Why was the MoD data leak kept secret for 600 days?

0:00Coming up on the Sky News Daily, the Ministry of Defence data leak that put 100 ,000 Afghans at risk and has been covered up for years. I'm Mark Austin. More in a moment. It was a simple mistake that had life-threatening consequences for 100 ,000 people. People who had helped protect British forces during their time in Afghanistan. people whose families were now at risk of violence, reprisals and even death because of that help. For the first time, the Ministry of Defence has admitted it was responsible for a data breach that has been kept secret for years at huge expense to the taxpayer with the help of a so-called super injunction that prevented any kind of media or parliamentary scrutiny.

0:50We'll have more on the legal fallout of the decision to finally lift that injunction a little later. But first, let's join our Security and Defence editor, Deborah Haynes. Deborah, this is an astonishing story in so many ways. Just talk us through the timeline of this, how the data was leaked and so forth. Yeah, it's an absolutely extraordinary set of incredibly unfortunate events that began with human error, back in February 2022, when a military person involved in trying to help draw up a big list of Afghan individuals who believe to have a claim to come to the UK or to be assisted by the British government as part of a scheme that they put in place following the collapse of the Western-backed Afghan government in 2021 and the return to power of the Taliban, who obviously saw anyone linked to NATO, Britain, Western powers as a traitor that deserved to die.

1:56So clearly lives at risk, incredibly serious. And what happened was that an email was sent out and it contained this data set of almost 20 ,000 names who were all applying for this scheme. And it included not just their names, but other personal information. The UK government in 2023, so about 18 months after it happened, it realised the breach and then imposed a super injunction on any reporting of the fact that the breach had taken place. It says it did this to try to protect the information rather than suppress the embarrassment of the blunder. And at the same time, it started a secret scheme to relocate a number of those who had had their personal data compromised.

2:48But it didn't tell anybody that this had happened. And what the government is saying today is it's admitting this huge data breach. It's saying that these close to 7 ,000 Afghan nationals who are directly impacted by this breach and wouldn't be in the UK were it not for the breach, are being relocated. Right. Is there any evidence that the Taliban got sight of this or got any information about this? Nobody has said that they have clear evidence that because of the data breach, individuals have been killed. There have been individuals who have been targeted and killed by the Taliban because of their affiliation with Western-backed forces.

3:30However, would that have happened if the breach hadn't occurred? It's not clear. It's also not clear whether the Taliban actually have got their hands on this list. What is clear is that the Ministry of Defence lost control of the information. And that is the mess that they are now having to try to deal with and to contain. And clearly this super injunction was designed as part of that. And an interesting part as well, which is contradictory. It seems, talking to people who've been involved in this process, the Ministry of Defence used the fact that there was this serious risk to life, torture, potential even death of individuals to justify the super injunction in the first place.

4:15But now this internal review that's been carried out by a former senior civil servant that has concluded that actually there isn't an elevated risk to those named in this data set beyond the risk that they already faced, which is why the judge or one of the reasons why the judge has lifted the super injunction. And these are two contradictory things. There can't be no risk. and then suddenly it's been lifted. So that's quite confusing. And I'm sure that will be something that's drawn on in the legal action that is following. Right. Well, it is confusing because the judge today basically said that it was not justified when so many people were involved in Afghanistan and so much public money was being spent.

4:59So there will be this whole argument about whether the super injunction was ever justified. Yeah, I agree. And actually the sums of money being talked about are also being disputed. Court documents cite government officials estimating that the cost of the relocation, and it seems to be that this is the cost of, if you wanted to relocate every single person whose data has been compromised, is around£7 billion. But what the Ministry of Defence today is saying is that the cost of the relocation of these 6 ,900 individuals that are only going to be in the UK because of that security breach, so does that mean that they weren't eligible for the formal government programme in the first place?

5:50That cost is going to be£850 million. But the total cost to the taxpayer of the whole more, you know, the secret scheme plus the public relocation scheme is going to be around£6 billion. There's obviously there's been significant cost already incurred by the government through taking this legal action in the first place. And there is a class action that is going to follow, which again, is going to cost the taxpayer ultimately an awful lot of money. And, you know, of course, you have to as well stress, though, the risk to life that has been caused to these individuals that have been named. This was clearly a mistake.

6:30Do you know if there's been any disciplinary action against the official involved? It hasn't been made public what the repercussions were for the particular individual that was involved in sending this email in the first place. Although the Secretary of State, John Healy, he did say, or it's been briefed, that changes have been made in the way that the Ministry of Defence or the military handles these kind of data sets to ensure the same mistake can't happen again. That was going to be my last point. You know the Ministry of Defence very well. You've been defence correspondent for many years. How surprised are you that this kind of really sensitive information could have been leaked inadvertently in the way it was?

7:19You would think there'd be more secure systems in the MOD already, not that they'd promised now to make sure they're more secure. Yeah, sadly, not surprised at all. And it's a shocking misuse or mistake. It seems as though the systems that were involved in the handling of this information were woeful. The fact that this breach could have occurred. But it really underlines as well, you know, the MOD's IT system has been notoriously poor for a long time. Yes, there are always updates being made. But unfortunately the Ministry of Defence and the military doesn't have a great track record when it comes to ensuring the protection of information which is you know clearly worrying and of course you assume that lessons are being learnt and the Ministry of Defence is in massive damage limitation mode but this is a really bad day for them and they know it and it's going to have repercussions for a long time.

