Oral Statement by Defence Secretary on Afghan data breach

Statement on a significant data protection breach from February 2022, relating to the Afghan Relocations and Assistance Policy. 

"With permission, Mr Speaker, I wish to make a statement on a significant data protection breach from February 2022, relating to the Afghan Relocations and Assistance Policy.  This led to the High Court granting an unprecedented superinjunction. And the previous government establishing a secret Afghan resettlement route. 

Today, I am announcing to the House a change in government policy. I am closing this resettlement route; I'm disclosing the data loss and confirm that the Court Order was lifted at 12 noon today. Members of the House, including you Mr Speaker, have been subject to this superinjunction. It is unprecedented.  

And to be clear, the Court has always recognised the parliamentary privilege of proceedings in this House and Ministers decided not to tell Parliamentarians at an earlier stage about the data incident, as the widespread publicity would increase the risk of the Taleban obtaining the dataset. 

But, as Parliamentarians – and as Government Ministers – it has been deeply uncomfortable to be constrained in reporting to this House. 

And I am grateful today to be able to disclose the details to Parliament. 

And I trust you, Mr Speaker – and Members – will bear with me, if I take the time to ensure the House now has the fullest information possible, something I discussed with you Mr Speaker, yesterday.   

Mr Speaker, the facts are as follows… 

In February 2022… ten months after the Defence Secretary, Ben Wallace, introduced the Afghan Relocations and Assistance Policy and six months after the fall of Kabul a Defence official emailed an ARAP caseworking file outside of authorised government systems. 

ARAP as the House knows is the resettlement scheme that this country established for Afghan citizens who worked for or with UK Armed Forces over the combat years of Afghanistan. 

Both in Opposition – and in Government – we have backed this scheme and I know ARAP has had full support from across this House.  

Now this official mistakenly believed they were sending the names of 150 applicants. 

However, the spreadsheet in fact contained personal information associated to 18 714 Afghan who had applied to either the Ex Gratia or ARAP scheme on or before 7 January 2022. 

It contained names and contact details of applicants – and some instances, information relating to the applicants' family members.  

In a small number of cases Mr Speaker, the names of Members of Parliament, senior military officers and government officials were noted as supporting the application. 

This was a serious departmental error. 

It was in clear breach of strict data protection protocols. 

And it was one of many data losses relating to the ARAP scheme during this period.  

Previous Government Ministers first became aware of the data loss in mid-August 2023 – 18 months after the incident. They became aware of the loss when personal details of nine individuals from the dataset appeared online. 

Action was taken to ensure they were swiftly removed, an internal investigation was conducted and the incident was reported to both the Metropolitan Police and the Information Commissioner. 

The Met deemed that no criminal investigation was necessary. 

And the Information Commissioner has continued to work with the department throughout. 

However, journalists were almost immediately aware of the breach and the previous administration applied to the High Court for an injunction to prevent the data loss becoming public. 

The Judge deemed the risk warranted going further and on 1 September 2023, granted a superinjunction, which prevented disclosure of the very existence of the injunction. 

Mr Speaker, that superinjunction has been in place for nearly two years, during which time 8 media organisations and their journalists have been served to prohibit any reporting. 

And no government wishes to withhold information from the British public, from parliamentarians or the press in this manner. 

In Autumn 2023, previous Ministers started work on establishing a new settlement scheme specifically designed for people in the compromised dataset who were not eligible for ARAP, not eligible for ARAP but judged to be at the highest risk of reprisals by the Taleban. 

It is known as the Afghanistan Response Route (ARR). It was covered by the superinjunction. 

The then-Government initially established the ARR to resettle a target cohort of around 200 principals but in early 2024, a combination of the Minister's decisions on the scheme's policy design and the court's views had broadened this category to nearly 3,000 principals. 

I want to provide assurance Mr Speaker – both to the House and the British public – that all individuals relocated under the Afghanistan Response Route, ARAP or the Home Office's ACRS undergo strict national security checks before being able to enter our country. 

And the full number of Afghan arrivals under all schemes have been reported in the regular Home Office statistics, meaning they are already counted in existing migration figures. 

As Shadow Defence Secretary, I was initially briefed on the ARR by James Heappey – former Armed Forces Minister – on 12 December 2023; and issued with the super injunction at the start of the meeting.  

Other Members of the present Cabinet were only informed of the evidence of the data breach, the operation of the ARR, and the existence of the super injunction on taking office after the General Election. 

By this time, the ARR scheme was fully established and in operation. By this time it was nearly two and a half years since the data loss.  

I have felt deeply concerned about the lack of transparency to parliament and the public.  

I felt it only right to reassess the decision-making criteria for the ARR. 

So, we began straightway to take a hard look at the policy complexities, costs, risks, court hearings and the range of Afghan relocation schemes being run across government. 

Cabinet colleagues endorsed the need for new insights in the scheme in the Autumn last year while the scheme kept running. 

