The Commons’ Defence Select Committee has published its findings into the Afghan resettlement and data breach which led to the secret resettlement of 7,355 people in the UK. The total cost for that: £850 million…
The committee found:
- The MoD has refused to verify that £850 million figure, and journalists who saw the closed court material say the MOD at times described the response in terms of around £7 billion, far above what was later said publicly about the ARR. It is unknown whether it was referring to the wider costs of resettlement…
- No individual was held personally accountable.
- Neither the Defence Committee nor the Intelligence and Security Committee chairmen were briefed. The judge described parliamentary scrutiny as “completely shut down” in a “security vacuum.”
- The breached Excel file, apparently containing 150 records, actually held detailed data on more than 18,500 applications in hidden rows. The sender did not know spreadsheets could hide data.
- Information Commissioner Office guidance on the data breach risk dated back to 2015. Government guidance requiring checks for hidden tabs, columns and rows was published in June 2021. The MOD had its own guidance.
- The MoD should never have been involved in handling immigration.
- Risk registers show the MOD never identified the risk of a mass data loss event from spreadsheet use at all.
- The ICO had fined the MOD £350,000 for a 2021 incident in which 245 applicants’ email addresses were exposed and ben Wallace told the House in November 2021 that “significant remedial actions” had been taken. A further 18 personal data incidents were reported within DARR between February 2022 and November 2023.
The committee has concluded that the breach and subsequent secret resettlement were “foreseeable.” Did someone mention the tepid bath of managed decline?
