Rarely has an email created such danger — or carried so high a cost. When a British soldier pressed send three years ago, they unwittingly placed thousands of lives in danger and put the UK government on the hook for billions of pounds.
The soldier had accidentally leaked a vast database containing details of Afghan nationals who worked with the UK before the Taliban retook power in 2021. Fearing reprisal, they had applied online to seek sanctuary in Britain.
If the Taliban obtained the records, they would have confirmation that those on the list — former translators, intelligence analysts, special forces operatives and many others — had sided with a western power. They would also have key personal information to try to hunt them down.
The security breach, which first occurred on February 18, 2022 and was compounded by a second email that the same soldier sent four days later, was of such enormity that it prompted ministers to institute a secret scheme to relocate tens of thousands of people to the UK at a cost of billions of pounds.
Yet court documents show the Ministry of Defence knew nothing about the data breach for 18 months, until mysterious and menacing messages appeared on Facebook.
An anonymous Facebook user posted in a group with 1,300 members the personal details of 10 applicants to the UK’s Afghan Relocations and Assistance Policy (Arap). The user also threatened to reveal the complete list, with records of 25,000 individuals.
“I have received one database from ARAP it has (thousands) of records,” the person told the group, adding ominously: “I want to disclose it. What is your opinion?”
The fallout has preoccupied the highest levels of the British state for almost two years — all without public scrutiny thanks to an unparalleled “super-injunction” that kept the episode under wraps until Tuesday.
Ministers grappled with whether to attempt to evacuate thousands of Afghans without alerting the Taliban and risk what officials described as a fresh “immigration crisis” for the UK, or to leave those who had furthered British interests at risk of murder and torture due to mishandling of their highly sensitive data.
The dangers were spelt out in an email on August 15 2023 to then armed forces minister James Heappey and his Labour shadow Luke Pollard from an advocate for Arap applicants who was aware of the Facebook posts.
“Bone chilling”, Heappey was told by the individual, who would become known in private court proceedings as Person A. The Taliban may well now have a “kill list”, the message read. “If any of these families are murdered, the government will be liable.”
In the hours after they learned of the Facebook posts, a sense of crisis engulfed the top ranks at MoD headquarters in Whitehall.
Officials were all too aware that Afghans who had aided coalition forces or championed western values before the chaotic August 2021 withdrawal faced extrajudicial killings, arbitrary arrests and detentions.
Afghans who knew themselves to be at risk were living out a real-world “Jason Bourne film”, moving location regularly and varying their routines to avoid detection, according to person A.
Facebook took down the posts after four days. But, at any moment, the MoD database containing the personal details of 18,700 Arap applicants plus almost 6,000 family members could be disseminated more widely.
As well as making it easier for the Taliban to track down people it already suspected of collaborating with the UK, the list was also “almost certain” to contain names previously unknown to the Taliban, the MoD assessed.
Arap candidates had applied online and were required to submit evidence of work they had undertaken for the UK. The records included a broad range of information including contact details, family members and application status.
Most of those on the compromised database had been unsuccessful in petitioning to move. Although some were in other countries including Iran, Pakistan and Turkey, the majority remained in Afghanistan.
Officials believed that if the Taliban knew the records had been compromised, its members would be likely to succeed in obtaining the list.
An MoD “impact assessment” found that all individuals on the compromised dataset were at risk.
Among the first steps the government took was to ask the courts to order that the debacle be kept secret for a short period to allow protections to be put in place to help victims of the breach. Ben Wallace, then Conservative defence secretary, personally made the decision to apply for an injunction.
The High Court not only granted his request in September 2023 but took the additional step of issuing a super-injunction, meaning even the existence of the gag order could not be disclosed.
“Publication of information about the unauthorised data release increases the prospect of the Taleban becoming aware of the data and accessing it,” Nina Cope, a senior MoD official told the court in one of the first statements made to the court, on August 29 2023.
The threat to those on the list was “grave”, Deana Rouse, another leading MoD official, said in a follow-up witness statement that October. If identified to the Taliban, she said, they were at risk of death, torture or intimidation, she wrote.
It was also “almost certain” that wider family members of those on the list would also be targeted. In total, officials estimated, the lives of as many as 100,000 people had been endangered by the security lapse.
Some individuals on the list soon received a warning from the UK government: the handful of Arap applicants whose details had been published on Facebook, as well as a larger group who had fled to Pakistan.
