logo
‘Bone-chilling': The most expensive – and potentially deadly

‘Bone-chilling': The most expensive – and potentially deadly

The Age16-07-2025
When journalists inquired about the data breach, they were slapped with a superinjunction. By court order, news outlets were prevented from disclosing any details about the error – or even the existence of the injunction itself.
At the time the email was sent, the government was scrambling to make good on a promise to give sanctuary to Afghans, including soldiers and interpreters, who had fought alongside British troops following the invasion in 2001 until the fall of Kabul to the Taliban in August 2021.
The tens of thousands of names on the database were of Afghans who had applied for asylum in the UK under the specially convened ARAP scheme. It also included information about Afghans who applied to a similar programme called the Afghan Citizens Resettlement Scheme (ACRS). Their very act of applying for asylum had put their lives in jeopardy.
For 18 months, the Ministry of Defence (MoD) appeared oblivious to the existence of the rogue email, with its spreadsheet sent in error. That all changed on August 14 2023, with an anonymous post on Facebook that would send the MoD into a spiral of panic.
The MoD only became aware of the leak when that month a member of the public wrote to Luke Pollard, the Labour MP for Plymouth, and James Heappey, a Conservative who was at the time a defence minister, warning them that the spreadsheet had been shared widely online.
'I have a copy of it, so does the Taliban – why doesn't the ARAP team?' wrote the person, whose name was redacted in court documents, in the email dated August 10, 2023. They are understood to be a support worker for Afghans settling in the UK.
Extracts from the spreadsheet were then posted on Facebook four days later.
In a group used by 1300 Afghans needing to relocate, some of whom may have been Taliban infiltrators, the user – known only as 'Anonymous Member' – wrote that he was in possession of the database containing records of 25,000 applicants on 33,000 rows of information, adding: 'I want to disclose it.'
The user who posted the extracts is understood to have been an Afghan who was sent the database, and whose own asylum claim was later rejected.
To show the list was genuine, the Facebook user then posted the personal details of nine Afghans who had applied to the ARAP scheme. British diplomatic staff administering the scheme in Pakistan were alerted by another member of the Facebook group. Alarm bells began to ring.
By the afternoon of August 14, the relocation team in Islamabad had circulated an email to some 1800 Afghans in Pakistan, warning them: 'We have been informed there may have been a potential data breach of your contact information.'
Some of those affected told the British Council they had been contacted by Iranian phone numbers on WhatsApp asking them to disclose scans of their passports.
However, Whitehall officials chose not to inform any individuals waiting in Afghanistan or elsewhere about the breach, because it was felt it would increase the risk of the Taliban getting hold of it. Spies, meanwhile, sought to delete any trace of the list from servers overseas.
The posts were deleted within three days after officials from the MoD contacted Meta, Facebook's owner.
Timeline of the 'kill list' and the superinjunction
February 2022: A Royal Marine accidentally sends an email containing the list of nearly 25,000 people who applied for the Afghan Relocations and Assistance Policy.
August 14 2023: A Facebook user posts an excerpt of the dataset disclosing the details of nine ARAP applicants. The Ministry of Defence is notified.
August 15: A civilian volunteer warns James Heappey, the armed forces minister, that the Taliban may now have a 'kill list essentially provided to them by the UK government'.
August 17-25: Journalists contact the MoD and Foreign Office about the breach, but agree not to publish until those at risk are protected. Ben Wallace, the defence secretary, decides to apply for a court order blocking the news.
September 1: The MoD asks the High Court for an injunction for around four months. A High Court judge grants a superinjunction, saying the risk of the information falling into the Taliban's hands justifies the highest level of secrecy.
November 16: A Cabinet sub-committee, the Domestic and Economic Affairs (DEA) committee, discusses the issue. Members at the time include Rishi Sunak and Jeremy Hunt. Meeting notes reveal plans to establish a compensation scheme at a cost between £120 million and £350 million.
November 23: Justice Martin Chamberlain gives a private judgment where he says granting a superinjunction 'is likely to give rise to understandable suspicion that the court's processes are being used for the purposes of censorship'.
December 19: The DEA committee says that a new route of settlement in the UK should be offered to about 200 at-risk people and their dependents. This is called the Afghanistan Response Route (ARR).
