As is well known, the British civil service has very many employees, and a significant proportion of them are also members of the Civil Service Sports & Social Club. These active, outgoing types are well used to receiving correspondence about forthcoming events, matches, and the governance of their club. But at some point in August 2023, an email was sent out to them containing officially sensitive data about a number of Afghan nationals seeking sanctuary in the UK after the fall of the Kabul government two years earlier, when the Allied attempt to hold back the Taliban finally collapsed.
Unfortunately, as The Independent reveals, it is far from the only egregious breach of confidentiality that has potentially put lives at risk in a tragicomic manner. Another unintended leak came from an official leaving open their laptop on a train. There have also been examples of WhatsApp being used to share personal data insecurely, and of flight manifests being revealed that include the details of Afghans arriving in the UK. All are serious matters, and some may have put lives at risk.
In the most serious case, spreadsheets containing the personal and contact details of at least 18,700 Afghans who applied to come to the UK under the Arap (Afghan Relocations and Assistance Policy) and via a predecessor scheme were inadvertently sent to individuals outside of official systems – with potentially fatal consequences; one piece of research suggests that 49 may have lost their lives as a consequence.
That is why the story – along with the subsequent decision to grant asylum to these Afghans irrespective of the merits of individual claims – was covered up by the authorities for years. Persistent lobbying and legal action by The Independent eventually succeeded in bringing the whole scandal into the public realm, to widespread dismay.
But the more that is uncovered about this scandal, the worse it gets – and the more questions need to be asked about the way in which British officialdom deals with data. It sounds like a dry debate, but, as the Afghan saga proves, it can be a matter of life and death.
It is particularly poignant, and shaming, that so many Afghans who fought alongside American and British forces – including in the Afghan version of the SAS – should have been so cruelly denied asylum, or betrayed by having their details mistakenly leaked to potential enemies. The Independent is proud to have campaigned to have these brave ex-soldiers rescued from near-certain death and torture at the hands of the Taliban, but also frustrated, as are so many, that the process has been both flawed and chaotic.
The permanent secretary at the Ministry of Defence has recently said he will leave his post in the aftermath of the scandal – but it’s not clear that this will be sufficient to force the change of culture that is so obviously needed across the civil service. One glaring aspect of the largest data leak is that a civilian officer in the Ministry of Defence didn’t understand how tabs can be concealed in an Excel spreadsheet.
Of course, the risks around data security have escalated in the digital age. This was apparent almost 20 years ago, when two computer disks – at a time when physical storage was still necessary – were sent unencrypted and lost in transit between the HMRC centre in Washington, Tyneside, and the National Audit Office in London. The disks contained the personal data of all 10 million recipients of child benefit, plus 15 million children, including their names, addresses, dates of birth, national insurance numbers and, in some cases, bank details. It seems this particular trove was lost forever and was never set to nefarious purposes. But what ought to have been no end of a lesson back in 2007 was also swiftly forgotten.
Nowadays, cyberattacks are routine across the public and private sectors, causing enormous economic damage. The recent attack on Jaguar Land Rover, for example, is independently estimated to have cost £2bn. If true, that makes it the costliest in UK history – a measurable hit.
One obvious conclusion that can be drawn from the succession of data blunders and cyberattacks in recent years is that Labour’s proposed digital ID card scheme will need to be so well designed as to be practically impossible to hack, and immune to the risks arising from data being “left on a bus” in some way. Otherwise, the consequences of such an event would be too terrible to contemplate – as they may well have proved already for some Afghan allies of the West.