UK government officials in Islamabad were told of the Facebook posts by an activist helping Arap applicants — referred to in court proceedings as Person B — who had challenged the anonymous poster about whether the data was real. The poster had replied by sending Person B their own “personal information”, apparently extracted from the database.
After learning of the posts from Person B, UK officials in Pakistan sent WhatsApp messages to about 1,800 Arap applicants in the country, telling them their data might have been compromised and advising them not to respond to messages from people claiming to be from the UK government.
But the vast majority of those on the list received no such alert.
Whitehall decided to keep them in the dark in the belief that publicising the incident further would increase the risk to the very people such a notification would be seeking to protect.
It also kept the British public and UK parliament in the dark as officials instituted an extraordinary and expensive solution to the problem.
In late 2023, Rishi Sunak’s Conservative government was trailing far behind in opinion polls and a punishing general election loomed in the coming year, with immigration one of the hot-button policy issues. Now, his government began creating a secret immigration scheme for Afghans on the compromised database.
The “domestic and economic affairs committee” of the cabinet, a grouping of senior frontbenchers that included former deputy prime minister Oliver Dowden, decided on November 16 to evacuate a “targeted cohort” of those deemed to be at greatest risk.
This was limited to about 1,000 individuals, including family members of those on the list, known as “Cohort 1”. To be eligible, the Afghan nationals had to be both “high profile” and have “confirmed links” with the UK government.
The evacuation scheme was called the Afghan Response Route (ARR).
The fate of the vast majority of those named in the dataset hung in the balance, however. Ministers debated for months over how many to move and what to do about everyone left behind.
Officials presented a range of possibilities, ranging from the mass relocation of tens of thousands of people to asking allied countries, including the US, to accept more Afghans who wanted to leave.
“Diplomatic engagement” with the Taliban was also discussed — as was “doing nothing” for those stuck in Afghanistan, before being ruled out, according to Natalie Moore, a senior official at the MoD, in a March 2024 statement.
The options included allowing everyone on the database to emigrate to the UK, which would have the advantage of “signalling” the government was “taking responsibility and acting to mitigate threat to life”, according to a paper officials prepared in October 2023.
Providing refuge to all those affected would also reduce the risk that foreign nationals who co-operated with the British military in the future would be “reluctant” to do so, the paper said.
But the colossal scale of such resettlements presented daunting logistical hurdles. The options paper highlighted “limitations on the capacity of public services, such as healthcare and schooling, associated with such a large scale arrival”.
Officials still assessed in December 2023 that relocation might be required for tens of thousands of people. Grant Shapps, who had succeeded Wallace as defence secretary, wrote in a briefing paper for a cabinet committee in January 2024 that he recommended “a significant increase in the number of eligible individuals”.
By March 2024, ministers had decided to leave most of the 100,000 people who could be at risk to their fates in Afghanistan. They viewed it as impractical to move them all. Even so, significant public funds were needed to resettle the successful applicants.
“Upon my arrival at the Treasury three weeks ago, it became clear that there were things I didn’t know,” Rachel Reeves told the House of Commons in July 2024 in one of her first speeches as chancellor.
Labour had trounced the Tories at the general election that month. Instead of striking an optimistic beat, the new government struck a mournful tone of shock at the condition of the British state it inherited.
Reeves claimed to have discovered a £22bn fiscal “black hole”, contending that UK government departments’ true spending commitments were significantly higher than had been disclosed. She highlighted public sector pay and a spending overshoot on asylum and illegal migration.
In a private memo the same month, Treasury chief secretary Darren Jones wrote to cabinet colleagues that the issue of Afghan relocations was “hanging over from the previous Government which may have adverse consequences for value for money for taxpayers”.
He blamed fragmentation across schemes and insufficient accommodation for “disproportionately contributing to pressures on government spending”.
Even before the MoD learned that the database was compromised, the UK was struggling to accommodate more than 21,000 Afghans wanting to resettle, often using costly “bridging hotels” as a stop-gap measure.
Unexpected new arrivals risked overwhelming an already strained immigration system and further intensifying political tensions, including with local authorities that resented having migrants placed in their areas.
Afghans who had fled to the UK were among “the most vulnerable in society across (personal) finance, language and health and disability”, defence secretary John Healey said in an October 2024 memo to the cabinet’s home and economic affairs committee.
The sub-committee includes chancellor Reeves and deputy prime minister Angela Rayner. Large average household sizes meanwhile made it “particularly challenging and costly” to house them, Healey said.
Decisions on how many people to move were being taken without parliamentary or public scrutiny, at a time when migration was a dominant and politically charged topic of debate in Westminster.
