Are we sure the Afghan data debacle wouldn't happen again?

Spectator

a day ago

'Afghanistan' was the heading of Defence Secretary John Healey's statement to the House of Commons on Tuesday – a word that hardly does justice to a three-year saga involving a catastrophic security breach and loss of data by the Ministry of Defence, a superinjunction and billions of pounds of taxpayers' money.
The bare bones of the story are these. In February 2022, the details of nearly 20,000 Afghans who had applied to come to the UK after the Taliban had seized power, as well as of senior British military officers, civil servants and MPs, was inadvertently leaked when a spreadsheet was emailed 'outside of authorised government systems'. These were mainly people who had worked with, or in some way assisted, British forces in Afghanistan and might therefore be the target of reprisals by the Taliban.
The MoD did not become aware of this disclosure of the details of these applicants to the Afghan Relocations and Assistance Policy (ARAP), which had been established for then-defence secretary Sir Ben Wallace in 2021, until August 2023, through a post on Facebook. Although the post was quickly taken down, Wallace applied to the High Court for a temporary injunction to prevent reporting of the data loss while the security aspects were investigated. The judge went one step further and issued a superinjunction, which prevented even disclosure of the injunction, let alone the issues it covered.
Shortly afterwards, a new scheme, the Afghan Response Route (ARR), was set up by ministers for people whose details had been included in the compromised dataset but who were not eligible under ARAP to come to the UK; the very existence of this scheme fell within the scope of the superinjunction and could not be reported. The ARR was initially intended to apply to around 200 people but expanded substantially, initially to include up to 3,000 Afghans; Healey told the Commons that there were now 900 'principals' and 3,600 family members in the UK or in transit under ARR, at a cost of £400 million.
In the Commons, the Defence Secretary announced that the ARR scheme would be closed and the superinjunction lifted; ARAP had previously been closed to new applicants on 1 July. An internal inquiry within the MoD suggested that the threat to Afghans who had worked with the UK government was no longer as acute as had first been thought.
There are several aspects of this unhappy story which are of enormous concern. The first is the loss of data itself. Healey noted that it was 'in clear breach of strict data protection protocols, and was one of many data losses relating to the ARAP scheme during this period', but the government refuses to say whether the individual responsible was a member of the armed forces or a civil servant. Incredibly, he or she is still employed by the government, and all Healey would disclose was that s/he no longer works on the Afghan brief.
The Metropolitan Police decided at the time that no criminal proceedings were necessary. That is a matter for them, but, given how tight-lipped ministers continue to be, we can only assume that the individual responsible for the leak has suffered effectively no consequences. Every aspect of that is unacceptable.
The broader issue is, of course, the superinjunction. Wallace's initial application for a time-limited injunction is understandable, following the revelation – albeit 18 months after the fact – of the data loss. A short media blackout while security aspects were resolved would have been an acceptable compromise in circumstances which were less than ideal. The judge's decision to issue a superinjunction makes the matter much more serious.
Once the superinjunction was in place, eight separate media organisations were instructed to not report on the matter. It was in place for nearly two years; Healey may have been 'deeply concerned about the lack of transparency to Parliament and to the public', but he has been defence secretary for more than a year now, longer than the injunction was in place under his Conservative predecessor Grant Shapps.
The MoD is a chronically secretive organisation which parts company with any information only with the greatest reluctance. I suspect that the presence of such a heavy blanket of secrecy was convenient and comforting, but it was unacceptable. Ministers and civil servants cannot be allowed to make policy and spend taxpayers' money without any kind of oversight. That is not how a democracy works.
This use of a superinjunction is apparently 'unprecedented', but Downing Street refused to rule out similar use in the future. That is not good enough. A court cannot be allowed to deny the House of Commons details of government administration and expenditure. The Bill of Rights 1688 is explicit:
'The Freedome of Speech and Debates or Proceedings in Parlyament ought not to be impeached or questioned in any Court or Place out of Parlyament.'
An investigation of how this all happened is vital: it may be that the Intelligence and Security Committee is the best body to undertake this. Looking forward, however, ministers must understand and profess unreservedly: this can never happen again.