Thousands of Afghans have been moved to the UK under a secret scheme which was set up after a British official inadvertently leaked their data, it can be revealed.
In February 2022, the personal details of nearly 19,000 people who had applied to move to the UK after the Taliban seized power in Afghanistan were leaked.
The previous government learned of the breach in August 2023 and created a new resettlement scheme nine months later, which has seen 4,500 Afghans arrive UK so far.
The existence of the leak and relocation scheme were kept secret after the government obtained a super-injunction.
Details of the major data breach, the response and the number of Afghans granted the right to live in the UK as a result were only made public on Tuesday after a High Court judge ruled the gagging order should be lifted.
The leak contained the names, contact details and some family information of people potentially at risk of harm from the Taliban.
The government also revealed on Tuesday:
- The Ministry of Defence (MoD) believes 600 Afghan soldiers included in the leak, plus 1,800 of their family members, are still in Afghanistan
- The scheme is being closed down, but relocation offers already made to those who remain in Afghanistan will be honoured
- The secret scheme – officially called the Afghan Relocation Route – has cost £400m so far, and is expected to cost a further £400m to £450m
- The breach was committed mistakenly by an unnamed official at the MoD
- People whose details were leaked were only informed on Tuesday
Speaking in the House of Commons, Defence Secretary John Healey offered a “sincere apology” to those whose details had been included in the leak, which came to light when some appeared on Facebook.
He said it was as a result of a spreadsheet being emailed “outside of authorised government systems”, which he described as a “serious departmental error” – though the Metropolitan Police decided a police investigation was not necessary.
Healey said the leak was “one of many data losses” related to the Afghanistan evacuation during that period, and contained the names of senior military officials, government officials and MPs.
The MoD has declined to say how many people may have been arrested or killed as a result of the data breach, but Healey told MPs an independent review had found it was “highly unlikely” an individual would have been targeted solely because of it.
He said that review had also judged the secret scheme to be an “extremely significant intervention” given the “potentially limited” risk posed by the leak.
In a High Court judgement issued on Tuesday, Mr Justice Chamberlain said it was “quite possible” that some of those who saw the Facebook post containing the leaked personal data “were Taliban infiltrators or spoke about it to Taliban-aligned individuals”.
An email has been sent to those impacted by the breach, urging them to “exercise caution”, and take steps like protecting their online activities and not responding to messages from unknown contacts.
Healey said those who have been relocated to the UK have already been counted in immigration figures.
Tuesday’s disclosure dates back to the August 2021 withdrawal of US troops from Afghanistan, which saw the Taliban retake power and quickly surround the capital Kabul.
The leak involved the names of people who had applied for the Afghan Relocations and Assistance Policy (Arap) scheme, which the UK government set up to rapidly process applications by people who feared reprisals from the Taliban and move them to the UK.
The evacuation – which saw 36,000 Afghans moved to the UK – has already been heavily criticised in the years since it was launched, with a 2022 inquiry by the Foreign Affairs Committee finding it was a “disaster” and a “betrayal”.
When the government set up a new relocation scheme last year in response to the leak, members of the press quickly learned about the plans.
The government asked a judge to impose an injunction on the media. The court then imposed a type of order which prevented outlets from reporting any detail of the leak, or even that the injunction itself existed. Healey said he was not aware of any other similar injunctions being in place.
He told the House even he had been prevented from speaking about the breach because of the “unprecedented” injunction, after being informed while still shadow defence secretary.
Reading a summary of his judgment in court, Mr Justice Chamberlain said the gagging order had “given rise to serious free speech concerns”.
He continued: “The super-injunction had the effect of completely shutting down the ordinary mechanisms of accountability which operate in a democracy.
“This led to what I describe as a ‘scrutiny vacuum’.”
Court documents disclosed on Tuesday revealed then-Defence Secretary Ben Wallace “personally” applied for the stringent injunction in order to give the government time to do “everything it reasonably can to help those who might have been put at further risk by the data compromise”.
The injunction was extended in November 2023 on the basis the Taliban may have not been aware of the leaked data’s existence.
However, Mr Justice Chamberlain decided to lift it on the ground the MoD’s internal review found the Taliban “likely already possess the key information in the dataset” and confirmation of its existence is “unlikely” to “substantially” raise the risk” faced by those impacted.
Shadow defence secretary James Cartlidge, who was in government when the secret scheme was established, said “this data leak should never have happened and was an unacceptable breach of all relevant data protocols”.
Erin Alcock, a lawyer for the firm Leigh Day, which has assisted hundreds of Arap applicants and family members, called the breach a “catastrophic failure”.
Earlier this month, the government confirmed it had offered payouts to Afghans whose information had been compromised in a separate data breach.