8:21Thanks very much, Deborah. Well, already the lawyers are circling, but what is a super injunction and how did the government justify using it in this case? I'm joined by Adnan Malik, Head of Data Privacy at Bearings Law. Adnan, just explain who you're representing. We represent claimants. These are the individuals who assisted the Ministry of defence in various capacities, from being translators to being the equivalent of special forces and everyone else in between. These people named were on a spreadsheet that was inadvertently emailed to people it shouldn't have, ended up on social media, and there was a massive data breach as a result of this.

9:04Right. So how soon did you realise there had been this data breach. When did you first know about it? So we received our first instruction this year and we became aware of the super injunction when the Minister of Defence provided us with a copy of this approximately four to five months ago. Right. And those you're representing, are they now all in the UK or are some still in Afghanistan? So from the thousand claimants, approximately 25 % of them are still abroad, predominantly in Afghanistan. Everyone else is here. So how concerned are you about those still in Afghanistan? Extremely concerned.

9:46These individuals email us regularly and the contents of the email essentially always says the same thing. I'm very scared. I, you know, there's people knocking on my door. I don't know who they are. And they also know of family members or friends who assisted the Ministry of Defence, who unfortunately are no longer alive now. So these people have to keep changing homes. They keep changing the telephone numbers as well on the hope that no one can find out who they are, where they are. And is there still hope that they can be brought to the UK? For one reason or another, the application has been rejected, but they still are hopeful that they can come here because they feel they'll be much safer in the United Kingdom than in Afghanistan.

10:27done. The MOD has apologised and advised them to take certain actions. What do you make of that? Maybe too little too late. The Minister of Defence have been aware of this for over two years now. They've forced tooth and nail to keep the super injunction in place. These steps should have been carried out years ago, especially when they found out that this list has been posted on social media. So just for the benefit of our listeners, just explain what a super injunction is and the impact that that has. So a normal injunction in place, one can make reference to it, one can discuss it with anyone really.

11:07A super injunction doesn't even let an individual mention that there's a super injunction in place. We were not even allowed to tell our own clients that there was a super injunction in place. So you've been fighting pretty fiercely in court to get this super injunction lifted? That's correct. We've attended several hearings where we made representations on behalf of our clients and provided the court with several reasons why this super injunction should be lifted. The primary reason being the threat to their life, that these are individuals who assisted the Ministry of Defence through no fault of their own.

11:42They're in a very bad situation now where they could be a serious threat to life. They deserve to know, as they've assisted us when we needed their help. The least you can do now is tell them, we're sorry, we made this mistake. Please take preventive measures to ensure your life doesn't come to harm. But if more detail of all this came out, aren't their lives at greater risk? The MOD argument would be, I guess, that this is a matter of national security. Either way, there's a threat to their life, whether this is disclosed or not. But I'm sure these individuals would want to be made aware that their information has been disclosed so they can take the steps that they feel necessary to protect themselves.

12:23Not telling them essentially is leaving them in a room with no light switch on. Additionally, this has also cost the Minister of Defence a lot. They've spent two years on legal costs and trying to stop this from coming up. So what do you think happens now then? As I understand, the Minister of Defence have started informing individuals whose data has been breached and they've told them to be cautious. Now, if the Minister of Defence did not think that there was a threat to life, they wouldn't be advising people to be cautious. I gather this arrived suddenly by text message or on WhatsApp to various people, some of whom, as you say, are in Afghanistan.

13:02What do you think about the way that this has now been conveyed to individuals? It was emailed across to a large number of individuals. I think the email could have been better. There was actually a requirement on the Ministry of Defence to inform these individuals of what kind of data has been breached based on the correspondence that we've seen from our clients. The Ministry of Defence have not informed them. It's a very simple email they've sent, and they had all the information for over two years insofar as what information was breached. These individuals are people at the end of the day who have a right to know this.

13:37Right. And as far as you're concerned, this statement today by the Defence Secretary in the House of Commons, this is not the end of the matter. As we understand, no, because there are still people who are wishing to relocate here. Admittedly, they've also said that they are looking to bring people across as soon as possible. Again, going back to my earlier point, if there is no threat to life, why would you be looking to do that? And legally, what do you hope to achieve on behalf of these people? Essentially compensation for the damage that they've suffered as a result of this breach. So I'll give the listeners an example.

14:14We represent an individual who was very high up in the Afghan military, and he had three battalions under him who he was overseeing. And these were individuals who would assist the Ministry of Defence with night raids. When they had to go capture Taliban, sometimes they would kill them. He's essentially told me as a result of the work that he did, his battalion did, he does not feel safe ever returning to Afghanistan. And now he will have to look over his shoulder whilst in the United Kingdom, thinking if someone sympathetic to the cause of the Taliban find out who he is, they might want to bring harm to him or his family.

14:49This was, as he explained to me, not something he had to consider prior to the data breach. And how sympathetic do you think the courts will be to the case you were bringing. I believe there will be a level of sympathy here for the simple reason that these are individuals who assisted the Ministry of Defence when we needed their help. They stood up, they helped us. Adnan, thanks very much indeed. And you can get more on this story, including Deborah Haynes' analysis on the Sky News app. The Daily is back tomorrow.

15:29Thank you.