Microsoft error or external attack causing disruption to email communication across the climate change community - NewClimate Institute

Microsoft error or external attack causing disruption to email communication across the climate change community | NewClimate Institute
(in case you share a link to this page by email, please use this bit.ly link https://bit.ly/NewClimate_MicrosoftStatement to ensure delivery)

Since 17 October, to our knowledge any email with the NewClimate URL (newclimate dot org) in the email body, link, signature, reply header or contained anywhere in an attachment is unjustifiably quarantined by Microsoft email servers without any notice, regardless of who sends or receives the email.

That our own email flow is disrupted is the least of our problems: all Microsoft tenants are afflicted by the same issue when this URL appears in their emails, or any attachments they share, even when we are not a party to the communications.

Hundreds of governmental and non-governmental organisations working on climate change appear to be experiencing disruption to email communication when their communications contain any reference to the NewClimate URL.

For example, as per our understanding:

- No organisation using Microsoft email services can currently send the IPCC Sixth Assessment Report of Working Group 3 as an attachment to anyone else (newclimate dot org URL appears 11 times in the report). The same applies to hundreds of other relevant scientific papers and reports from any organisations, where NewClimate URLs appear on the reference lists.
- Any multi-organisation email chain where any of the participants uses Microsoft email services is breaking down in the case that NewClimate URLs are included. This could arise either because a NewClimate colleague is on the mailing list in the chat history, or if a NewClimate publication is linked to, in the email or the chat history.
- Even a link to this article on the NewClimate website cannot be spread by email if the sender or recipient uses Microsoft as email service.

We understand that the majority of our partner organisations within the climate community use Microsoft email services, including the United Nations Framework Convention for Climate Change (UNFCCC) and the Intergovernmental Panel on Climate Change (IPCC).

It came as a surprise to us that this is even possible. It remains unclear whether this is the result of a targeted attack on Microsoft’s infrastructure against NewClimate, or simply a highly unfortunate error on the part of Microsoft. In our consultations with Microsoft and a number of independent IT experts, we have confirmed that we are not on any blacklist and our website is also free of malware.

We are fully dependent on Microsoft to prioritise and solve the issue, but Microsoft support agents have been difficult to engage and – to our understanding – disinclined to prioritise the issue. It is not clear whether Microsoft is aware of the inconvenience and disruption beyond our own organisation.

Beyond being an existential threat to our own organisation, this issue could significantly disrupt communication within the climate community at a time when it is most critical in the run up to COP28 in at the end of 2023 in Dubai. We greatly appreciate any support to bring this issue to the attention of Microsoft’s senior management so that it can be prioritised and resolved.

This is extremely unfortunate and we apologise for any inconvenience that this may cause or may have caused.

We understand that partner organisations who use Microsoft email exchange services and that are experiencing email deliverability problems because of this issue may be able to apply a band-aid fix for email flow, by reporting to Microsoft that the NewClimate URL should not be blocked (see ‘Submission form for reporting false positives for Microsoft’s URL detonation policy’, available in the Microsoft admin center). This may help individual organisations to improve issues with their own incoming and outgoing email flow, but it does not help to resolve communication issues with other organisations that use Microsoft.

Emails are only quarantined when the text “newclimate(dot)org” appears in the email and not if a diverted link to the NewClimate website through e.g. tinyurl is included instead.