10
Conclusion
54th Report - Afghanistan Response Route
Acknowledged
In August 2023, after it discovered the data breach, the Department reported the incident to the Metropolitan Police and the Information Commissioner’s Office (ICO). The police decided that no criminal investigation was necessary. The ICO decided that it was not in a position to conduct its own investigation at that …
Read more
In August 2023, after it discovered the data breach, the Department reported the incident to the Metropolitan Police and the Information Commissioner’s Office (ICO). The police decided that no criminal investigation was necessary. The ICO decided that it was not in a position to conduct its own investigation at that time, because of the restrictions resulting from the super-injunction and the classification of much of the relevant material as Secret or Top Secret. Instead, the ICO decided to review, oversee and propose lines of investigation to the Department’s internal investigation team.20 The ICO found that, due to the urgency with which the Department was operating, there was “inherently some risk” it was having to take by sharing data externally. It also found that, at the time of the breach, the Department’s systems were not set up for this way of working, and the Department was working at pace due to its assessment that there was a clear threat to life.21
Show less
Government response AI summary
The government commissioned an independent, MOD-wide Data Protection Review in response to several high-profile and sensitive data protection incidents.
Read full response →
HM Treasury
13
Conclusion
54th Report - Afghanistan Response Route
Acknowledged
As part of its investigation into the February 2022 data breach, the Department provided to the ICO details of its data protection policies, as well as training and guidance for staff on the risks of sharing information by email, that were in place at the time of the incident. The …
Read more
As part of its investigation into the February 2022 data breach, the Department provided to the ICO details of its data protection policies, as well as training and guidance for staff on the risks of sharing information by email, that were in place at the time of the incident. The ICO found that, in its view, the Department did have policies and processes in place designed to address the risks of sharing information externally when the data breach took place, and that it had taken steps to implement improved systems and processes since then.29
Show less
Government response AI summary
The government references a letter dated 7 October 2025 which includes an update on how the recommendations in the McIvor Review have been implemented.
Read full response →
HM Treasury
23
Conclusion
54th Report - Afghanistan Response Route
Acknowledged
The Department is not able to determine exactly what it has spent on resettling people through the ARR scheme, because it did not separately identify the costs in its accounting system. The Department told us that it did this because reporting the costs separately would breach the super-injunction and because …
Read more
The Department is not able to determine exactly what it has spent on resettling people through the ARR scheme, because it did not separately identify the costs in its accounting system. The Department told us that it did this because reporting the costs separately would breach the super-injunction and because much of the activity for the secret 54 Q 35 55 Q 42 56 Q 39 57 Q 43 58 Letter from Ministry of Defence, 7 October 2025 59 Qq 40–41 15 scheme and the open ARR scheme was the same.60 Although the criteria for offering resettlement under the ARR and ARAP schemes are different, the resettlement offer was the same. It included: relocation to the UK; transitional accommodation for up to nine months; support to find a settled home; integration support; permission to stay in the UK permanently and to work; and access to education, healthcare, benefits and other public services.61
Show less
Government response AI summary
The government states that capturing costs for the ARR scheme separately would be disproportionately complex and resource intensive, and proposes an alternative approach for allocating costs.
Read full response →
HM Treasury