Recommendation 30

The obligations examined in this report arose from the UK’s long involvement in Afghanistan, the commitments made to Afghans who supported the UK mission, and the additional risks created by the data breach. The government and local partners have brought many people to safety in challenging circumstances and supported their settlement in the UK: those efforts deserve recognition. But the central lesson of this episode is that a foreseeable MOD data failure became a wider failure of governance. A breach that should have been prevented was followed by a response shaped by prolonged secrecy, weak accountability, fragmented delivery and inadequate challenge. The consequences were operational, financial and constitutional, but also, first and foremost, human. High-risk, secret, rapidly scaled operations require stronger systems, clearer ownership, earlier external challenge and firmer accountability from the outset. (Conclusion, Paragraph 226) 75