What has happened?

Details have emerged for the first time of an enormous accidental data breach by a British official in 2022 that put up to 100,000 Afghans at risk of torture and death, and the huge efforts by successive governments to keep the blunder secret, citing the risk of Taliban reprisals.

Thousands of Afghan people – some of whom had worked with British forces in Afghanistan – have been secretly relocated to the UK as a direct result of the leak, at a cost of more than £850m.

Why are we only finding out about this now?

The breach has been the subject of a superinjunction since August 2023, meaning journalists were banned from disclosing anything about it – or even the fact that an injunction existed.

The superinjunction, which was the first ever requested by a British government and the longest in history, was lifted by the high court on Tuesday, which is why details of the leak and response can now be revealed.

How did the breach happen?

The leak in February 2022 was the result of an error by a defence official, who had been tasked with verifying applications to the Afghanistan resettlement and assistance policy (Arap) resettlement scheme, designed for Afghans who had worked for British forces in the country.

Working outside authorised government systems, he contacted a number of Afghans in the UK, believing he was sending a list of 150 names. Instead, he had emailed a copy of the entire list of applicants, which was passed on to others in Afghanistan.

The Times reported that the official was a British soldier based at Regent’s Park barracks, the headquarters of the UK special forces.

What was leaked?

The leaked dataset contained the personal details of 18,800 individuals who were applying for resettlement along with their family members, including their phone numbers and in some cases addresses, amounting to 33,000 lines of data. Some emails of British government officials were also disclosed.

How did the leak first come to light?

It was discovered in August 2023 by an activist who was helping Afghans who had worked for UK forces. One of her contacts alerted her in alarm saying that an anonymous member of a Facebook group had said he had the database and was threatening to post it in full.

She immediately contacted the MoD, saying: “The Taliban may now have a 33,000-long kill list – essentially provided to them by the British government. If any of these families are murdered, the government will be liable.” The discovery was “simply bone-chilling”, she wrote.

What did the government do next?

The realisation sparked panic in Whitehall and an immediate hunt for the source of the leak. At the same time, UK officials contacted 1,800 Arap applicants in Pakistan warning them that they might be in danger.

The MoD asked Facebook to remove the post, citing the “risk of physical harm”. It then launched a top-secret initiative named Operation Rubific to secretly evacuate to the UK those deemed most at risk of Taliban assassination – although tens of thousands would be left behind.

How did the superinjunction come about?

After a number of journalists became aware of the leak within days of its disclosure to the MoD, Ben Wallace, then the defence secretary, asked the high court for an order banning any mention of the breach.

On 1 September 2023 the judge Mr Justice Knowles granted a three-month superinjunction “against the world”, rather than named individuals, the first of its kind. Another judge extended it the following February, saying there was a “real possibility that it is serving to protect” those named in the leaked database.

However, he cautioned: “What is clear is that the government has decided to offer help to only a very small proportion of those whose lives have been endangered by the data incident and that the decisions in this regard are being taken without any opportunity for scrutiny through the media or in parliament.”

The injunction was later extended further, despite challenges from four media organisations. The government cited concerns of retribution from the Taliban against those named.

How did the secret resettlement scheme work?

In December 2023, a covert new scheme called the Afghanistan Response Route (ARR), was set up to evacuate to the UK some individuals on the list who were ineligible for Arap. Though it was initially set up to resettle about 200 “principals” and their families, to date 900 individuals and 3,600 family members have been brought to Britain or are in transit via ARR, at a cost of £400m.

Taking into account the wider schemes, other official figures show that so far the government has relocated 35,245 Afghans to Britain, of whom 16,156 were among those affected by the data leak.

What happened next?

The present defence secretary, John Healey, had been briefed on the leak while in opposition but said on Tuesday that other cabinet members only become aware of the situation after Labour was elected to government in July 2024.

On taking office he “began straightway to take a hard look at the policy complexities, costs, risks, court hearings and the range of Afghan relocation schemes being run across government”, he told parliament on Tuesday. 

In January, he commissioned a former senior civil servant, Paul Rimmer, to conduct an independent review.  He concluded that nearly four years into Taliban rule of Afghanistan, the leaked data “may not have spread nearly as widely as initially feared” and “there is little evidence of intent by the Taliban to conduct a campaign of retribution” against those on the leaked list.

The review concluded that the ARR scheme “may now be disproportionate to the actual impact of the data loss”.

What happened on Tuesday?

As a result, the government told the high court on Tuesday that the superinjunction should be discontinued. In his ruling, Mr Justice Chamberlain described the cost of the plans as amounting to “the sort of money which makes a material difference to government spending plans and is normally the stuff of political debate”.

The ARR has now closed, Healey told MPs, although he said 600 “invitations” that had already been granted to individuals and their families would be honoured. “When this nation makes a promise, we should keep it,” he said.

He also offered “a sincere apology on behalf of the British government”, which was echoed by the Conservatives’ defence spokesperson, James Cartlidge.

How many Afghans will come to the UK and how much will all this cost?

MoD figures published on Tuesday show that across several Afghan resettlement schemes, the numbers of those who have already come to the UK and those who have not yet travelled total 56,100 people, including family members.

The estimated total cost of all resettlement schemes is now £5.5bn-£6bn. The covert ARR scheme set up specifically in response to the leak is expected to cost £850m.