Recommendation 10

The response to the breach exposed a serious weakness in cross- government governance. Once relocation became the principal means of mitigation, the MOD carried the strongest responsibility and incentive to act, but many of the levers needed to deliver the response— accommodation, immigration processing, local authority capacity, funding and integration support—sat elsewhere. Under conditions of secrecy, that mismatch was harder to challenge externally. The financial consequences of the breach were shaped not only by the original loss of data, but by policy choices made under the injunction about cohort size, accommodation, pace of implementation and delivery model. Decisions about risk became decisions about housing, local capacity, departmental budgets and long-term support. The result was an incremental response whose pace, scope and cost were shaped by misaligned responsibilities, cross- government constraints and limited democratic, audit or public scrutiny. (Conclusion, Paragraph 131)