Afghan Data Breach and Resettlement Schemes

We are not a public inquiry and our access to evidence has been constrained, especially in relation to government and Court material, and material at higher levels of classification. We have nonetheless been able to reach important findings in less than a year. However, the constraints imposed on us have unavoidably diminished the completeness of democratic scrutiny of an episode involving risks to life, substantial expenditure and prolonged secrecy. If government wishes to rely on select committee scrutiny in cases of this seriousness, it must provide the access needed for that scrutiny to be as complete as the circumstances require. It is for others to judge, on reading this report, if a further inquiry with more extensive powers and access to information would be valuable. (Conclusion, Paragraph 23)

In responding to this report, the government should publish a single action plan covering lessons from the breach and the resettlement response, with each action assigned a named owner, timetable for completion, intended outcome and means of reporting progress. After this initial response it should report progress against each of these actions to us every six months. (Recommendation, Paragraph 25) Part One: The data breach

The breach was not simply an individual mistake, but a foreseeable systemic failure. It arose from the combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability. The pressures of the fall of Kabul in 2021 help to explain how these weaknesses developed; they do not excuse their continuation into 2022. The MOD handled sensitive immigration casework using tools and controls not appropriate for a life- endangering dataset at any scale. Controls have improved since, but the episode shows the risk of taking on unfamiliar responsibilities without fit- for-purpose systems, assurance and clear accountability. (Conclusion, Paragraph 60) 68

Describing the breach as a systemic failure does not mean that responsibility lay nowhere. Institutional accountability requires clear lines of responsibility. Where a department takes on unfamiliar responsibilities involving life-endangering data, clear senior ownership of risk, assurance and data protection becomes more important. The evidence suggests that this ownership was inadequate before the breach; the injunction then made ordinary political accountability for the response largely impossible for nearly two years. By the time the facts could be scrutinised publicly, the ministers responsible for earlier decisions were no longer in office and the opportunity for ordinary contemporaneous ministerial accountability had passed. That combination—weak internal accountability before the breach and displaced democratic accountability after it—is central to why this episode became a wider governance failure. (Conclusion, Paragraph 61)

Government should mandate and enforce minimum standards for skills, process, tools, controls, independent assurance and testing for datasets where compromise could plausibly risk life. The MOD should also explain who held senior official responsibility for data-protection risk in ARAP before the February 2022 breach, whether any disciplinary, performance- management or other accountability processes followed, and how individual senior accountability is now assigned in comparable high-risk operations. The government should also review how ministerial accountability can be preserved where major decisions are taken under legal secrecy and cannot be scrutinised by Parliament or the public until after the responsible ministers may have left office. (Recommendation, Paragraph 62) Part Two: The response under secrecy

The Afghan data-breach injunction was an exceptional measure with profound constitutional consequences. Even aside from the “superinjunction” element, it prevented public and parliamentary knowledge of a major policy response involving risk to life, substantial public expenditure and affected communities across the UK. A short period of secrecy may have been justified to reduce immediate risk to affected Afghans, but secrecy endured far longer than originally envisaged. Over time, the injunction displaced normal democratic, audit and public scrutiny; it limited controlled external challenge; and it imposed serious costs on accountability and trust among affected Afghans and the UK public. (Conclusion, Paragraph 103)

Future governments should treat this case as exceptional, not as a precedent for normalising injunctions that suppress matters of widespread public interest. (Recommendation, Paragraph 104) 69

In any future circumstances requiring both secrecy and accountability, the government should test more seriously whether confidential briefing could be provided to a wider group of parliamentarians without significantly increasing the risk of disclosure. (Recommendation, Paragraph 105)

The government should, in response to this report, publish the lessons it has learned from the Afghan data-breach injunction and set out clear principles governing when it or any other public body may exceptionally seek an injunction preventing disclosure of a matter of widespread public interest. Those principles should include requirements for: periodic reassessment of necessity and proportionality against recorded criteria; controlled external challenge at the earliest safe stage; minimum expectations for parliamentary notification; arrangements for audit and Accounting Officer assurance; and clear ministerial accountability for applications to maintain, vary or discharge the injunction. (Recommendation, Paragraph 106)

The response to the breach exposed a serious weakness in cross- government governance. Once relocation became the principal means of mitigation, the MOD carried the strongest responsibility and incentive to act, but many of the levers needed to deliver the response— accommodation, immigration processing, local authority capacity, funding and integration support—sat elsewhere. Under conditions of secrecy, that mismatch was harder to challenge externally. The financial consequences of the breach were shaped not only by the original loss of data, but by policy choices made under the injunction about cohort size, accommodation, pace of implementation and delivery model. Decisions about risk became decisions about housing, local capacity, departmental budgets and long-term support. The result was an incremental response whose pace, scope and cost were shaped by misaligned responsibilities, cross- government constraints and limited democratic, audit or public scrutiny. (Conclusion, Paragraph 131)

