Inside the £7bn secret scramble to save lives after MoD data breach

Independent

7 hours ago

In February 2022, sitting in an office not far from the Ministry of Defence 's Whitehall HQ, a member of the armed forces pressed 'send' on two emails. Two emails that would spark one of the most extraordinary secret government operations in modern history over fears that 100,000 lives were in danger.
They would lead to an unprecedented gagging order on the British press through a superinjunction; claims that parliament was being misled; and the largest covert evacuation in UK peacetime, projected to cost the taxpayer billions.
In the wake of the fall of Kabul to the Taliban in August 2021, tens of thousands of Afghans at risk of reprisals for fighting alongside British troops had asked the UK to bring them and their families to safety.
Six months on, an 80-strong MoD team was working through the difficult task of assessing these applications, deciding if they should be approved or denied on the strength of each applicant's ties to UK forces.
The British serviceman, in his office in Whitehall, thought his Afghan contacts might be able to help establish who was eligible for help and who was not. He decided to email the database, which he believed contained 150 names, to trusted sources.
But the document in fact contained 33,000 records, and the details of more than 18,000 Afghan applicants and their loved ones. He pressed send twice, apparently unaware of the extent of the data he was sending because of hidden rows within the spreadsheet.
Only today, after a nearly two-year legal battle involving the country's most prominent judges and media organisations – including The Independent – can the astonishing story of what happened next finally be told.
Scramble
It was on 14 August 2023, 16 months after the spreadsheet was shared, that the crisis began for the government.
On that day, an anonymous member of a Facebook group, set up for people applying to resettlement schemes created by the UK government, wrote a post in which they claimed to be in possession of a database containing 33,000 records.
'What do you think?' the person posted, asking the 1,300 members whether they should share the details.
They were challenged to prove that they had access to the information. When they replied with a screenshot of the database, as well as the contact details of a person who had applied to relocate to the UK, another member raised the alarm.
The scramble began.
The incident was instantly reported to the joint MoD and Foreign Office relocations team in Islamabad, the Pakistani capital, where hundreds of Afghan families were being housed in hotels by the UK government while waiting to be moved to Britain.
There, the team sent a WhatsApp message to around 1,800 people, warning that their contact information may have been compromised by a data incident.
The secretary of state for defence at the time, Ben Wallace, was informed of the breach 'within minutes', along with MI6, the CIA and the Foreign Office, according to an independent caseworker who was supporting Afghans with sanctuary applications.
The next day, the same caseworker emailed the armed forces minister James Heappey, and shadow minister Luke Pollard, describing the situation as 'simply bone-chilling'.
'The Taliban may well now have a 33,000-long kill list – essentially provided to them by the UK government. If any of these families are murdered, the government will be liable,' they wrote.
Minutes after that email was sent at 9.57am, the breach was reported to the resettlement team in London, with an urgent meeting scheduled to take place at 3pm. By just after 8pm, the senior MoD leadership team had been informed.
A crisis team called Gold Group was set up the following day, with the response to be dubbed Operation Rubific. With the scale of the leak becoming apparent, the MoD also informed the Information Commissioner's Office (the UK's data protection watchdog), the deputy national security adviser, and the Metropolitan Police. The MoD has not confirmed whether the serviceman faced any disciplinary action for the accidental leak or if he is still employed by the government.
Unprecedented superinjunction
The breach itself included names of those who had applied under the resettlement schemes, as well as dates of birth, email addresses and phone numbers.
The majority of the applicants were based in Afghanistan and had already been deemed ineligible for the UK's resettlement schemes. But more than 2,000 people eligible for relocation were also on the list.
By mid-August, two media outlets – the Daily Mail and Global Media – knew about the story.
Keen to ensure that the information spread no further while it took steps to protect those named in the leak, the MoD sought a four-month injunction in court. The MoD's acting Gold commander, Nina Cope, claimed there was an 'escalating possibility' that the information could be published widely and that it might reach the Taliban.
Government lawyers deemed it 'very unlikely' that the MoD would ask for a further extension of the injunction. But, at a hearing on 1 September 2023, a High Court judge, Mr Justice Knowles, went a step further and offered an unprecedented contra mundum superinjunction.
