Recommendation 5

Government should mandate and enforce minimum standards for skills, process, tools, controls, independent assurance and testing for datasets where compromise could plausibly risk life. The MOD should also explain who held senior official responsibility for data-protection risk in ARAP before the February 2022 breach, whether any disciplinary, performance- management or other accountability processes followed, and how individual senior accountability is now assigned in comparable high-risk operations. The government should also review how ministerial accountability can be preserved where major decisions are taken under legal secrecy and cannot be scrutinised by Parliament or the public until after the responsible ministers may have left office. (Recommendation, Paragraph 62) Part Two: The response under secrecy