Data Breach: ARAP Applicants in Afghanistan

(Urgent Question): To ask the Secretary of State for Defence if he will make a statement on the data breach exposing ARAP applicants in Afghanistan.

I understand the strength of feeling on this subject, and this question gives me the opportunity to set out where we are with the Afghan relocations and assistance policy and yesterday’s data breach. I would like to place it on record that I had offered a statement for when we return from conference recess, as the investigation I have ordered will be able to report fully by then, and I still expect to make those details available.

As you know, Mr Speaker, I have taken the obligation we have to the Afghan personnel who have supported us throughout extremely seriously. Despite this disappointing event, we should pay tribute to the armed forces for Operation Pitting and the that we have managed to evacuate 8,800 people and families eligible under the ARAP scheme since April, in addition to the 1,400 who had already been relocated prior to that date. However, worryingly for me, over the last few weeks lapses from the highest standards in the management of those people remaining in Afghanistan have been brought to my attention by both hon. Members of this House and others. For that reason Ministers raised concerns both last week and yesterday, and sought assurances that these problems would be rectified. Those assurances were given. However, it was brought to my attention at 2000 hours last night that there had been a significant data breach. To say I was angered by this is an understatement and I immediately directed an investigation to take place.

Initial findings show that an email was sent at 17.44 hours as part of the “weekly contact” we maintain with ARAP currently remaining in Afghanistan. This had been copied to all the 245 applicants, rather than blind copying them. The email was immediately recalled on identification of the breach and then a subsequent email was sent advising people to delete the email and change their addresses, which many of them have done.

So far, one individual has been suspended pending the outcome of the investigation and processes for data handling and correspondence processing have already been changed. I have directed that extensive steps are to be taken to quantify the potential increased risk to individuals in order to take further steps to protect them. The Information Commissioner has been notified and we will co-operate fully with any of its own enquiries.

Thank you for granting this urgent question, Mr Speaker.

There is rightly cross-party concern about this very grave security breach, with names, email addresses and in some cases photographs of 250 Afghan ARAP applicants, all still in Afghanistan and in danger, shared in a mass mailing. This needlessly puts their lives at risk.

I welcome the Defence Secretary’s presence here this morning and welcome his apology, inquiry and commitment to a statement when the House returns after its short recess, but it is not the apology but the action which matters most now. These Afghan interpreters worked alongside our British forces and the Government rightly pledged to protect them. Ministers must make good on those promises now, so can the Defence Secretary answer the following questions: when will he complete that assessment of the increased risk these individuals now face as a result of the data breach; what action is he taking urgently to evacuate them and their families; and why on earth is the MOD mass emailing people who face life-or-death situations?

I know from ARAP evacuees in my constituency who have separated family members still in hiding in Afghanistan that their social media has been blocked. Is there any evidence of email surveillance or interference from the Taliban? How will the MOD remain in contact with these people if they follow the advice to change their email addresses?

Yesterday, Ministers confirmed that 7,900 applications have been made to the ARAP scheme, with 900 so far approved since the end of August. Have there been any data breaches linked to other ARAP applicants?

This is the third known serious defence data breach in as many months. Each time, we have the same response: public apology, internal inquiry, then silence—no report on the inquiry results, no confirmation of action taken to tighten up the system. The Secretary of State rightly started by paying tribute to all involved in Operation Pitting. Our forces were totally professional in that extraordinary evacuation from Kabul, but they must be asking now: how can we trust our back-up at the MOD?

The right hon. Member makes some points that I would say are deservedly landed, and I hear what he says. First, yes, we mass email individuals, but we also email individually. This was a weekly catch-up email that was sent to over 250 people to make sure that they were kept in touch, because, quite rightly, as many Members have pointed out on a number of occasions, they need to be engaged and know that there is someone out there keeping it going and trying to get them through the country.

This was a mass email. It did not contain individuals’ home addresses or anything. The photo profiles that the right hon. Member mentioned were ones that were in profiles of the email addresses as opposed to the individuals’ names. Indeed, having looked at all the email addresses, I can say that the vast majority were not specific names, necessarily; they were email addresses rather than particular names. However, that does not change the fundamental impact that the email could have had and could still have.

