The Ministry of Defence (MoD) has not done enough to stop further data breaches, MPs have warned, after the personal details of thousands of Afghans applying to move to the UK were leaked.
The House of Commons Public Accounts Committee (PAC) said the department “knew the risks” of using “inappropriate” data systems – namely Excel spreadsheets – to handle sensitive personal information as the Taliban seized power in Afghanistan.
However, it found the MoD “neither did enough to improve its processes, guidance, and culture in response to this risk, nor to learn lessons from multiple data breaches over successive years”.
MPs also criticised the department for failing to calculate the total cost of a secret relocation plan it set up after the data breach, saying its £850m estimate does not include costs of legal action or potential compensation claims.
Please use Chrome browser for a more accessible video player
A reminder of what happened…
In July, it emerged that details of nearly 19,000 applicants for the Afghan Relocations and Assistance Policy (ARAP) scheme were released “in error” by a defence official in 2022.
Excerpts from a spreadsheet containing the data were posted anonymously on a Facebook group, before the MoD became aware of the breach in August 2023.
It led to the imposition of a super injunction in September 2023, which blocked all coverage of the leak. The Afghanistan Response Route (ARR) was then set up to bring some of those affected to the UK.
After their information was leaked, an estimated 7,355 people became eligible for resettlement – added to those already included in the initial scheme, it amounted to around 27,278 candidates for relocation to the UK.
Defence Secretary John Healey offered a “sincere apology” on behalf of the government after reports of the leak emerged, calling it a “serious departmental error”.
In September, an Afghan source told Sky News hundreds of those relocated had since returned to Afghanistan for holidays and other trips.
Read more on this story:
Man pleads for King’s help
Thousands more Afghans affected by second breach
Analysis: Afghan retreat began as farce, now a cover-up
Please use Chrome browser for a more accessible video player
‘These risks crystallised,’ says PAC chair
The cross-party panel urged the MoD to confirm it is now using a new casework system to manage all Afghan resettlement schemes and give details of how it will prevent data breaches in the future.
Committee chairman Sir Geoffrey Clifton-Brown MP said “data breaches occurred in 2021 which were sufficiently serious to have to be reported to the Information Commissioner’s Office, giving a warning which MoD should have taken steps to heed”.
He added: “These risks crystallised into dozens of data breaches over years, and ultimately resulted in the 2022 breach, presenting a grave risk to thousands of lives and a cost to the taxpayer running into hundreds of millions of pounds, at least.
“I take no pleasure as chair of this committee in stating now that we lack confidence in the MoD’s current ability to prevent such an incident happening again.”
Read more from Sky News:
Amber weather warning issued for parts of UK
Inmate spared lethal injection in last-minute reprieve
Keep up with all the latest news from the UK and around the world by following Sky News
An MoD spokesperson said the incident “should never have happened”, and that “while the committee acknowledges that practices have improved, we are continuing to make changes and improvements in data handling across the department, such as introducing a dedicated, secure casework system for Afghan resettlement”.
“This government lifted the super injunction in July so that the public and parliament could rightly scrutinise this,” they said.
“The overall financial cost has never been concealed, and the government published the cost of all Afghan resettlement schemes, including the ARR, in the spending audit in July 2024.
“We continue to estimate that the overall cost of the ARR scheme will be £850m.”
