Former MoD permanent secretary rejects fall guy claim

The former Permanent Secretary at the Ministry of Defence has pushed back on a suggestion from the Defence Committee chair that he had been made the “fall guy” for the Afghan data breach, while repeating his personal apology for what he described as “a serious departmental failing in which the MOD fell well short of the standards that you might reasonably expect.”

David Williams, who served as Permanent Secretary at the MoD until earlier this year, appeared before the Defence Committee on 21 April alongside former Second Permanent Secretary Paul Lincoln to give evidence on the Afghan data breach and resettlement schemes, with both men describing their personal reflections on what went wrong and what lessons should be drawn.

Williams opened his evidence by reiterating the apology he had previously made to those affected by the breach, saying he welcomed the opportunity to return to the Committee despite no longer being a serving civil servant, and that he and Lincoln had been “reflecting on our own personal take on this” ahead of the hearing, grouping their lessons around the importance of “setting up for success” in a cross-government venture, how to transition from crisis to sustainable delivery, and questions of accountability, risk management and transparency.

On the question of scale, Williams confirmed that when the ARAP scheme was established it was expected to handle around 800 principals and 4,000 people in total, and that the scheme eventually received around 200,000 applications, a volume that was described as “a materially low underestimate” in the light of the withdrawal from Afghanistan and the collapse of the Afghan government, and which created the conditions in which data risks became increasingly difficult to manage.

Lincoln told the Committee that concerns about the risks of releasing data had been raised with ministers in the form of advice including threat assessments, saying that if the information “was to be released and then fall into the hands of the Taliban — it could have provided a threat to life”, with the primary consideration in seeking a super-injunction being the Department’s ability to put in place policies and procedures to protect those thought to be at risk.

Williams also told the Committee that the best departmental estimate of the cost of the data breach at the time the super-injunction was lifted last summer was around £850 million, of which about half had already been spent, though he acknowledged the figure was his “best” estimate and “not necessarily fully robust”, and noted that the NAO had done “a pretty thorough job on the costs” in its recent report, which put the total cost of all resettlement schemes from Afghanistan at £5.7 billion.