Data Breach: ARAP Applicants in Afghanistan

John Healey Excerpts

Tuesday 21st September 2021 Commons Chamber

[John Healey (Wentworth and Dearne) (Lab)]

(Urgent Question): To ask the Secretary of State for Defence if he will make a statement on the data breach exposing ARAP applicants in Afghanistan.

[The Secretary of State for Defence (Mr Ben Wallace)]

I understand the strength of feeling on this subject, and this question gives me the opportunity to set out where we are with the Afghan relocations and assistance policy and yesterday’s data breach. I would like to place it on record that I had offered a statement for when we return from conference recess, as the investigation I have ordered will be able to report fully by then, and I still expect to make those details available.

As you know, Mr Speaker, I have taken the obligation we have to the Afghan personnel who have supported us throughout extremely seriously. Despite this disappointing event, we should pay tribute to the armed forces for Operation Pitting and the that we have managed to evacuate 8,800 people and families eligible under the ARAP scheme since April, in addition to the 1,400 who had already been relocated prior to that date. However, worryingly for me, over the last few weeks lapses from the highest standards in the management of those people remaining in Afghanistan have been brought to my attention by both hon. Members of this House and others. For that reason Ministers raised concerns both last week and yesterday, and sought assurances that these problems would be rectified. Those assurances were given. However, it was brought to my attention at 2000 hours last night that there had been a significant data breach. To say I was angered by this is an understatement and I immediately directed an investigation to take place.

Initial findings show that an email was sent at 17.44 hours as part of the “weekly contact” we maintain with ARAP currently remaining in Afghanistan. This had been copied to all the 245 applicants, rather than blind copying them. The email was immediately recalled on identification of the breach and then a subsequent email was sent advising people to delete the email and change their addresses, which many of them have done.

So far, one individual has been suspended pending the outcome of the investigation and processes for data handling and correspondence processing have already been changed. I have directed that extensive steps are to be taken to quantify the potential increased risk to individuals in order to take further steps to protect them. The Information Commissioner has been notified and we will co-operate fully with any of its own enquiries.

I apologise to those Afghans affected by this data breach, and we are now working with them to provide security advice. As I speak, the Minister for the Armed Forces is in the region speaking to neighbouring countries to see what more we can do with both third country and in-country applicants. This is an unacceptable level of service that has let down the thousands of members of the armed forces and veterans, and on behalf of the Ministry of Defence I apologise.

I offer the reassurance that the scheme will continue to operate and bring people back to the United Kingdom for however many are eligible and however long it takes.

[John Healey]

Thank you for granting this urgent question, Mr Speaker.

There is rightly cross-party concern about this very grave security breach, with names, email addresses and in some cases photographs of 250 Afghan ARAP applicants, all still in Afghanistan and in danger, shared in a mass mailing. This needlessly puts their lives at risk.

I welcome the Defence Secretary’s presence here this morning and welcome his apology, inquiry and commitment to a statement when the House returns after its short recess, but it is not the apology but the action which matters most now. These Afghan interpreters worked alongside our British forces and the Government rightly pledged to protect them. Ministers must make good on those promises now, so can the Defence Secretary answer the following questions: when will he complete that assessment of the increased risk these individuals now face as a result of the data breach; what action is he taking urgently to evacuate them and their families; and why on earth is the MOD mass emailing people who face life-or-death situations?

I know from ARAP evacuees in my constituency who have separated family members still in hiding in Afghanistan that their social media has been blocked. Is there any evidence of email surveillance or interference from the Taliban? How will the MOD remain in contact with these people if they follow the advice to change their email addresses?

Yesterday, Ministers confirmed that 7,900 applications have been made to the ARAP scheme, with 900 so far approved since the end of August. Have there been any data breaches linked to other ARAP applicants?

This is the third known serious defence data breach in as many months. Each time, we have the same response: public apology, internal inquiry, then silence—no report on the inquiry results, no confirmation of action taken to tighten up the system. The Secretary of State rightly started by paying tribute to all involved in Operation Pitting. Our forces were totally professional in that extraordinary evacuation from Kabul, but they must be asking now: how can we trust our back-up at the MOD?

[Mr Wallace]

The right hon. Member makes some points that I would say are deservedly landed, and I hear what he says. First, yes, we mass email individuals, but we also email individually. This was a weekly catch-up email that was sent to over 250 people to make sure that they were kept in touch, because, quite rightly, as many Members have pointed out on a number of occasions, they need to be engaged and know that there is someone out there keeping it going and trying to get them through the country.

This was a mass email. It did not contain individuals’ home addresses or anything. The photo profiles that the right hon. Member mentioned were ones that were in profiles of the email addresses as opposed to the individuals’ names. Indeed, having looked at all the email addresses, I can say that the vast majority were not specific names, necessarily; they were email addresses rather than particular names. However, that does not change the fundamental impact that the email could have had and could still have.

I have asked Defence Intelligence to go through all the cases and assess the risk to the individuals. That will be ongoing. I can of course get an update, and I will be happy to share with the right hon. Member where we are with those updates on intelligence. I can certainly also give a Privy Council briefing to both him and, indeed, the Scottish National party if it wishes, on the greater security situation on the ground in Afghanistan.

This group was not the wider cohort that the right hon. Member referred to—the people who have applied since ARAP. To put it in perspective, some 68,000 have applied for ARAP. Obviously, when that number is scrubbed and worked through, it reduces significantly, but that is the number of emails that have been sitting in email boxes and have been worked through—and are being worked through—to try to make sure that we find the right people with the right criteria and then, obviously, communicate with them.

This matter relates only to the number of people who had been called forward under Op Pitting, had been security checked and were ready to go but either never made it to the Baron hotel or never made it on to a flight. That number started at 311, as hon. Members will remember. Of the 311, there are 260 principals left in Afghanistan—that is 1,232 people if we include their families—43 principals, or 163 pax in total, in third countries, and eight with whom we have still not been able to establish communications despite trying numerous times. That is the cohort that this relates to. We will do everything we can.

As far as getting those people out of the country, as I said, the Minister for the Armed Forces is now in one of the neighbouring countries and will continue to do that. I have spoken to my defence sections and offered to increase resource and to give reassurances to those third countries. The MOD funds the flying of those people back to the United Kingdom. We have already done so, and I will be happy to update the House as we go about how many people come out of the country.

Some of the other challenges, obviously, relate to security, and we have to have that balance in bringing people back who sometimes turn out, eventually, to have the wrong record; we want to protect the British public from that. But fundamentally, that is the cohort of people that these emails relate to.