February 15 2024: Chamberlain extends the superinjunction. He adds in a second, private judgment: 'What is clear is that the Government has decided to offer help to only a very small proportion of those whose lives have been endangered by the data incident and that the decisions in this regard are being taken without any opportunity for scrutiny through the media or in Parliament.'
May 21: Chamberlain rules that the superinjunction should be lifted. He says there is a 'significant possibility' the Taliban knows about the dataset, but adds that it is 'fundamentally objectionable' that decisions about thousands of people's lives and billions of pounds of taxpayers' money are being taken in secret.
June 25-26: The Court of Appeal rules that the superinjunction will remain in place. In a later written ruling, judges Sir Geoffrey Vos, Lord Justice Singh and Lord Justice Warby say that between 80,000 and 100,000 people could be at risk if the Taliban were to obtain the data.
July 4: Sir Keir Starmer is briefed about the data breach after taking office.
February 3 2025: A review says the ARR resettlement plan would mean relocating more Afghans than had been moved under ARAP, and would extend the schemes for another five years at a total cost to the taxpayer of around £6 billion.
July 4: John Healey, the Defence Secretary, concludes that the ARR should be closed after an internal review finds the breach is unlikely to have put individuals at greater risk. The review also said the Government may have 'inadvertently added more value to the dataset' by seeking the superinjunction and implementing a bespoke resettlement scheme. Government lawyers tell the High Court that in light of the decision to close the Afghanistan Response Route, the superinjunction 'should no longer continue'.
July 15: Chamberlain lifts the superinjunction.
The Metropolitan Police was informed in August 2023, but it was decided a criminal investigation was not necessary.
It is understood that individuals in the UK and Pakistan are still in possession of the database, and in at least one case it has changed hands for a large sum of money, understood to be five figures.
By 10am on August 15, an email was sent to Heappey – the armed forces minister at the time – with the alarming subject title: 'ARAP families, imminent threat to life.'
The sender of the email – whose name has been redacted in court documents – explained that they were now aware of the data breach.
'The fact that the Taliban may be in possession of 33,000 ARAP applications, including the primary applicants' phone numbers and all the case evidence, is simply bone-chilling,' claimed the email.
It is unclear what, if any, was Heappey's response. Or indeed whether he saw the email.
By 8.09pm, a time when the MoD's top brass would have gone home for the day, a senior official in charge of data governance circulated an official crisis alert to them, confirming the data breach.
But it wasn't clear at that stage how the database had got into rogue hands. The question, an unnerving one for the government, was whether this could have been an illegal hack.
The intelligence services, including GCHQ and MI6, were briefed by the UK Foreign Office and asked to examine whether a hostile state could have been responsible. The CIA was also brought into the loop. Days later, officials realised the stark truth of the accidental leak.
From then on, the government went into crisis mode. David Williams, a freelance journalist who had previously worked on a campaign to resettle Afghan interpreters, was made aware of the breach. He contacted the MoD for comment, and other journalists soon got wind of it.
The government decided that any whiff of the spreadsheet could put lives in danger, and the MoD issued a so-called D-Notice requesting that newspapers refrain from reporting the breach. D-Notices are advisory only, and not legally binding.
Meanwhile, inside the UK government, ministers were in a race against time to get to Afghans identified on the spreadsheet before the Taliban could.
Ben Wallace, the defence secretary at the time, who had announced in July his intention to resign, was incandescent. He had been concerned about data safety and could not believe that such a lackadaisical breach could have been allowed to occur.
A Cobra meeting – called when high-level decision need to be made in emergency situations – was convened in Whitehall in response.
On August 25, 2023, in one of his last acts as defence secretary, Wallace applied to the High Court for an injunction to prevent the leak becoming public.
A week later, on Sept 1 – by which time Grant Shapps had been installed as his successor – the High Court granted a superinjunction contra mundum – meaning 'against the world' – that prevented anybody knowing about the leak and the existence of the injunction itself.
It was the first time such a draconian injunction had been used by a UK government against the British press.
By now, the government was running two operations. One was to stop the story getting out, and the other was to get the Afghans out of their home country and to the safety of the UK.
