The British government on Tuesday (July 15) admitted to an accidental data leak of the identities of up to 100,000 Afghan nationals in 2022, which incited the risk of Taliban reprisal, and spurred a government program to provide asylum for thousands of the affected.
News of the data breach came to light when British Defence Secretary, John Healey, informed the parliament that the gag order banning the discussion had been lifted, and that the Afghanistan Response Route had been closed.
Prime Minister Keir Starmer, whose government took office last July, said, “This should never have happened. We owe a duty of care to those who helped British forces, and this breach has put lives at risk. Our priority now is to bring them to safety and ensure full accountability.”
Here is what to know.
Story continues below this ad
What was the 2022 data breach?
The February 2022 leak was an error by a British military official tasked with verifying applications for the Afghanistan Resettlement and Assistance Policy (ARAP), which relocated Afghan nationals who worked “for or with the UK Government in Afghanistan in exposed or meaningful roles”. Some of these persons had served alongside British troops and risked their lives in the Afghanistan war before the western forces exited the nation in 2021, and the subsequent takeover by the Taliban.
The timing of the data leak came ten months after former Defence Secretary Ben Wallace had launched the ARAP, and six months after the Taliban’s takeover of Afghanistan.
The offender was identified by British newspaper The Times as a soldier under the command of General Gwyn Jenkins, then director of special forces and the current navy chief.
In his statement to the Parliament, Healey said that the official had emailed an ARAP case file outside authorised government systems to some Afghan nationals in the UK to verify the identities of the applicants. The dataset circulated among their compatriots in the UK, and contained the personal information, including phone numbers and addresses of 18,714 Afghan ARAP applicants, amounting to 33,000 lines of data. The Times also noted that the emails of some British government officials were also disclosed.
Story continues below this ad
Healey said that the official had erroneously assumed that they had sent the names of 150 applicants, and added that the incident was one of the many data losses under the scheme during this period.
How was the leak uncovered?
According to Healey, the data loss became known to previous government ministers over a year later in August 2023 when the personal details of nine persons appeared online. The Times, which had been investigating the breach since then, added that one of the recipients of the dataset threatened to publish it on Facebook, spurring the government’s fears of a Taliban “kill list”. The Defence Ministry then noted that as many as 100,000 Afghans faced the “risk of death, torture, intimidation or harassment”, which government lawyers characterised as the stuff of “nightmares”.
In September 2023, the Conservative government under then-PM Rishi Sunak launched Operation Rubific to contain the leak and secretly evacuate those individuals on the list considered to be the most at risk of Taliban assassination. By then, the UK government had also contacted 1,800 applicants in Pakistan to warn them of the danger.
A three-month superinjunction “against the world” was granted by Justice Robin Knowles of the High Court of England and Wales in September 2023 at the government’s request. This was extended last February, with the justification being the “real possibility that it is serving to protect” those named in the leaked database. The superinjunction was effectively a gag order, unprecedented in scope and scale, yet the longest ever, preventing anyone from revealing that such an order existed.
Story continues below this ad
It was extended later once again, despite court challenges by four media organisations, including The Times.
What happened next?
In December 2023, the government introduced the Afghanistan Response Route (ARR), a secret new scheme to help evacuate to the UK some of the affected persons deemed ineligible under ARAP. While the scheme was originally set up to relocate 200 “principals” and their families, 900 individuals and 3,600 family members have been brought to Britain or are in transit via ARR, at a cost of £400 million, The Guardian reported.
The Guardian report also noted that official figures showed that the government had resettled 35,245 Afghans to Britain, including 16,156 who were among those affected by the data leak.
Healey had been briefed on the leak while in opposition, and told the Parliament that upon entering office, he had begun “straightway to take a hard look at the policy complexities, costs, risks, court hearings and the range of Afghan relocation schemes being run across government”. He added that other members of the cabinet became aware of the situation only after Labour entered government last July.
Story continues below this ad
This January, he commissioned an independent review of the scheme by former civil servant Paul Rimmer. The review established that the ARR scheme may have been a “disproportionate” response “to the actual impact of the data loss” and may have potentially increased the value of the dataset to the Taliban.
On Tuesday, the government asked the high court to discontinue the superinjunction. Healey also announced in parliament that the ARR was now closed for new applications, and would honour 600 “invitations” already granted. The Times reported that 5,400 more Afghan nationals would be flown to the UK over the coming weeks, bringing the total number of affected persons since resettled to 23,900.
How much have the schemes cost the British government?
The Times reported that Chancellor of the Exchequer, Angela Reeves, had allocated upto £7 billion over five years on bringing 25,000 of those affected to the UK, in a secret plan that had originally begun under the previous Conservative government.
According to the Defence Ministry, the cost of the breach was £850 million to relocate 6,900 of the affected over an unspecified duration, while the rest were found ineligible under the ARAP scheme. The Times also reported that the three Afghan schemes taken together would cost taxpayers £6 billion, of which £2.7 billion has already been spent.
Story continues below this ad
The government is now preparing to tackle legal claims, and has mooted a compensation scheme which is expected to cost between £120 million and £350 million, excluding administrative costs.