Dutch man receives American military email for years due to typo; "Risk is real"

A Dutch man has been receiving thousands of emails linked to the American military due to a typing mistake. According to the Financial Times, Johannes Zuurbier has received more than 115,000 emails just since January because he manages Mali's top-level internet domain, .ml. The email issue is because of its similarity to .mil, the sponsored top level domain held by the U.S. military. "This risk is real and could be exploited by adversaries of the US," the Financial Times quoted Zuurbier as saying.

Most emails routed to Zuurbier do not contain classified information, but he said he has collected many with sensitive information from time to time. For example, travel information about high-ranking officers, passport numbers, details of weapons production, passwords, and tax returns. Zuurbier received over a thousand emails in a day last Wednesday.

Zuurbier discovered the problem almost ten years ago and said he has tried to contact the US government on several occasions to address it. According to the internet entrepreneur, it is a severe risk that enemies of the United States could use. American officials have done little with the warnings thus far, according to the Financial Times.

He has again raised concerns over the issue, as Zuurbier’s contract for the domain code expires on Monday. This means that the government of Mali will take back control of the .ml top level domain from Zuurbier's Amsterdam firm, Mali Dili. Mali has strong connections with Russia. The Russian state-funded paramilitary organization, Wagner Group, has been in combat alongside Mali’s military to fight off a jihadist rebellion trying to topple Mali’s government.

American military specialists believe it would be a large problem if a country like Mali were to receive sensitive military information. "If you have this kind of sustained access, you can generate intelligence even just from unclassified information," said retired Navy Admiral Mike Rogers, who formerly led the National Security Agency and the U.S. Army Cyber Command. “It’s not out of the norm that people make mistakes but the question is the scale, the duration and the sensitivity of the information," he told the newspaper.

Zuurbier does not just receive American emails. The Malian code .ml also has a one-letter difference from the Dutch top level domain, .nl. He received more than ten emails from Dutch military personnel. Those were about picking up ammunition in Italy and a Dutch helicopter crew in the United States, for example.