Ministers launched Operation Rubific, which would aim to bring thousands of Afghan families most at risk to the UK, largely via Pakistan. In towns up and down the country, Afghans were quietly resettled and their numbers kept off the official books, after being flown into the UK on specially arranged flights.
Justice Robin Knowles, the High Court judge who granted the superinjunction, accepted his ruling would infringe 'freedom of expression and of the press,' but insisted that 'the impact is justified in the particular and exceptional circumstances of this case including the risk to life and of torture'.
Instead of being granted against a named individual or news organisation, the injunction banned anybody at all who learnt of the leak from talking about it.
With news reporting banned, Parliament was kept in the dark – although the speakers of both the Lords and Commons – were secretly told so they could decide how to handle any Parliamentary questions to ministers about it.
John Healey, then the shadow defence secretary, tabled just such a question on December 13, 2023. In that month, the information commissioner had fined the MoD £350,000 for leaking the details of more than 200 ARAP applicants. Healey asked if the watchdog was investigating any similar breaches.
A brief answer from Heappey said there were two 'live investigations', confirming the Labour member's suspicions. The Telegraph understands that Heappey then met his Labour counterpart that month to reveal all to him.
Yet, Healey was also served with the superinjunction at the meeting – meaning he could not even tell Sir Keir Starmer, the leader of the opposition at the time, let alone the shadow chancellor. The intelligence and security committee and the Commons defence select committee were both kept in the dark.
'I would not widen [the] circle by briefing others,' said Shapps in a civil service memo dated November 2023. The chairman of the public inquiry into alleged extrajudicial killings of Afghans by members of the SAS was also kept in the dark.
Democratic accountability had seemingly been thwarted. Thanks to the court order, the MP could ask no further public questions about the leak, nor question ministers' and officials' handling of it in deciding to bring all the directly affected Afghans to the UK.
At the time, sources suggested, the MoD's estimate of the total cost of bringing Afghans to Britain was in the region of £4 billion. It would rise to £7 billion, before being revised down to £6 billion, an extraordinary sum all the same.
By May last year, a Cabinet subcommittee chaired by the deputy prime minister – at the time, Oliver Dowden – had decided to allow 11,500 Afghans into Britain as a result of the leak, yet this had not been announced to Parliament nor subjected to any public scrutiny.
Loading
The money to do so was drawn from the Treasury's reserve funds and not the MoD, Home Office or Department for Communities and Local Government's budgets, The Telegraph understands.
At about the same time, Justice Martin Chamberlain, who had taken over the legal case, ruled the injunction ought to be lifted, prompting an immediate appeal by the MoD.
Court of Appeal judges agreed with the government and said the gag order had to remain in place.
Meanwhile, July's general election saw a change of government. Initially, Labour kept things exactly as they were under their Tory predecessors, with MoD lawyers continuing to insist to the High Court that any public mention of the leak would be lethally disastrous.
Healey, by now the Defence Secretary, continued to toe the MoD line and stay silent on the breach.
The injunction would remain in place for another year after Labour took charge. Officials and politicians continued to maintain that any public knowledge of the breach would somehow inspire the Taliban to go and look for the spreadsheet.
Yet by January this year, retired civil servant Paul Rimmer – the former deputy head of Defence Intelligence – had been commissioned to review the risks.
By April, The Telegraph understands, ministers were aware that he was likely to find that if the data breach became public knowledge it would not substantially increase the risks to those mentioned in it.
In his review, Rimmer concluded that 'early concern about the extent of the Taliban intent to target [certain individuals] has diminished'.
'There is little evidence of intent by the Taliban to conduct a campaign of retribution… Killings are undoubtedly still occurring, and human rights violations remain extensive, but it is extremely difficult to determine the causes of individual killings or detentions,' he found.
The system set up to fly in Afghans, without any public knowledge of the scheme as a result of the data breach, was now 'disproportionate to the actual impact of the data loss were it to fall into the Taliban's hands'.
By the time of the review, 16,156 individuals affected by the breach in 2022 had reached the safety of the UK. But it is only now that news organisations can tell that story.
An Afghan man now living in Britain is said to be the person who threatened to share the list. According to the Daily Mail, he is in the UK with at least seven relatives.
Orange background

