Unlock the Editor’s Digest for free
Roula Khalaf, Editor of the FT, selects her favourite stories in this weekly newsletter.
A historic UK government data security breach put tens of thousands of Afghans at heightened risk of murder and torture by the Taliban.
The episode set in train an extraordinary set of events, including the creation of a secret immigration scheme at one point projected to cost as much as £7bn, and the imposition of an unprecedented super-injunction.
What was the original breach?
An unnamed British soldier in February 2022 accidentally sent two emails with highly sensitive, personal details of about 19,000 Afghans who co-operated with the British government in Afghanistan, plus 6,000 of their family members. The recipient was an Afghan, according to people familiar with the breach, who has not been publicly identified.
The database contained the identity, contact information and some family details of Afghans who had applied for relocation to the UK, fearing reprisals from the Taliban over their association with a western power. It also included emails of some UK government officials.
How was it discovered?
The leak was only discovered by the UK Ministry of Defence 18 months later in August 2023, after an anonymous Facebook user posted screenshots of the database and threatened to publish the entire spreadsheet.
MoD officials assessed that the accidental leak potentially put up to 100,000 Afghans — those listed on the database, plus many of their family members — at risk of murder, torture, harassment and intimidation from the Taliban if it obtained the list.
Why did the government seek a super-injunction?
In August 2023, Ben Wallace, then the UK’s Conservative defence secretary, applied for a legal gagging order, initially for four months, to prevent news of the leak spreading to try to avoid the Taliban hearing of the breach.
High Court judge Mr Justice Knowles went further and issued a rare super-injunction, banning even disclosure of the existence of restrictions, on the basis of the exceptional circumstances.
Rishi Sunak’s Conservative government, and then Sir Keir Starmer’s Labour administration, fought to keep the super-injunction in place for almost two years, staving off domestic scrutiny and international embarrassment.
It was finally lifted on Tuesday, following lengthy legal action by a group of media organisations, joined earlier this year by the Financial Times, challenging the restrictions.
How did ministers attempt to help the victims?
The government set up a secret relocation scheme to move the most at-risk victims of the breach, along with their families, out of Afghanistan and to the UK.
Officials said just 5,500 people have been relocated directly because of the breach, with at least a further 2,400 due to come.
But a total of 18,500 Afghans named on the database have come to Britain. The MoD said most were already eligible under an existing public resettlement scheme.
The UK’s Labour government has this month closed all Afghan relocation routes.
What was the cost of the breach?
As recently as this year, court records showed officials were estimating that they would have to relocate 25,000 victims of the breach who would have otherwise been ineligible to come to the UK, at a cost of £7bn over several years.
This week, the MoD insisted that the real estimate had only ever been £2bn, and that it had cut the forecast expenditures to £850mn by reducing the number of Afghans who will be accepted.
Officials have not yet provided more detailed costings.
What happens now?
The UK government is on alert for “public disorder” following the discharge of the injunction, with the Home Office advising that “such a risk is higher during the summer period”.
Those on the compromised dataset were due to be alerted shortly before the super-injunction was lifted that their details may have been compromised.
The UK government has established an “online self-checker” for those who fear they were on the list, to help them establish whether they were or not. Victims will be given advice on steps they can take to protect themselves.
The MoD intends to take direction from the Information Commissioner’s Office on whether to launch a compensation scheme for the victims, according to officials.
At least 665 Afghans on the list are preparing to sue the MoD, demanding at least £50,000 each, in a joint action led by Barings Law. Thousands of victims could potentially join the lawsuit, which could entail a hefty bill for the UK government.
