Afghan allies failed by years of delay and secrecy say MPs

Afghans who worked with UK forces were wrongly refused relocation and left facing years of danger, delay and uncertainty, with a Ministry of Defence data breach described as a foreseeable systemic failure that became part of a wider failure of governance, accountability and public trust.

The findings come in a major report by the House of Commons Defence Committee, titled Shifting heaven and earth? The Afghan data breach and resettlement schemes, published on 30 July, five years after the fall of Kabul and one year after public disclosure of the breach.

The February 2022 incident saw a member of MOD personnel send a spreadsheet outside government which appeared to contain information on around 150 applicants to the Afghan Relocations and Assistance Policy, but in fact included detailed personal information relating to more than 18,500 applications. The breach was not discovered until August 2023, when part of the dataset appeared in a Facebook group. The government then managed its response under an unprecedented superinjunction, which prevented public reporting of both the breach and the response for nearly two years.

The committee is unequivocal that the breach was avoidable. Its formal conclusion states:

“The breach was not simply an individual mistake, but a foreseeable systemic failure. It arose from the combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability. The pressures of the fall of Kabul in 2021 help to explain how these weaknesses developed; they do not excuse their continuation into 2022. The MOD handled sensitive immigration casework using tools and controls not appropriate for a life-endangering dataset at any scale.”

The report traces how the department came to be running the scheme at all. Sir Ben Wallace, who set up the policy as Defence Secretary, told the committee he had deliberately kept eligibility decisions separate from the Home Office, quoted as saying: “ARAP was for our people who had helped us and saved lives… The Home Office was always very keen to blur the two, and I did not want to blur the two.” He admitted this required the MOD essentially “to design and make immigration databases from scratch”. The Permanent Secretary at the time, David Williams, described the initial system to the committee as “essentially a combination of the ad hoc use of spreadsheets on SharePoint sites”.

Wallace also told the committee the breach could only have occurred if operating procedures had been ignored, adding that “someone definitely did not do their job”. The MOD’s written evidence stated, by contrast, that the breach took place “while officials were following agreed processes”, a discrepancy the committee characterises as a stark admission of continuing cultural failure.

Accountability and secrecy

On who was answerable, the committee found that no individual appears to have been held personally accountable. Its conclusion sets out why it regards the episode as a failure of governance:

“Describing the breach as a systemic failure does not mean that responsibility lay nowhere. Institutional accountability requires clear lines of responsibility. Where a department takes on unfamiliar responsibilities involving life-endangering data, clear senior ownership of risk, assurance and data protection becomes more important. The evidence suggests that this ownership was inadequate before the breach; the injunction then made ordinary political accountability for the response largely impossible for nearly two years.”

The report also finds that the government’s prolonged use of legal secrecy displaced normal public, parliamentary and audit scrutiny while major decisions affecting thousands of Afghans and substantial public spending were taken behind closed doors, and that the government did not maintain adequate visibility of the direct financial consequences of the breach response.

Committee chair Tan Dhesi MP said, as quoted in the press release accompanying the report: “This inquiry began with a data breach, but became about the real lives affected by delay, secrecy and flawed decision-making. The government must now explain how it will protect eligible Afghans who cannot safely, lawfully or affordably reach a third country for UK entry-clearance checks. Otherwise, the latest ‘self-move’ policy risks excluding people the UK has promised to help, including some who should have been brought here years ago.”

He added: “The broader picture is deeply troubling. The Ministry of Defence should stick to defence – it should never have been left to run immigration casework schemes. Secrecy has been too easily used as a shield against proper accountability in areas far removed from sensitive operations. The government needs to be more open to scrutiny and challenge, including where Special Forces are involved, and must account for administrative failures that have affected lives, damaged trust, and carried significant cost to the British taxpayer.”

What the committee wants

Among its recommendations, the committee calls for enforceable minimum standards and renewed answers on senior accountability:

“Government should mandate and enforce minimum standards for skills, process, tools, controls, independent assurance and testing for datasets where compromise could plausibly risk life. The MOD should also explain who held senior official responsibility for data-protection risk in ARAP before the February 2022 breach, whether any disciplinary, performance-management or other accountability processes followed, and how individual senior accountability is now assigned in comparable high-risk operations. The government should also review how ministerial accountability can be preserved where major decisions are taken under legal secrecy and cannot be scrutinised by Parliament or the public until after the responsible ministers may have left office.”

The government has two months to respond. The committee has asked it to publish a single action plan covering lessons from the breach and the resettlement response, “with each action assigned a named owner, timetable for completion, intended outcome and means of reporting progress”, and to report progress against each action every six months.

The overarching conclusion returns to the human dimension of the episode:

“But the central lesson of this episode is that a foreseeable MOD data failure became a wider failure of governance. A breach that should have been prevented was followed by a response shaped by prolonged secrecy, weak accountability, fragmented delivery and inadequate challenge. The consequences were operational, financial and constitutional, but also, first and foremost, human. High-risk, secret, rapidly scaled operations require stronger systems, clearer ownership, earlier external challenge and firmer accountability from the outset.”