Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Military insecurity

What happened when a British Internet domain was assumed to be that of a US Air Force base.
Backspin By Mark Gibbs , Network World , 03/06/2008
Gibbs
  • Share/Email
  • Comment
  • Print

The Internet is just shy of its 20th commercial birthday. Given that, and the fact that the Internet is based on technologies that are open, well-documented, and well-understood, you'd think that all serious enterprises that connect their e-mail systems to the Internet would be capable of ensuring their security and protecting their assets.

When I write "serious enterprises" I'm thinking about really big ones like, oh, say, the United States Air Force. The USAF is responsible for the safety of millions of people, including the president when he 's jetting around on Air Force One, and has a budget of billions of dollars to do the job.

The following might seem like a bit of a digression, but stick with me, we'll join up the bits in a moment.

There is a town over in Jolly Old England called Mildenhall in the delightful county of Suffolk where once upon a time (actually March 1997) a gentleman by the name of Gary Sinnott decided that his town needed a Web site.
Sinnott created a very nice site that included a diary and local news, pictures of the town and area, the area's history, and so on. All was well in this webified corner of that green and pleasant land until around 2000 when mildenhall.com started getting a lot of incorrectly addressed e-mail.

If you take the A101 north out of Mildenhall and drive for roughly 5 kilometers (they are, after all, Europeans) you will arrive at the gates of Mildenhall Air Force Base which is shared by both the United Kingdom (it's actually RAF Mildenhall) and the USAF.

Now, when you connect naïve users to the Internet and let them use e-mail, what mistake do they pretty much always make? Yep, they assume that every destination is in the .com domain. Thus it was that people both inside and outside the military started sending messages to mildenhall.com rather than mildenhall.af.mil.

Two problems came of this. First, the sheer volume of e-mail overwhelmed Sinnott and his server, and second, much of the content was nothing he ever wanted to see. This included (these are Sinnott's words): "SPAM. Loads of it! Military data — some very interesting. Personal information — some very personal. Some of the worst multimedia clips I've ever seen or heard. [And] interesting insights into what some Americans consider to be pornographic."

  • Share/Email
  • Comment
  • Print
Comments (4)
Login
Forgot your account info?

Military insecurityBy Anonymous on April 4, 2008, 5:24 pmThe most troubling part of this story is the part about sensitive information being sent via clear-text email. The U.S. Department of Defense has very strict rules...

Reply | Read entire comment

How big a problem?By Michael Sparks on March 20, 2008, 5:27 pmSomething I wonder is how often this occurs intentionally if the military has not paid close attention to this possibility in the past. What sort of sensitive email...

Reply | Read entire comment

Re: 20th Commercial Birthday?By Mark Gibbs on March 12, 2008, 12:05 pmI was using the date when the NSFNET first connected to MCIMail as the beginning of commercial use. From Wikipedia : The opening of the network to commercial interests...

Reply | Read entire comment

20th Commercial Birthday?By pjbrockmann on March 11, 2008, 3:22 pmMark: I thought the Internet's commercialization was in 1995 when the non-commercial use policy changed with the end of federal funding... or are you using the first...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed