes
  3. [5]
    drannex
    Link
    Could they not begin transitioning to .mil.gov? Makes a lot more sense than having their own sTLD. I realize it's one of the oldest TLDs out there (1985) but seems strange to have it separated in...

    Could they not begin transitioning to .mil.gov? Makes a lot more sense than having their own sTLD. I realize it's one of the oldest TLDs out there (1985) but seems strange to have it separated in the modern age. Especially since the DoD uses .gov.

    9 votes
    1. [4]
      cfabbro
      (edited )
      Link Parent
      The Government of Canada maintains its own SLD (.gc.ca), as do a bunch of others. I'm surprised the US government doesn't have something similar (like .gov.us or .us.gov) as well.

      The Government of Canada maintains its own SLD (.gc.ca), as do a bunch of others. I'm surprised the US government doesn't have something similar (like .gov.us or .us.gov) as well.

      3 votes
      1. [3]
        updawg
        Link Parent
        .gov is only for US governments (state or federal).

        .gov is only for US governments (state or federal).

        10 votes
        1. [2]
          cfabbro
          (edited )
          Link Parent
          TIL. I honestly don't know how I didn't know that. I always assumed .gov could be used by various international government organizations if they wanted to register there. Weird how that knowledge...

          TIL. I honestly don't know how I didn't know that. I always assumed .gov could be used by various international government organizations if they wanted to register there. Weird how that knowledge somehow escaped me all these years.

          3 votes
          1. JCPhoenix
            Link Parent
            Another weird one is .edu. Only US schools accredited by one of big regional accreditors can use a .edu TLD. There are some non-univs out there (such as AACSB.edu) that have a .edu address before...

            Another weird one is .edu. Only US schools accredited by one of big regional accreditors can use a .edu TLD. There are some non-univs out there (such as AACSB.edu) that have a .edu address before the rules were released and are grandfathered in, but they’re pretty rare these days.

            Weird vestiges of when the US essentially operated important parts of the Internet.

            9 votes
  4. [3]
    mxuribe
    Link
    I know this can get hairy pretty quickly (and maybe not all mail servers support this so easily), but could there not be some outbound mail rules that display an extra prompt for the user under...

    I know this can get hairy pretty quickly (and maybe not all mail servers support this so easily), but could there not be some outbound mail rules that display an extra prompt for the user under certain cases like wanting to send external messages? For example, if the destination emails included at least one or more recipients whose TLD is one of the "risky ones", couldn't they configure to trigger a popup? I know from user perspective its annoying, but i would happily deal with that annoiyance, rather than have to explain any mistakes to a superior officer or congress oversight committe member or the office of professional responsib., etc. I mean, we're talking the military here!

    9 votes
    1. [2]
      fefellama
      Link Parent
      Didn't see it in this article but I think in The Verge's article about this they got a response from an representative of the US Military who said that they do enact protective security measures...

      Didn't see it in this article but I think in The Verge's article about this they got a response from an representative of the US Military who said that they do enact protective security measures for outgoing emails, but that doesn't stop others (like contractors working with them) from sending it to the wrong email.

      4 votes
      1. mxuribe
        Link Parent
        Ah, ok, yeah; gotcha. Thanks!

        they do enact protective security measures for outgoing emails, but that doesn't stop others

        Ah, ok, yeah; gotcha. Thanks!

        1 vote