Defence Committee examines Afghan data breach, says MOD ‘should never have been left to run immigration casework schemes’

In a significant report published last week, the House of Commons Defence Committee finds that hundreds of Afghans who worked alongside UK forces were wrongly refused relocation under the Afghan Relocations and Assistance Policy (ARAP), leaving many facing years of danger.

You can read the report online here or download it here.

The Committee's inquiry was tasked with examining the Ministry of Defence's (MOD's) data breach that exposed the details of thousands of ARAP applications and the subsequent resettlement schemes, but as the Chair of the Defence Committee explained, it "became about the real lives affected by delay, secrecy and flawed decision-making".

The inquiry concludes that the data breach was caused by poor operating practices at the MOD and was not just an isolated mistake.

The report states: "The breach was not simply an individual mistake, but a foreseeable systemic failure. It arose from the combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability. The pressures of the fall of Kabul in 2021 help to explain how these weaknesses developed; they do not excuse their continuation into 2022. The MOD handled sensitive immigration casework using tools and controls not appropriate for a life-endangering dataset at any scale. Controls have improved since, but the episode shows the risk of taking on unfamiliar responsibilities without fit-for-purpose systems, assurance and clear accountability."

Tan Dhesi, the Chair of the Defence Committee, added: "The Ministry of Defence should stick to defence - it should never have been left to run immigration casework schemes."

Following the breach, a secret Afghan Response Route was created to relocate Afghans at risk to the UK.

Serious flaws are identified in the operation of this scheme, with the Committee noting: "The response to the breach exposed a serious weakness in cross-government governance. Once relocation became the principal means of mitigation, the MOD carried the strongest responsibility and incentive to act, but many of the levers needed to deliver the response—accommodation, immigration processing, local authority capacity, funding and integration support—sat elsewhere. Under conditions of secrecy, that mismatch was harder to challenge externally. The financial consequences of the breach were shaped not only by the original loss of data, but by policy choices made under the injunction about cohort size, accommodation, pace of implementation and delivery model. Decisions about risk became decisions about housing, local capacity, departmental budgets and long-term support. The result was an incremental response whose pace, scope and cost were shaped by misaligned responsibilities, cross-government constraints and limited democratic, audit or public scrutiny."

The report also identifies serious failings in the handling of ARAP applications from former members of Afghan specialist units, known as the Triples. A review overturned 884 previous refusals, leading the Committee to conclude that "earlier determinations that applicants were not eligible for relocation could not be treated as reliable."

It adds: "The government therefore has a special responsibility to former Triples whose applications were wrongly refused and who, because of those failings and subsequent delay, may have spent additional years in hiding or been left to make their own way to a third country."

Looking ahead, the Committee expresses concern about the Government's current requirement for eligible Afghans to self-move to a third country before completing UK entry clearance processes. It notes: "The government has taken important corrective steps since 2024. It has created more formal programme governance for Afghan resettlement, increased decision-making capacity, published performance information and committed to clearing the remaining ARAP caseload. Those improvements are welcome. But the government's new policy announced in April 2026 of requiring eligible Afghans to make their own way to a third country within twelve months shifts risk and cost onto people who may have spent years in hiding, may be destitute, and may have no safe, lawful or affordable route out of Afghanistan. Unless the government identifies and supports those unable to self-move, its deadline risks becoming in practice an exclusion mechanism for eligible people who are too poor, too vulnerable or too exposed to travel independently."

The Committee recommends that, when responding to the report, the Government should publish a clear policy setting out how it will assist eligible Afghans who cannot safely, lawfully or affordably travel to a third country. It says the policy should establish criteria for identifying such cases and ensure that the 12-month self-move deadline does not prevent eligible individuals from accessing relocation simply because they are unable to travel independently. The Committee concludes that, without such a policy, the Government cannot demonstrate that it is meeting its obligations to all eligible Afghans.