Source · Select Committees · Defence Committee
Recommendation 3
3
The breach was not simply an individual mistake, but a foreseeable systemic failure.
Conclusion
The breach was not simply an individual mistake, but a foreseeable systemic failure. It arose from the combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability. The pressures of the fall of Kabul in 2021 help to explain how these weaknesses developed; they do not excuse their continuation into 2022. The MOD handled sensitive immigration casework using tools and controls not appropriate for a life- endangering dataset at any scale. Controls have improved since, but the episode shows the risk of taking on unfamiliar responsibilities without fit- for-purpose systems, assurance and clear accountability. (Conclusion, Paragraph 60) 68