Try Our AI Features

Explore what Daily8 AI can do for you:

Comments

No comments yet...

Related Articles

Australia locks in for 50-year defence pact with major ally
Australia locks in for 50-year defence pact with major ally

News.com.au

timean hour ago

  • News.com.au

Australia locks in for 50-year defence pact with major ally

Australia has locked itself into a new 50-year treaty with one of its most influential global allies. The UK government announced the signing of a new AUKUS-aligned pact with Australia in what it called a 'commitment to a free and open Indo-Pacific'. The AUKUS agreement has found itself on shaky ground as an increasingly erratic Trump administration undergoes a 'review' of the defence pact announced in September 2021. Spearheaded by American bureaucrat Elbridge Colby, the AUKUS review has shrouded the multibillion-dollar agreement in doubt since it began in June, prompting Australian and UK officials to announce their renewed enthusiasm for the tri-lateral security pact. The announcement comes as the UK Foreign and Defence secretaries arrive in Australia to discuss the strengthening of the relationship between the two historically tied countries with their Australian counterparts Penny Wong and Richard Marles. Mr Marles said he was enthusiastic about the opportunity to 'address shared strategic challenges in an increasingly complex and uncertain world'. Senator Wong said 'Australia and the United Kingdom are longstanding friends and partners'. 'We take the world as it is – but together, we are working to shape it for the better,' she said. The treaty ratifies the UK's commitment to produce components of the Virginia-class nuclear subs that Australia hopes to incorporate into its fleet by the early 2030s. UK Foreign Secretary David Lammy said the ties that bind Australia and the UK together were like 'no other'. 'In our increasingly volatile and dangerous world, our anchoring friendship has real impact in the protection of global peace and prosperity,' he said. UK Defence Secretary John Healey said AUKUS was 'one of Britain's most important defence partnerships'. 'This historic treaty confirms our AUKUS commitment for the next half-century. Through the treaty, we are supporting high-skilled, well-paid jobs for tens of thousands of people in both the UK and Australia,' he said. 'Our deep defence relationship with Australia – from our work together to support Ukraine, share vital intelligence, and develop innovative technology – makes us secure at home and strong abroad.' Mr Healey's comments come as a UK carrier group joins the Australian Defence Force and various branches of the US military in Operation Talisman Sabre, a biannual war game exercise that takes place across Far North Queensland and Papua New Guinea over three weeks. More than 3000 British military personnel are taking part in the exercise, which marks the first time in more than 20 years that a British aircraft carrier has entered Australian waters.

Australia and UK to sign new 50-year treaty amid US uncertainty
Australia and UK to sign new 50-year treaty amid US uncertainty

SBS Australia

timean hour ago

  • SBS Australia

Australia and UK to sign new 50-year treaty amid US uncertainty

The United Kingdom has underscored its commitment to AUKUS after revealing it will sign a new 50-year treaty with Australia, amid questions over US involvement in the trilateral security pact. The treaty will be inked when Foreign Minister Penny Wong and Defence Minister Richard Marles host their UK counterparts David Lammy and John Healey in Sydney on Friday for regular Australia-UK ministerial meetings, according to British news agency PA. "This historic treaty confirms our AUKUS commitment for the next half century," UK defence secretary Healey said. While the AUKUS nuclear submarine partnership involves the US, UK and Australia, the treaty is between the latter two nations, as a Pentagon review into the agreement threatens America's future participation. Australia and the UK are expected to lay out the bilateral aspects of the agreement and explore ways the two countries can work together over the next half-century. In a joint statement, Marles and Wong said the Australia-UK Ministerial Consultations, or AUKMIN, were critical to the two nations' shared interests. "We take the world as it is — but together, we are working to shape it for the better," Wong said. Under the $368 billion AUKUS program, Australia will buy at least three Virginia-class nuclear-powered submarines from the US in the early 2030s. A new class of nuclear submarines will be built in Adelaide and delivered in the 2040s. The US had promised to sell Australia nuclear-powered attack submarines under the AUKUS agreement, but President Donald Trump's administration has launched a review into the deal to examine whether it aligns with his "America first" agenda. Defence analysts believe a likely outcome of the US review will be a request for more money from Australia to support its submarine industrial base. The Australian government has said it remains confident in the nuclear-submarine deal being delivered. The UK has fast become one of Australia's most important defence allies amid turmoil under the Trump administration, a security analyst says. Australian Strategic Policy Institute senior analyst Dr Alex Bristow said holding ministerial meetings on a six-monthly cycle, rather than the traditional annual timeline, highlights strengthened ties between the two nations. "The tempo of it increasing, I think, is a signal that Britain is moving into an elite category," he told AAP. The UK was probably third behind Japan and the US in terms of how strategically significant the defence relationship was to Australia, Bristow said. Meanwhile, the UK's Carrier Strike Group, led by the Royal Navy flagship HMS Prince of Wales, arrived in Darwin on Wednesday in the midst of the Talisman Sabre multi-nation military exercises being hosted by Australia. It's the first UK carrier strike group to visit Australia since 1997. The international task group includes five core ships, 24 jets and 17 helicopters, centred on the flagship aircraft carrier. On Sunday, Marles and Wong will join their counterparts in Darwin to observe the UK Carrier Strike Group in action at Talisman Sabre. UK High Commissioner to Australia Sarah MacIntosh said the arrival of the strike group was a demonstration of commitment to the region and the strong relationship with Canberra. "This is an anchor relationship in a contested world," she said. Bristow said Australia should be welcoming carrier strike groups from European countries. He said NATO had identified China as a threat to its interests as Beijing continues to collaborate with Russia and North Korea. "It's entirely in the interests of European allies in NATO to be working with Indo-Pacific allies," Bristow said.

