British spies and SAS named in Afghan data breach

Hind Al Soulia - Riyadh - LONDON — The identities of more than 100 British officials, including members of the special forces and MI6, were compromised in a data breach that also put thousands of Afghans at risk of reprisal, it can be reported.

The latest fallout from the breach was kept secret by an injunction until Thursday, when the order was lifted in part by a High Court judge.

That allowed media organisations to reveal that detailed case notes in the database contained secret personal data of special forces and spies.

The government had already admitted on Tuesday the data of nearly 19,000 Afghans who had worked with the British during the 20-year war in Afghanistan and had applied to resettle in the UK had been inadvertently leaked.

Many were judged to be at risk of serious harm or even death as the Taliban sought retribution against those who had worked with the British government during the conflict.

This was part of the reason the information was protected by a so-called "super-injunction" - a kind of gagging order that prevents the reporting of even the existence of the injunction.

The data breach occurred in February 2022 but was not discovered by the government until August 2023, when someone in Afghanistan who had obtained the data posted part of it on Facebook and indicated he could release the rest.

The BBC revealed on Wednesday that the Ministry of Defence (MoD) had offered to expedite a review of the individual's application and brought him to the country after he posted the data - a sequence of events that government sources said was "essentially blackmail".

The MoD declined to comment on the actions of the individual but said that "anyone who comes to the UK under any Afghan relocation schemes" must go through "robust security checks in order to gain entry".

The discovery of the breach in 2023 forced the government to covertly set up the Afghanistan Response Route (ARR) - a resettlement scheme for those affected, who were not told about the breach despite the risk to their security.

The scheme has already allowed 4,500 Afghans and family members to move to the UK and a further 2,400 people are expected, at an estimated cost of £850m.

The accidental leak was the result of someone working at UK Special Forces headquarters in London inadvertently emailing more than 30,000 resettlement applications to an individual outside of government, thinking that he was sending data on just 150 people.

After the lifting of the super-injunction on Tuesday, a secondary injunction had prevented the revelations about special forces and security services personal being compromised.

But that was also lifted on Thursday that barristers representing both the MoD and a group of media organisations reached a compromise that meant journalists could report the additional facts.

Defence Secretary John Healey told Parliament on Tuesday that the breach was a "serious departmental error" and acknowledged that it was "just one of many data losses" relating to the Afghan relocation schemes.

The shadow defence secretary, James Cartlidge, apologised on behalf of the former Conservative government, which was in power when the leak was discovered.

The MoD has refused to say how many people in Afghanistan may have been harmed as a result of the data breach. The Taliban government said on Thursday that it had not arrested or monitored Afghans affected by the leak.

But relatives of Afghans named in the leak told the BBC that they fear for their family still in the country, with one saying efforts by the Taliban to find their named relative intensified following the leak.

An MoD spokesperson said: "It's longstanding policy of successive governments to not comment on special forces.

"We take the security of our personnel very seriously, particularly of those in sensitive positions, and always have appropriate measures in place to protect their security." — BBC