A Ministry of Defence (MOD) data breach that exposed the personal information of more than 18,500 Afghans was a "foreseeable systemic failure" caused by weak data protection practices, poor governance and inadequate accountability, MPs have concluded.
A report published by the Defence Committee says the 2022 breach was not simply the result of human error but reflected a combination of "inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability".
The report, Shifting heaven and earth? The Afghan data breach and resettlement schemes, examines the incident in which an MOD staff member mistakenly emailed a spreadsheet containing detailed personal information relating to more than 18,500 Afghan Relocations and Assistance Policy (ARAP) applications to a trusted third party.
The spreadsheet was intended to contain information on around 150 applicants, but instead included a much larger dataset. Once the file left government systems, the MOD no longer had control over who could access or distribute it.
The breach remained undetected for around 18 months before part of the dataset appeared in a Facebook group in August 2023.
Given concerns that the Taliban could target individuals identified in the leaked data who remained in Afghanistan, the Government treated the breach as potentially life-threatening and obtained an injunction to prevent its disclosure while it assessed the risks and considered protective measures.
However, the committee said the Government's response developed into "a wider failure of governance", arguing that prolonged legal secrecy prevented normal public, parliamentary and audit scrutiny while major decisions affecting thousands of Afghans and significant public expenditure were made behind closed doors.
The report concludes that while the pressures following the fall of Kabul in 2021 help explain how weaknesses emerged, they "do not excuse their continuation into 2022".
It says the MOD handled highly sensitive immigration casework using systems and controls that were not appropriate for a dataset where disclosure could endanger lives.
While data handling controls have since improved, the committee says the incident demonstrates the risks of departments taking on unfamiliar responsibilities without fit-for-purpose systems, adequate assurance arrangements and clear accountability.
Committee chair Tan Dhesi MP said: "This inquiry began with a data breach, but became about the real lives affected by delay, secrecy and flawed decision-making.
“The Ministry of Defence should stick to defence - it should never have been left to run immigration casework schemes. Secrecy has been too easily used as a shield against proper accountability in areas far removed from sensitive operations."
