The data breach by the Ministry of Defence (MoD) of Afghans who worked with UK forces in Afghanistan was a foreseeable systemic failure rather than simply an individual mistake, a select committee of MPs has stated. The report, Shifting heaven and earth? The Afghan data breach and resettlement schemes, found that the Ministryโs 2022 Afghan data breach became part of a wider failure of governance, accountability and public trust.
Chair of the Defence Committee, Slough Labour MP Tan Dhesi said:ย โThis inquiry began with a data breach, but became about the real lives affected by delay, secrecy and flawed decision-making. The government must now explain how it will protect eligible Afghans who cannot safely, lawfully or affordably reach a third country for UK entry-clearance checks. Otherwise, the latest โself-moveโ policy risks excluding people the UK has promised to help, including some who should have been brought here years ago.
โThe broader picture is deeply troubling. The Ministry of Defence should stick to defence – it should never have been left to run immigration casework schemes. Secrecy has been too easily used as a shield against proper accountability in areas far removed from sensitive operations. The government needs to be more open to scrutiny and challenge, including where Special Forces are involved, and must account for administrative failures that have affected lives, damaged trust, and carried significant cost to the British taxpayer.โ
For the report, visit the UK Parliament website.
Quote
The quote ‘shift heaven and earth’ is from summer 2021 and the west’s sudden evacuation of Afghanistan, when the then Prime Minister Boris Johnson made a promise, which the MPs said ‘has haunted our inquiry’. The casework scheme the Afghan Relocations and Assistance Policy (ARAP) and its databases were designed by the MoD from scratch, separate from the Home Office casework management systems; which, the report noted, have come in for criticism. The MPs reported ‘that those responsible for the original design of ARAP case management did not sufficiently understand the data-handling risks they were creating, how to treat those risks appropriately, or the consequences of failing to manage them. That was not simply an individual failing; it reflected the danger of a department whose core business is not immigration casework deciding to build and operate a sensitive casework system at speed.’
Breach
The direct cause of the breach was an Excel file sent by the MoD to a ‘trusted third party external to government’. The file superficially contained the data of around 150 ARAP applicants; it ‘also contained detailed personal information relating to over 18,500 other applications’. The report noted that ‘the risks of using Excel spreadsheets for sensitive personal data at scale were neither novel nor obscure’; and that ‘it is relatively straightforward to ensure that there is no hidden data in an Excel file’. The MPs pointed to ‘limited continuity, insufficient training and a weak data-protection culture within the ARAP operation’.
Fine
In December 2023, the data privacy watchdog the Information Commissionerโs Office (ICO) fined the MoD ยฃ350,000 for the September 2021 incident and related data breaches.
Comment
Muhammad Yahya Patel, vCISO and Cybersecurity Advisor at the anti-phishing and anti-ransomware cyber firm Huntress, said:ย “Basic data handling training and DLP controls are not advanced security capabilities. They are foundational. DLP tools that flag or block the sharing of bulk personal data outside authorised channels, email controls that identify when sensitive spreadsheets are being sent inappropriately, and mandatory data handling training for anyone with access to sensitive personal information, none of this is expensive or technically overly complex. It just requires someone to treat data security as an operational priority rather than an IT responsibility.”
