The personal details of Afghans seeking sanctuary from the Taliban for themselves and their families after serving with British forces were accidentally leaked in at least 49 separate data breaches by the British Defense Ministry. File photo by Andy Rain/EPA
The security of thousands more Afghans who served with British forces in Afghanistan may have been compromised after their data was accidentally leaked by the British Defense Ministry department processing applications to resettle in the United Kingdom.
Freedom of Information requests lodged by the BBC revealed an additional 48 data breaches, on top of a 2022 leak of an unlocked document containing the names and details of almost 100,000 former interpreters and troops and their families seeking refuge from the Taliban.
Three other smaller leaks were already in the public domain.
“We take data security extremely seriously and are committed to ensuring that any incidents are dealt with properly, and that we follow our legal duties. All incidents that meet the threshold under U.K. data protection laws are referred to the Information Commissioner’s Office, and any lesser incidents are examined internally to ensure lessons are learned,” said an MoD spokesperson.
Of the breaches revealed Thursday, seven were sufficiently significant to require the ICO, the country’s data watchdog, which has previously fined the MoD, to be notified at the time they occurred.
The Information Commissioner’s Office said it took no further action but was unable to say why due to the limited information it had retained on the cases. However, it said it was working with the MoD on the issue.
“We continue to engage with the MoD, so we can be assured that they have made the required improvements,” a spokeswoman said.
The watchdog didn’t prosecute over the 2022 leak either, describing it as a one-off that did not represent a pattern.
That breach only emerged in July when the High Court lifted a gagging order to stop it from being made public.
Legal representatives of those affected said the number of leaks showed officials overseeing the so-called Afghan Relocations and Assistance Policy, put in place just prior to Western forces’ complete withdrawal from Afghanistan in 2021, and other programs, did not take security seriously.
ARAP replaced previous “intimidation schemes” providing assistance or relocation to Britain for Afghans in the British military or civilians at risk of Taliban reprisals for working for the British in Afghanistan from 2001 onward.
Exactly how the additional data breaches occurred was not revealed by the MoD, but in previous incidents, officials inadvertently emailed out the email addresses and other personal information of ARAP applicants or attached spreadsheets that were not password-protected.
“What began as an isolated incident, which the Ministry of Defence initially sought to keep from public view, has now escalated into a series of catastrophic failings,” said Adnan Malik, data protection lead at Barings Law, which represents thousands of Afghans impacted by the 2022 leak.
“We urge the Ministry of Defence to be fully transparent with both those affected and the wider public. Victims should not be forced to learn the truth through legal action or news reports,” he added.
The 2022 leak, which went undiscovered for 18 months, was deemed sufficiently dangerous that the then-Conservative government was granted a court superinjunction preventing the reporters who uncovered the breach from reporting it and spent $1 billion secretly bringing around 800 of those affected to Britain.
The level of secrecy was constitutionally unprecedented, with the “contra mundum superinjunction” gagging all persons with knowledge from revealing the leak had occurred and requiring them to deny the existence of the injunction.
The final price tag of that leak alone was expected to balloon to much as $9.4 billion to relocate all 6,900 people affected.
The MoD had originally planned to bring just 200 individuals and their dependents.