UK and Australia deepen AUKUS submarine pact with 50-year treaty
UK and Australia deepen AUKUS submarine pact with 50-year treaty

ABC News

time2 hours ago

  • ABC News

UK and Australia deepen AUKUS submarine pact with 50-year treaty

The United Kingdom and Australia will sign a new five-decade treaty to cement the AUKUS submarine pact and bolster shipbuilding in both countries as the Trump administration continues to scrutinise the ambitious technology-sharing deal. The new pact is expected to be announced by Foreign Minister Penny Wong and Defence Minister and Deputy Prime Minister Richard Marles — along with their British counterparts David Lammy and John Healey — in the wake of annual AUKMIN talks in Sydney today. It will be signed by Mr Marles and Mr Healey tomorrow when they meet in the deputy prime minister's electorate in Geelong. While full details are not yet clear, the agreement is expected to cover the "full breadth" of cooperation between the UK and Australia to develop the next-generation AUKUS nuclear-powered submarine — including to develop the workforce and infrastructure Australia will need to operate and sustain the highly sophisticated military platform. In a statement, Mr Healey said the "historic" treaty "confirms our AUKUS commitment for the next half century" and would deliver more than $40 billion in exports to the United Kingdom over 25 years. "Through the treaty, we are supporting high-skilled, well-paid jobs for tens of thousands of people in both the UK and Australia," he said. Foreign Secretary David Lammy said the UK–Australia relationship was "like no other, and in our increasingly volatile and dangerous world, our anchoring friendship has real impact in the protection of global peace and prosperity." Top US Defence official Elbridge Colby, who is conducting the Trump administration's review, has previously voiced concern about the pact and suggested the US may not be able to sell Virginia Class submarines to Australia in the 2030s without compromising its national security. Other US government sources have also speculated that the administration might make fresh demands of Australia in order to lock in continuing support from the US. One UK government official told the ABC that both governments were sending a "clear and obvious" signal to the Trump administration that they were not wavering on AUKUS and their support for it remained "rock-solid." The federal government has already committed more than $4 billion to bolster submarine production in the United Kingdom, which will work with Australia to co-design the next-generation AUKUS submarine and deliver Australia the small-scale nuclear reactors that will power them. It is not yet clear what additional commitments Australia has made under this new agreement, although the government has already publicly flagged it will need to plough at least $360 billion into developing and sustaining nuclear-powered submarines over the decades. Defence analysts say while the final figure is difficult to calculate, it is likely to be much higher than that over time. Any additional investments in the UK could also draw political scrutiny in Australia. While the United Kingdom's political commitment to AUKUS has remained firm, the British shipbuilding industry has also been beset with serious cost blowouts and delays. After their meetings in Sydney and Geelong, the four ministers will travel to Darwin and visit the UK aircraft carrier HMS Prince of Wales, which is participating in the massive Talisman Sabre military exercises, which will draw in more than 30,000 military personnel from almost two dozen countries. It is the first time in more than two decades that a UK aircraft carrier has visited Australia, and the British government says it is a clear signal of its resolve to remain a force in the Indo-Pacific, despite the pressures it is facing due to Russia's invasion of Ukraine.

DOWNLOAD THE APP

Get Started Now: Download the App

Ready to dive into a world of global content with local flavor? Download Daily8 app today from your preferred app store and start exploring.
app-storeplay-store