Far-right, anti-immigration riots had taken place across the UK earlier that summer. Healey noted in his memo that several of the “disorder hotspots” had large numbers of “Afghan resettlement arrivals”, as he raised the issue of “community cohesion” in relation to the government’s relocation programme.
He also discussed how to “maintain control of the narrative” with a statement to parliament and a “robust public comms strategy” that disclosed the “scale (but not the cause) of the challenge” of resettling Afghans in Britain.
Alongside protecting national security and mitigating the threat to life of the victims of the data breach, “political and reputational considerations” had been another key factor informing the government’s response since autumn 2023, Healey said in the paper.
He suggested new mechanisms — including via legislation — might be required to force resistant local authorities to accept relocated Afghans, as he warned that 10 per cent of such arrivals were forecast to enter the “homelessness system” under the government’s plan.
Downing Street has been alive to the political threat that Labour faces from Nigel Farage’s populist right-wing Reform party, which promises to take a hard line on migration and refugees.
The government’s misgivings about the Afghan relocations continued to increase and in January 2025 Healey commissioned retired civil servant Paul Rimmer, a former deputy chief of Defence Intelligence, to review the threat picture in Afghanistan. It was the first step in a wider move to unwind the secret Afghan resettlements policy.
After arguing for almost two years in court that tens of thousands of lives were at risk, the government made an abrupt turn in June as the High Court again prepared to reconsider the super-injunction.
The Whitehall review by Rimmer concluded that “early concern about the extent of Taleban intent to target (certain individuals) has diminished”.
While it acknowledged that “killings are undoubtedly still occurring” in Afghanistan, “it appears unlikely that merely being on the dataset would be grounds for targeting”.
The Taliban had already gained access to other records since seizing power, making the confidential MoD database “unlikely” to be “the single, or definitive, piece of information” that would facilitate reprisals.
The review, whose findings were presented to ministers last month, concluded that the ARR — the secret scheme set up for victims of the data breach — was a “disproportionate” response.
The government this month closed its public schemes to relocate Afghans to new applicants and Healey is due on Tuesday to announce the closure of the ARR.
The MoD said on Monday that about 6,900 Afghans had either arrived or were due to come to the UK as a direct result of the data breach under the ARR scheme.
The government now says the cost of ARR will be £850mn, of which £400mn has been committed for people who have already arrived under the scheme.
It has declined to provide overall costings for the fallout of the data breach as a whole, including an extra 1,000 people who were made eligible under the Arap scheme because of the leak.
But the MoD claims it has saved at least £1.2bn on the projected cost of relocations triggered by the data leak as a result of closing ARR and Arap to new applicants this month.
The alleged savings derive from preventing an additional 9,500 Afghans resettling in the UK who would have otherwise been eligible due to the breach, according to officials.
For those Afghans and others on the list who remain stuck in the country, the risks remain considerable.
Whitehall has been stepping up preparations in recent weeks for what it has termed the “break glass” event — the moment, which finally arrived on Tuesday, when the data breach became public knowledge.
The UK government has planned to launch an “Information Service Centre” for people who fear they may have been on the exposed dataset.
A paper civil servants prepared for ministers last month (June) said the telephone service would be “very limited”, with calls from Afghanistan “discouraged”. Instead, potential victims will be directed towards an “online self-checker”.
Ministers have discussed whether to offer data breach victims compensation to “repair the reputational damage” done to the UK government and “mitigate against the risk of future litigation”, as officials put it in an October 2023 briefing paper.
One option considered in November 2023 but rejected suggested payments totalling between £120mn and £350mn, a sum worth potentially as little as £1,277 per victim at the low end.
This month, armed forces minister Luke Pollard said the government would pay up to £1.6mn in compensation to hundreds of Afghans affected by a separate 2021 data breach. A one-off payment of up to £4,000 would be offered to each verified claimant, he said.
The true impact of the larger leak is unlikely to become clear for several weeks. If no evidence emerges that Afghan nationals on the dataset are being targeted, the UK government may have grounds to argue that its response has mitigated what otherwise might have escalated into a full-blown emergency.
With thousands of people relocated and the secret immigration route now closed, ministers will maintain they have sought to achieve a prudent balance between protecting those at greatest risk of reprisals while avoiding the even more exorbitant costs to the Treasury of a broader evacuation.
Intense scrutiny awaits the MoD over the leak. An inescapable question will remain: how could such a costly, and potentially deadly, mistake have happened?