The government did not maintain adequate cost visibility over the direct financial consequences of the data-breach response. The NAO found that the MOD could not identify ARR-specific costs with normal audit confidence, because those costs had not been separately recorded. The evidence also suggests that government did not consistently distinguish between the marginal cost of the breach response, the cost of the ARR, the cost of prioritised ARAP relocations and the wider cost of Afghan resettlement. Weak cost visibility, ambiguous presentation and delayed programme controls limited assurance and made it harder to test whether decisions were being taken on a realistic understanding of their financial consequences. (Conclusion, Paragraph 132) 70

Where policy must be designed or implemented in secret, the government should establish formal interdepartmental governance arrangements from the outset. That governance should include clear ownership of decisions, delivery and costs; documented ministerial decision points; scheduled reassessment of necessity, scope, delivery and proportionality; explicit cost-assurance arrangements; and mechanisms for controlled democratic and audit challenge where normal parliamentary scrutiny is displaced. (Recommendation, Paragraph 133)

The government should set out clearly where responsibility lay across departments for the major decisions taken under the injunction, including responsibility for delivery, accommodation planning, cost assurance and oversight. It should also set out what lessons it has learned from this experience about governance and delivery where one part of government owns the immediate risk but depends on others to deliver the response. (Recommendation, Paragraph 134)

The government was right to commission the Rimmer Review, and a similar reassessment of risk and proportionality should have taken place much sooner after discovery of the breach. The Review was coherent, logically constructed and a fair reflection of the evidence it received; it provided a rational basis for the government and the High Court to conclude that the injunction should no longer be maintained. However, because the Review was conducted in secret, the range of evidence that could be gathered and tested was constrained. That affected perceptions of its fairness and completeness among affected Afghans and those who advocate for them, and means the Review should not be treated as the final word on risk. (Conclusion, Paragraph 143)

The government should establish and publish a process for periodic reassessment of the risks faced by ARAP applicants, former applicants and their family members who remain in Afghanistan or third countries, where those risks arise because of their past connection with the UK or from their applications for resettlement. The process should draw on current intelligence, operational evidence, engagement with those supporting affected Afghans, and evidence from applicants where available. The government should report, at least annually, how these reassessments affect eligibility, safeguarding, relocation and self-move policy. (Recommendation, Paragraph 144)

The government approached notification of affected Afghans primarily as a communications exercise rather than as a safeguarding intervention. Although the notification reached most affected individuals, it did not provide sufficiently specific, actionable or individualised information to enable people to understand their level of risk, what data relating to them or their families had been compromised, or what practical steps 71 they could take. Nor was it supported by an adequate system of follow-up engagement, case-specific advice or assistance. Given the time available to plan for disclosure and the foreseeable reaction of people receiving notice of a potential risk-to-life data breach—many of whom were in Afghanistan or precarious third-country settings—the government should have treated notification as an immediate operational response to safeguarding need, not simply as public messaging. (Conclusion, Paragraph 161)

Where government manages disclosure after a period of operational secrecy in a case involving credible risk to life, it should treat disclosure and notification as a safeguarding intervention. Break- glass arrangements should be tested in advance and designed around the needs of affected people. They should include, as a minimum: clear and timely communications; specific information on the nature of the data compromised, as far as can safely be disclosed; tailored guidance reflecting different levels of risk and location; accessible multilingual support channels; routes for case-specific enquiries; and a coordinated cross-government plan for follow-up assistance. (Recommendation, Paragraph 162) Part Three: Longer-term consequences

We recognise and respect the sensitivity surrounding Special Forces operations. However, the “no comment” approach is inappropriate for matters of administrative decision-making, data handling and accountability for resettlement casework. Serious questions have been raised about the governance arrangements under which Special Forces personnel contributed to immigration casework and data handling affecting former Afghan partner forces. Special Forces’ involvement must not prevent Parliament and the public from understanding how administrative failings occurred, whether lessons have been learned, and whether senior accountability has been exercised. (Conclusion, Paragraph 198)

The Triples Review revealed serious administrative failings in the handling of ARAP applications from former members of Afghan specialist units who had worked closely with UK forces. The high overturn rate showed that earlier determinations that applicants were not eligible for relocation could not be treated as reliable. The government therefore has a special responsibility to former Triples whose applications were wrongly refused and who, because of those failings and subsequent delay, may have spent additional years in hiding or been left to make their own way to a third country. (Conclusion, Paragraph 199) 72

