n data breach that exposed the personal details of thousands of Afghans attempting to flee Taliban rule “was not simply an individual mistake but a foreseeable systemic failure”, watchdog MPs have found.
In July last year, it was revealed that in 2022, a Ministry of Defence official accidentally shared the data of more than 18,000 Afghans seeking relocation to the UK. The breach led to the then-Conservative government creating a secret resettlement route for those affected and an estimated 7,355 people being offered resettlement in the UK.
Following the revelation, which had been kept under wraps for two years through a super-injunction, the Defence Committee launched an inquiry, seeking to understand how the breach happened and whether successive governments took well-informed and sensible decisions.
The committee’s now-published report says the “central lesson of this episode is that a foreseeable MoD data failure became a wider failure of governance”.
“A breach that should have been prevented was followed by a response shaped by prolonged secrecy, weak accountability, fragmented delivery and inadequate challenge,” it said.
“The consequences were operational, financial and constitutional but also, first and foremost, human.”
The report advises that “high-risk, secret, rapidly scaled operations require stronger systems, clearer ownership, earlier external challenge and firmer accountability from the outset”.
It says the breach arose from a “combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity and an inadequate culture of data protection and accountability”. The report says the pressures of the fall of Kabul in 2021 help to explain how these weaknesses developed but “do not excuse their continuation into 2022”.
The MoD “handled sensitive immigration casework using tools and controls not appropriate for a life-endangering dataset at any scale”, the report says. “Controls have improved since but the episode shows the risk of taking on unfamiliar responsibilities without fit-for-purpose systems, assurance and clear accountability.”
The committee also found there was “weak internal accountability” before the breach and “displaced democratic accountability” after it, and that this combination was “central to why this episode became a wider governance failure”.
The MPs also found that the response to the breach "exposed a serious weakness in cross-government governance".
"Once relocation became the principal means of mitigation, the MoD carried the strongest responsibility and incentive to act, but many of the levers needed to deliver the response – accommodation, immigration processing, local authority capacity, funding and integration support – sat elsewhere," the report says. "Under conditions of secrecy, that mismatch was harder to challenge externally."
In response to this failure, the report recommends that government "should not allow departments to continue leading high-risk protection or resettlement casework by default where that work falls outside their core expertise". It says where such responsibilities are assigned in urgent circumstances, ministers should keep the operating model under formal review and transfer responsibility if better-placed departments or agencies can deliver the work more safely, fairly and efficiently.
Tan Dhesi, chair of the Defence Committee, said: “The Ministry of Defence should stick to defence – it should never have been left to run immigration casework schemes. Secrecy has been too easily used as a shield against proper accountability in areas far removed from sensitive operations."
An MoD spokesperson said the department is "learning the lessons from this incident and important reforms are already in place, including improved data protection standards, strengthened caseworking processes and better programme governance".
The spokesperson said the incident "should never have happened" and that the department acknowledges "the significant impact it has had on many people".
“Thousands of eligible Afghans have already been safely relocated to the UK, where they can rebuild their lives, and we are committed to ensuring that we conclude the Afghan Resettlement Programme by the end of this Parliament," they added.
“We welcome the public and parliamentary scrutiny of our actions, so we can learn more and be held to account, and we’ll continue to work closely with the committee on this issue.”