A confidential program established following a significant data breach has facilitated the relocation of thousands of Afghans to the United Kingdom, it has been revealed.
The breach, which occurred in February 2022, involved the personal data of nearly 19,000 individuals who had applied for resettlement in the UK after the Taliban’s resurgence in Afghanistan.
The previous government became aware of the incident in August 2023, after portions of the data surfaced on Facebook.
In response, a new resettlement scheme was initiated nine months later for those affected by the leak, leading to the arrival of approximately 4,500 Afghans in the UK.
The existence of both the data breach and the subsequent relocations were kept under wraps through a super-injunction obtained by the government.
Details of the major security lapse, the government’s reaction, and the number of Afghans granted residency in the UK only emerged on Tuesday, following a High Court judge’s ruling to lift the gagging order.
The leaked data included names, contact details, and certain family information of individuals potentially vulnerable to the Taliban.
The government further disclosed on Tuesday:
Addressing the House of Commons, Defence Secretary John Healey offered a “sincere apology” to those whose information was compromised, noting that the breach came to light when some of the details were found on Facebook.
He attributed the incident to a spreadsheet being emailed “outside of authorised government systems,” describing it as a “serious departmental error.” However, the Metropolitan Police deemed a formal investigation unnecessary.
Healey stated that the leak was “one of many data losses” connected to the Afghanistan evacuation during that period and included the names of senior military officials, government officials, and Members of Parliament.
The Ministry of Defence has not disclosed whether any individuals were arrested or killed as a result of the data breach, but Healey informed MPs that an independent review found it “highly unlikely” that anyone would have been targeted solely because of it.
He added that the review also concluded that the secret scheme was an “extremely significant intervention” considering the “potentially limited” risk posed by the leak.
In his High Court judgement issued on Tuesday, Mr Justice Chamberlain stated it was “quite possible” that some who viewed the Facebook post containing the leaked personal data “were Taliban infiltrators or spoke about it to Taliban-aligned individuals.”
An email has been dispatched to those affected by the breach, urging them to “exercise caution” and adopt measures such as protecting their online activities and avoiding communication from unknown contacts.
Healey confirmed that individuals relocated to the UK under the scheme have already been accounted for in immigration statistics.
Tuesday’s disclosure stems from the withdrawal of U.S. troops from Afghanistan in August 2021, which led to the Taliban’s regaining power and quickly surrounding Kabul.
The leak involved the names of applicants to the Afghan Relocations and Assistance Policy (Arap) scheme, established by the UK government to expedite the processing of applications from those fearing Taliban reprisals and facilitate their relocation to the UK.
The evacuation, which saw 36,000 Afghans relocated to the UK, has faced considerable criticism since its inception. A 2022 inquiry by the Foreign Affairs Committee described it as a “disaster” and a “betrayal.”
When the government established the new relocation scheme last year in response to the leak, members of the press promptly became aware of the plans.
The government subsequently sought and obtained a court injunction preventing media outlets from reporting any details of the leak or even the existence of the injunction itself. Healey stated that he was unaware of any other similar injunctions in place.
He informed the House that he had also been prevented from discussing the breach due to the “unprecedented” injunction, even while serving as shadow defence secretary.
Reading a summary of his judgement in court, Mr Justice Chamberlain said the gagging order had “given rise to serious free speech concerns”.
He continued: “The super-injunction had the effect of completely shutting down the ordinary mechanisms of accountability which operate in a democracy.
“This led to what I describe as a ‘scrutiny vacuum’.”
Court documents disclosed on Tuesday revealed then-Defence Secretary Ben Wallace “personally” applied for the stringent injunction in order to give the government time to do “everything it reasonably can to help those who might have been put at further risk by the data compromise”.
The injunction was extended in November 2023 on the basis the Taliban may not have been aware of the leaked data’s existence.
However, Mr Justice Chamberlain decided to lift it on the ground the MoD’s internal review found the Taliban “likely already possess the key information in the dataset” and confirmation of its existence is “unlikely” to “substantially” raise the risk” faced by those impacted.
Shadow defence secretary James Cartlidge, who was in government when the secret scheme was established, said “this data leak should never have happened and was an unacceptable breach of all relevant data protocols”.
Erin Alcock, a lawyer for the firm Leigh Day, which has assisted hundreds of Arap applicants and family members, called the breach a “catastrophic failure”.
Earlier this month, the government confirmed it had offered payouts to Afghans whose information had been compromised in a separate data breach.