In December 2024, I announced a streamlining of the range of government schemes we inherited into the Afghan Resettlement Programme, to better establish  

value for money, establish a single set of time-limited entitlements and support to get families resettled. 

And I would on behalf of the House, Mr Speaker, like to thank our colleagues in local government, without whom this unified resettlement programme would simply not have been possible. 

And at the beginning of this year, I commissioned Paul Rimmer – a former senior civil servant and ex-Deputy Director of Chief of Defence Intelligence – to conduct an independent review.  

This Review was concluded and reported to Ministers last month. 

Today, I am releasing a public version of the Rimmer Review and I am placing a copy of the report in the Library of the House. 

I am very grateful to him for his work.  

Mr Speaker, despite brutal human rights abuses in Afghanistan, the Rimmer Review notes the passage of time – nearly four years after the fall of Kabul – and concludes… 

First and I quote.. there is little evidence of intent by the Taleban to conduct a campaign of retribution against former officials… 

Second…those who pose a challenge to the Taleban rule now are at greater risk of a reaction from the regime… 

Three… and the wealth of data inherited from the former Government by the Taleban would already enable them to target individuals if they wish to do so which means fourthly he concludes, and I quote it is “highly unlikely” that merely being on the spreadsheet would be the piece of information enabling or prompting the Taleban to act. 

However, Rimmer is clear – he stresses the uncertainty in any judgments… and he does not rule out any risk. Yet he concludes given this updated context, the current policy we inherited appears an “extremely significant intervention” to address the potentially limited net additional risk the incident likely presents. 

Mr Speaker, the Rimmer Review is a very significant, but not the sole element in the Government's decision to change policy, to change policy to close the ARR and to ensure that the Court Order is lifted today. 

Policy concerns about proportionality, about public accountability, about cost and about fairness were also important factors to the Government. 

And this was not a decision taken lightly.  

It follows a lengthy process, including the Rimmer review, detailed ministerial discussions, and repeated consultations with legal advisors.  

And just as I have changed government policy in light of the Rimmer Review, so the High Court today in light of the Rimmer Review ruled that there is no tenable basis for the continuation of the superinjunction. 

Mr Speaker, to date, around 900 ARR principals are in Britain or in transit, with 3 600 family members at the cost of £400 million. 

From today, there will be no new ARR offers of relocation to Britain.  

From today the route is now closed. 

However, we will honour the 600 invitations already made to any named person still in Afghanistan and their immediate family.  

When this nation makes a promise, we should keep it. 

Today, Mr Speaker, I am also restoring full accountability for the government's Afghanistan relocations schemes to Parliament. 

And I would expect select committees to hold us to account now, through in-depth inquiries. 

Let me turn now if I may, to the practical action we have taken, as a result of this policy change and in preparation for the Court's lifting of the superinjunction today. 

Mr Speaker, my first concern has been to notify as many as possible affected by the data incident, and provide them with further advice. 

The MOD has done this this morning, although I have to say to this House it has not been possible to contact every individual on the dataset due to its incomplete and out-of-date information. 

Anyone who may be concerned can head to our new dedicated gov.uk website wherein they will find: 

… more information about the data loss incident… 

… further security guidance… 

… a self-checker tool which will inform them whether their application has been affected … 

… and contact steps for the dedicated Information Services Centre, which the MOD has established. 

Mr Speaker, this serious data incident should never have happened. 

It may have occurred 3 years ago under the previous government… 

But to all those whose information was compromised, I offer a sincere apology today on behalf of the British government. 

And I trust the Shadow Defence Secretary – as a former Defence Minister – will join me in this.   

Mr Speaker, to date, 36 000 Afghans have been accepted by Britain through the range of relocation schemes. 

Britain has honoured the duty we owe to those who worked and fought alongside our troops in Afghanistan.  

The British people have welcomed them to our country, and in turn this is their chance to rebuild their lives the chance to contribute to – and share in – the prosperity of our great country.  

However, none of these relocation schemes can carry on in perpetuity, nor were they conceived to do so. 

That's why, on 1 July, we announced that we would no longer accept new applicants to ARAP. 

However, I will reiterate the commitment we made then to process every outstanding ARAP application and relocate those who may prove eligible.  

And we will complete our commitment to the continuing the review of the Triples. 

Mr Speaker, I recognise my statement will prompt many questions.  

I would have wanted to settle these matters sooner – because full accountability to Parliament and freedom of the press matter deeply to me… 

They are fundamental to our British way of life. 

However, lives may have been at stake… 

And I've spent many hours thinking about this decision – thinking about the safety of and the lives of people I will never meet – in a far off land in which 457 of our servicemen and women lost their lives. 

So this weighs heavily on me – and it's why no government could take such decisions lightly, without sound grounds and hard deliberation. 

During this last year, we have conducted and have now completed this work. 

And I commend this statement to this House."