Britain's self-inflicted Afghanistan data leak disaster

The Hill

a day ago

When a news story bursts into the headlines in the U.K. and consumes all the oxygen for several days, it can be difficult to know whether it is a domestic uproar or something that is reaching an international audience.
For all the fevered debate here, it seems that what we are calling 'the Afghan data leak scandal' has not attracted much notice in America. Perhaps we should be grateful.
To sum up, in February 2022, a Royal Marine at U.K. Special Forces headquarters emailed a spreadsheet that he thought contained the names of around 150 Afghan nationals who had applied to come to Britain, having assisted U.K. forces in Afghanistan. In fact, it had the details of 18,714 Afghans, as well as some Special Forces personnel, senior defense officials, members of Parliament and intelligence officers.
In the wrong hands, it could have been a pre-prepared Taliban kill list. This was a catastrophic breach of data security.
The Ministry of Defence was unaware of this loss of data for 18 months, until some of the information appeared in a Facebook group in August 2023. Defence Secretary Ben Wallace applied to the High Court for a temporary injunction on reporting the leak so that the security implications could be assessed and appropriate measures put in place to protect those at risk. Wallace was, however, standing down. His successor, Grant Shapps, who took on responsibility for the issue.
Astonishingly, the High Court judge who considered the Ministry of Defence's application, Justice Robin Knowles, went even further: He granted what is referred to as a 'super-injunction,' which not only prevents reporting of the issue covered by the injunction, but disclosure of the existence of the injunction itself. The use of this kind of measure by the government is unprecedented, and it meant that there was no public or parliamentary scrutiny of the data loss, because very few people even knew it had occurred.
Those who knew the full extent of the situation were extremely few: Shapps as defence secretary and the armed forces minister, James Heappey; Prime Minister Rishi Sunak and his deputy, Oliver Dowden; Labour's defense spokesman, John Healey, who is now defence secretary; the speaker of the House of Commons, Lindsay Hoyle; the media organizations whom it silenced; precious few others. The current prime minister, Keir Starmer, was not informed at that point.
Under the cloak of secrecy — the super-injunction's duration was extended twice in 2024 — a new resettlement scheme was hastily introduced which extended to 900 individuals affected, along with 3,600 family members.
When Starmer's Labour government took office in July 2024, only Healey, the incoming defence secretary, knew the full situation. Although he told the House of Commons when the super-injunction was lifted that 'it has been deeply uncomfortable to be constrained from reporting to this House,' it was in place for slightly longer under Labour than it had been under the previous Conservative government.
A review was conducted by Paul Rimmer, a former deputy chief of defence intelligence, which concluded that 'there is little evidence of intent by the Taliban to conduct a campaign of retribution against' those who assisted U.K. and coalition forces. The various resettlement schemes for Afghan nationals have now been closed down.
Inevitably, the current government is seeking to blame its predecessor. But that will not wash. Not only did Starmer and Healey have a year to rescind the injunction, but the prime minister's office will not rule out seeking such an instrument in the future. The government did not inform the Intelligence and Security Committee, the independent oversight body of these kinds of issues, and it has not been frank with the National Audit Office, the U.K.'s public spending watchdog.
The Ministry of Defence is a secretive organization by instinct. It parts with even the most harmless information under duress. Many will find it hard to avoid the conclusion that when a judge offered such a wide-ranging court order to prevent scrutiny or comment, it was as if Christmas had come early. Not only could challenging questions be avoided, they would never even be asked, because most legislators were unaware there was anything to ask questions about.
The eventual cost of the debacle is not clear, but it will be billions of pounds. That it touches on the ultra-sensitive subject of immigration compounds the damage done. Some have called it the worst data breach in British history; sadly it is part of a pattern at the Ministry of Defence, which reported 569 incidents of data loss in 2023 to 2024.
The most damaging aspect, however, is the corrosive effect on public trust, already at a historic low. Those inclined to believe overblown tales of 'the deep state' have been provided with fresh ammunition — the government using the courts to prevent parliamentary scrutiny and media reporting of an issue for two years.
It should not have happened. It cannot happen again. But the government will struggle to make voters believe that.
Eliot Wilson is a freelance writer on politics and international affairs and the co-founder of Pivot Point Group. He was senior official in the U.K. House of Commons from 2005 to 2016, including serving as a clerk of the Defence Committee and secretary of the U.K. delegation to the NATO Parliamentary Assembly.