The UK’s Ministry of Defence has committed a serious data breach that was only revealed this week after a super injunction was lifted which put the lives of thousands of Afghan citizens at risk of targeting from the Taliban for seeking refuge in the UK after the group took control of Afghanistan once US troops withdrew from the nation in 2021.

The data breach took place in February 2022, leaking the details of nearly 19,000 people who had applied to relocate to the UK after the Taliban took control of Afghanistan. A British official was responsible for the leak – it is unclear if this person was reprimanded, but they have since been removed from their previous job.

Around 18,000 Afghans applying for asylum had their data leaked, including those that fought and aided the UK and US’s military efforts in the region, directly in opposition to the current Afghani government. These people applied for asylum under the Afghan Relocations and Assistance Policy (Arap) and the Afghanistan Locally Employed Staff Ex-Gratia Scheme (EGS), under the basis that they had worked for the UK during its occupation of the country.

The previous government reportedly first learned of the leak in August 2023, when the MOD discovered that part of this dataset was published on Facebook.

Since then, the Conservative government created a resettlement scheme for those affected by the breach, as they believed them to be at risk of reprisal from the Taliban.

This Afghanistan Response Route lead to 4,500 Afghans arrive in the UK so far, costing £400m, with a projected total cost of £850m. In total, 6,900 people are predicted to enter the UK under the scheme, which has since been closed by the current Labour government.

The existence of this scheme, as well as the breach itself, was hidden in a super injunction issued by the High Court on request of the previous Conservative government, banning any reporting on the story.

In an address, Secretary of Defence John Healey MP said he was briefed on the relocation programme in 2023 when he served as shadow defence secretary, and was also served the super injunction, but that other members of the current Labour cabinet were only made aware of the data breach and the relocation programme upon taking office after the General Election.

Recommended reading

• OpenAI & Microsoft Disrupt State-backed Hackers
• Who Was Behind the Ministry of Defence Hack?
• Warning Issued Over North Korean Threat Actors Posing as IT Workers

“I have felt deeply concerned about the lack of transparency to parliament and the public.”

The lifting of the super injuction comes after an independent review from Paul Rimmer, a former civil servant. The review of the policy found that the dataset falling into the hands of the Taliban would be less problematic than previously thought.

The internal review decided that the Taliban “likely already possesses the key information in the dataset,” and that if they Taliban did get its hands on the data it would be “unlikely to substantially change an individual’s existing exposure.”

This lead to the end of the injunction as decided by the Labour government, as well as the discontinuation of the Afghanistan Response Route. About 600 principals and their families who remain in Afghanistan and were affected by the breach will be able to take up offers made by the ARR, however.

A stop to the scheme, however, means that another 9,500 people would not be able to come into the UK who otherwise would have under the previous government’s scheme.

The mistake – a data breach caused by human error – brings into question government data security and transparency, all while shedding a light on one of the West’s collective failures of intervention and subsequent abandonment of a Middle East quagmire.

The UK government had already failed in basic cyber hygiene in a leak of Afghani details when a civil servant failed to use a blind carbon copy of email addresses of asylum applications of Afghani interpreters who were key allies to the UK. The UK government offered affected individuals £4,000 each in compensation.

The current revelation has sparked concern from current members of Parliament who are dismayed at the lack of transparancy within the UK government, as well as apologies from former Conservative cabinet members.

Healey said he was “unable to say for sure” if anyone was killed as a result of the data breach, but also told the BBC it was “highly unlikely” the breach would increase risks for people being targeted by the Taliban. It seems the Labour government is comfortable with these odds for the remaining people in Afghanistan who risked their lives for the UK’s military operations, and are now under the rule of their previous adversaries.

The UK government has been critiqued for its moves since the withdrawal of US troops from Afghanistan enabled the Taliban to seize control of the region. The UK set up schemes enabling UK-aligned Afghans who had aid the UK military to apply for asylum, leading to around 36,000 Afghans move to the UK.

The UK Foreign Affairs Committee called the UK evacuation from the region as “disaster and betrayal of our allies that will damage the UK’s interests for years to come.”