The strict legal order meant that no one would be able to share a sliver of information about the subject of the injunction – or, remarkably, even speak about the injunction itself. But signs were still emerging that knowledge of the leak had not been contained.
The MoD became aware of rumours of a list, and would later assess that some 'Taliban-aligned individuals' might be aware of a dataset. A person had also obtained some of the data and tried to blackmail the government over the breach.
Some Arap applicants had also contacted the MoD saying they believed their data had been compromised, while campaigners in regular contact with the MoD were also highlighting cases of intimidation, unusual calls, and instances of Taliban members turning up at people's homes.
A not-so-secret evacuation
Having been given unprecedented power to gag the press and operate in secret by the courts, the MoD had to find a way to keep the Afghans who had been identified safe.
In the early stages, the MoD considered telling more of those affected about the leak so they could take steps to protect themselves. It would inevitably decide against this, taking the view that it might make it more likely that the Taliban would find out about the breach.
Instead, MoD caseworkers were instructed to speed up decision-making in respect of Afghans implicated in the leak, and to bring them to safety – a move that has ultimately delayed the provision of help to other eligible Afghans desperate to flee their country.
In October 2023, the MoD told the court that this work was happening 'at pace', but that it expected relocations to take until at least the end of February. Officials still had no idea how many people they would need to help.
The following month, ministers decided to relocate a 'targeted cohort' of just 150 high-risk individuals and their family members to the UK. It was this move that sparked The Independent 's involvement in the case – I was placed under injunction as I investigated why some applicants were suddenly being granted relocation.
While the High Court judge now in charge of the case, Mr Justice Chamberlain, had initially sought to give the MoD time to act, he was growing impatient with the lack of evidence from the government to back up its assertions, and there were fears among ministers that he could lift the injunction entirely if more people were not helped.
At a later hearing in February 2025, the judge explained his thinking: 'You can put up with uncertainty for a while... but you start to wonder – do you have anything more to back this up?'
The government settled on a plan to bring the Afghans to the UK in large numbers, but it was still facing a major problem – how do you evacuate thousands of people from Afghanistan to the UK without anyone noticing?
Civil servants came up with a plan to 'provide cover' for the number of people arriving.
A brief was prepared by defence secretary John Healey for a meeting of the economic affairs committee – involving chancellor Rachel Reeves, deputy PM Angela Rayner, and home secretary Yvette Cooper – in October 2024, which outlined how the government intended to cover up what was happening.
Mr Healey proposed a new Afghan resettlement scheme, merging the two existing schemes to create the Afghan Resettlement Programme (ARP). It would aim to evacuate around 36,000 people, 28,500 of whom had been affected by the data leak, at a cost of up to £7.23bn. By its own admission, the government's secret scheme came at a time when the UK asylum system was 'under significant strain'.
By June this year, the number of people it aimed to resettle had increased to 42,572.
According to the plan, families would spend up to nine months in accommodation including hotels and military homes, with settled housing such as council properties provided after that.
Half of arrivals would be found somewhere to live, while 40 per cent would privately rent, the MoD estimated. But around 10 per cent could end up homeless.
A compensation scheme for those left behind in Afghanistan was also planned. Mr Justice Chamberlain highlighted the huge magnitude of spending on a supposedly secret plan, asking the court: 'Am I going bonkers?' He added: 'It is not actually possible to disappear it down the back of a sofa.'
In order to deliver the plan successfully, Mr Healey advised that the government needed to 'engage meaningfully' with local authorities and devolved governments about the scale and timing of the plan. Crucially, however, MPs, local councils and the public would not be told the true reason behind the surge in numbers of Afghans arriving in the UK.
The government needed to 'maintain control of the narrative', the brief added, by giving a statement to parliament laying out 'the scale (but not the cause) of the challenge'.
Ministers agreed. At the next court hearing on 11 November 2024, Mr Justice Chamberlain was left to confront the fact that the government planned to withhold highly significant information from parliament. He told the private hearing: 'To see… that a statement in parliament is going to be made to provide cover for something is a very very striking thing.'
