A cross-party committee of MPs has issued a stark warning that the Ministry of Defence has failed to implement sufficient measures to prevent future data breaches, following a catastrophic leak that exposed the personal details of thousands of Afghans seeking UK relocation.
A Grave Risk to Lives
The House of Commons Public Accounts Committee (PAC) revealed that the MoD "knew the risks" of relying on "inappropriate" data systems, specifically Excel spreadsheets, to manage highly sensitive information during the Taliban's seizure of power in Afghanistan. Despite this awareness, the department was found to have neglected crucial improvements to its processes, guidance, and organisational culture.
Committee Chairman, Sir Geoffrey Clifton-Brown MP, stated unequivocally, "These risks crystallised into dozens of data breaches over years, and ultimately resulted in the 2022 breach, presenting a grave risk to thousands of lives." He expressed the committee's profound concern, adding, "I take no pleasure... in stating now that we lack confidence in the MoD's current ability to prevent such an incident happening again."
The Costly Aftermath of the Breach
The incident in question occurred in 2022, when a defence official released details of nearly 19,000 applicants for the Afghan Relocations and Assistance Policy (ARAP) scheme "in error". Excerpts from the spreadsheet were anonymously posted on a Facebook group, with the MoD only becoming aware of the breach in August 2023. This led to a super injunction in September 2023 to block media coverage, which was only lifted by the government in July of this year.
In response, the government established the secret Afghanistan Response Route (ARR) to resettle affected individuals. An estimated 7,355 people became eligible for this scheme, bringing the total number of candidates for UK relocation to approximately 27,278.
MPs heavily criticised the MoD for its financial handling of the crisis. The department's estimated cost of £850 million for the ARR scheme was revealed to exclude potential legal action and compensation claims, with the PAC accusing the MoD of failing to calculate the total financial burden on the taxpayer.
Government Response and Ongoing Reforms
Following reports of the leak, Defence Secretary John Healey offered a "sincere apology" on behalf of the government, labelling the event a "serious departmental error".
An MoD spokesperson acknowledged that the incident "should never have happened" and pointed to ongoing reforms. They stated, "While the committee acknowledges that practices have improved, we are continuing to make changes and improvements in data handling across the department, such as introducing a dedicated, secure casework system for Afghan resettlement." The spokesperson also defended the government's transparency regarding costs, asserting that the overall financial impact had never been concealed.
The PAC has urged the MoD to confirm it is now using a new, secure casework system for all Afghan resettlement schemes and to provide concrete details on its strategy for preventing future data breaches.