The UK’s obligations after the breach were wider than its pre-existing ARAP commitments. The government had continuing obligations to eligible Afghans to whom public commitments had been made after Op PITTING, and additional responsibilities to people placed at increased risk by the breach itself. Prioritising breach-exposed people was understandable, but it created trade-offs within an already strained resettlement system. Those trade-offs should have been more explicitly governed, documented and subjected to controlled scrutiny, particularly where different groups faced credible risk because of their work with the UK. (Conclusion, Paragraph 200)

The government should treat the remaining work for former Triples whose applications were affected by serious administrative failings as a corrective exercise, not routine casework. It should identify the affected cohort, prioritise the remaining cases, including family applications and relocation arrangements, provide clear casework updates, and report regularly to Parliament until the corrective work is complete. Reporting should include numbers outstanding, numbers relocated, average time in each stage, and the action being taken for those unable safely or affordably to self-move. (Recommendation, Paragraph 201)

Government should not allow departments to continue leading high-risk protection or resettlement casework by default where that work falls outside their core expertise. Where such responsibilities are assigned in urgent circumstances, ministers should keep the operating model under formal review and transfer responsibility if better-placed departments or agencies can deliver the work more safely, fairly and efficiently. (Recommendation, Paragraph 203)

We welcome the government’s stated ambition to clear the current ARAP caseload by spring 2027, and its decision to publish KPIs and transparency data. These are important corrective steps. But the commitment will only be meaningful if it is delivered fairly as well as quickly. The government must ensure that pressure to close the programme does not reduce the quality of decision-making, particularly in complex cases and cases involving applicants whose previous decisions were affected by administrative failings. It should continue publishing performance against the KPIs, which should include indicators reflective of the quality of decision-making, explain where KPIs are being missed, and set out what operational action is being taken to recover performance. (Recommendation, Paragraph 206)

The government has not adequately explained how it will protect eligible Afghans who cannot safely, lawfully or affordably self-move to a third country for UK entry-clearance checks. This is a serious gap in the current model. A policy that works for many applicants may still fail the most vulnerable, including those who have already waited years because of government delay or error. If the government is to honour its obligations in 73 substance, not merely in process, it must identify those for whom self-move is not realistic and set out what alternative support or exceptions will apply. If the government does not identify and support those unable to self-move, the 12-month deadline risks becoming in practice an exclusion mechanism for eligible people who are too poor, too vulnerable or too exposed to travel independently. (Conclusion, Paragraph 215)

The government should publish, by the time it responds to this report, a clear policy for eligible Afghans who cannot safely, lawfully or affordably self-move to a third country. This should include criteria for identifying these cases and should set out steps to ensure that the 12-month deadline does not exclude eligible people because they lack the means or ability to travel independently. Without such a policy, the government cannot credibly claim that it is honouring its obligations to all eligible Afghans. (Recommendation, Paragraph 216)

Afghan resettlement has brought many people to safety, but successful resettlement cannot be measured by arrival numbers alone. It should also be judged by how quickly families move from temporary to settled accommodation, whether they receive early support, whether unresolved family and casework issues are addressed, and whether employment, language, health and community integration needs are being met. (Conclusion, Paragraph 222)

For many relocated Afghans, unresolved cases involving close family members remain a significant source of anxiety and affect wellbeing and integration. Family separation and lack of timely casework updates are therefore not peripheral issues; they are part of the continuing consequences of how the schemes have been administered. (Conclusion, Paragraph 223)

The government should ensure that relocated Afghans in transitional accommodation have timely access to casework updates where unresolved applications involving close family members remain a significant source of anxiety or practical uncertainty. (Recommendation, Paragraph 224)

The government should publish the outcome measures it is developing for the Afghan Resettlement Programme and explain how they will be used to manage delivery and improve outcomes. These measures should cover, at a minimum, movement from temporary to settled accommodation, access to early support, casework resolution for close family members, English- language support, employment, health and wellbeing, and community integration. The government should also explain how the Home Office- led evaluation and programme-board management information will feed into ministerial accountability for Afghan resettlement outcomes. (Recommendation, Paragraph 225) 74 Conclusion

The obligations examined in this report arose from the UK’s long involvement in Afghanistan, the commitments made to Afghans who supported the UK mission, and the additional risks created by the data breach. The government and local partners have brought many people to safety in challenging circumstances and supported their settlement in the UK: those efforts deserve recognition. But the central lesson of this episode is that a foreseeable MOD data failure became a wider failure of governance. A breach that should have been prevented was followed by a response shaped by prolonged secrecy, weak accountability, fragmented delivery and inadequate challenge. The consequences were operational, financial and constitutional, but also, first and foremost, human. High-risk, secret, rapidly scaled operations require stronger systems, clearer ownership, earlier external challenge and firmer accountability from the outset. (Conclusion, Paragraph 226) 75