Jude Bunting KC, on behalf of the media organisations, put to Mr Justice Chamberlain that 'the government is going to deliberately mislead parliament and the public'. The judge replied: 'That's territory we can't get into, but the word 'cover' is particularly striking.'
On 18 December 2024, Mr Healey announced the new scheme. Though he said it was for eligible Afghans, the defence secretary crucially did not explain what they were eligible for.
Media organisations were then left to report the government's statement – unable, due to the terms of the injunction, to tell readers the truth until now. In a witness statement Dominic Wilson, a senior civil servant in the Cabinet Office, said press interest in the announcement had 'not been significant'.
The superinjunction unravels
In spring 2025, a new strand was added to the ever-expanding court case. A Manchester-based legal firm, Barings Law, told the government it was instructing 667 potential clients, 154 of whom were in Afghanistan, in relation to compensation over the data breach.
With news that hundreds more Afghans knew about a leak, and with the expanding number of media organisations listed as defendants, it was clear the government's case was falling apart.
By a hearing on 20 February 2025, ministers had decided to conduct a review of their whole approach to the data breach, asking a retired civil servant to analyse what risk named Afghans faced as a result of the leak.
The MoD had maintained throughout the case that it was unable to carry out an investigation for fear of spreading the information protected by their own injunction and alerting the Taliban, so news that the government could review these matters after all came as a surprise to the judge. Mr Justice Chamberlain asked: 'If this is a manageable risk now, why hasn't it been done to date?'
The review, carried out by Paul Rimmer, ex-deputy head of defence intelligence, drew on interviews with numerous experts, some of whom knew about the facts of the injunction.
It found that, while killings and other reprisals against former Afghan officials do occur, being identified on the dataset was unlikely to be sole grounds for targeting.
The Taliban already has access to 'significant volumes of data' to help identify targets, it said. It added that knowledge of a data breach had spread but the actual database had not been shared as widely as initially feared.
In another extraordinary conclusion, the government's review found that creating a bespoke scheme and using an unprecedented superinjunction may have 'inadvertently added more value' to the dataset for the Taliban.
The cost and scale of the evacuation 'may perpetuate a perception that the dataset provides information of considerably higher value that this review judges it to in reality', it concluded.
Lifting the injunction on Tuesday, Mr Justice Chamberlain said the conclusions of the review 'fundamentally undermine the evidential basis' on which the injunction, and the decisions to maintain it, have relied.
Break glass
In anticipation of the injunction falling away – an event referred to as the 'break glass' moment – ministers decided the original resettlement schemes should be closed because they risked being overwhelmed by a 'significant spike' of people wanting help.
On 1 July, without warning, the government quietly closed all existing schemes under immigration rule changes laid in parliament. Journalists were again left to report on the closure of the scheme without being able to explain the true motivations.
In light of the review, the MoD also told the court Mr Healey had decided to end the dataleak evacuation programme (ARR) and recommended the injunction be discharged. It is now taking steps to inform people that their information has been breached and will set up a dedicated information page.
Incredibly, the MoD has also planned for a risk of riots when the government's secret mission to bring thousands of Afghans into the country is revealed to the public.
The government has told the court that some 16,000 people affected by the data breach have been brought to the UK – believed to be the largest covert evacuation in peacetime history. A further 7,900 are yet to arrive but have been offered relocation.
Of those, the MoD say some 4,500 would not have been eligible to come to the UK and have been evacuated solely because of the leak. The MoD estimates the total cost for this group alone will reach £800m.
The rest have all been found eligible under the Arap scheme, though officials acknowledge their cases were prioritised and, in some instances, reassessed.
Though many Afghans have been brought to safety, the majority have been left behind – only now allowed to know about the danger they have been put in by the leak. They have been left to fend for themselves, in fear of their lives, with any other legal route to the UK now closed.
As one Afghan father of three, who wrote to the MoD after discovering the data breach, said: 'We are miraculously still alive due to our wit and pure luck, but it is like we are evolving in an open tomb. We are forced to always change places, and I never thought we'd one day face starvation but it happens. We pray that you understand what some of us go through, and that you make this unfair nightmare stop'.