I have asked Defence Intelligence to go through all the cases and assess the risk to the individuals. That will be ongoing. I can of course get an update, and I will be happy to share with the right hon. Member where we are with those updates on intelligence. I can certainly also give a Privy Council briefing to both him and, indeed, the Scottish National party if it wishes, on the greater security situation on the ground in Afghanistan.

This group was not the wider cohort that the right hon. Member referred to—the people who have applied since ARAP. To put it in perspective, some 68,000 have applied for ARAP. Obviously, when that number is scrubbed and worked through, it reduces significantly, but that is the number of emails that have been sitting in email boxes and have been worked through—and are being worked through—to try to make sure that we find the right people with the right criteria and then, obviously, communicate with them.

I welcome the statement. I hope that the necessary oversight protocols are now in place to make sure that this does not happen again. The Taliban have not changed. They seek to exact revenge on anyone who worked for NATO. We must get these interpreters out or they will be hunted and killed. If the usual methods, via the ARAP scheme, are not available, may I invite the Secretary of State to take advantage of the chaos in the country to find clandestine means of leading these people to safety?

My right hon. Friend will know that I cannot talk about the broader means, but all means will be explored.

I thank the Secretary of State for his apology. I do not doubt the sincerity of it, and I do not doubt for a second the anger that he will have felt when he got the news of this unacceptable and quite dangerous leak yesterday. However, I have a few questions to follow on from those asked by the shadow Secretary of State, the right hon. Member for Wentworth and Dearne (John Healey), and the Chair of the Select Committee on Defence, the right hon. Member for Bournemouth East (Mr Ellwood).

Can the Secretary of State confirm whether the Taliban have the capability to monitor these people’s emails? I do not want to know if they are monitoring them— I suspect that he would not tell the House even if he did know—but do they have the capability to do so? How long will the investigation take? Who will carry out the investigation? Is the person who has been suspended an employee of the Ministry of Defence or of the Foreign, Commonwealth and Development Office?

Will the Secretary of State outline in a bit more detail, if he is able to, the additional resources that he intends to commit to ensure that people are not exposed to any more danger than they already are as a result of the leak? I understand entirely the point that he makes about using mass email as a communications method, but who signed off on that as an okay way to make that communication?

The shadow Secretary of State is right that when these breaches happen, we get these apologies and then there tends to be silence, so more broadly, what is being done to arrest this worrying trend of data leaks from the Secretary of State’s Department? Is he going to order a broader investigation? I think the House would welcome that.

I am grateful to the hon. Member for his series of questions. First, the investigation will be carried out by Admiral Sir Ben Key, the commander of joint operations at PJHQ—permanent joint headquarters—who also led the planning and the evacuation from Kabul.

On data leaks, the hon. Member is right that these are a concern. The previous leak obviously involved a senior official who deliberately broke the regulation, in so far as he took something out the Department. If the regulation had been followed, that would not have been the case. However, although I cannot say too much, I have instigated changes to improve information security within the Department, and I am happy to brief the hon. Member on that.

The “Manual of Protective Security”, the modern rules that govern information security, is, I believe, fit for purpose; it is really the training and the adherence to it that must be improved. I am graduate of something called the classified documents handling course from the early ’90s—I think I am the only saddo who actually knows what type of lock should be on what type of cabinet that links to different types of security classifications. Nevertheless, information security is not something that western Governments are good at, which is why our adversaries seem to be. We have to improve it, and we have to stand by it.

The Taliban, or obviously any Government that control a country, have control of the telephone network. I cannot say too much about what they can and cannot do; suffice it to say that the method we used to communicate with those people is a way of minimising that risk. One of the reasons we involve emails rather than telephone calls is to try to do that, which is important.

On resource, right from the beginning of this process, way back in August, or in July, I was very clear with my senior military commanders and civil servants that they would have whatever resource they needed to process emails and carry people out, for example. We will fly these people back from third countries out of the MOD budget. It is my view that we should continue to stand by them, including using married quarters, for example, in military establishments to look after them if they cannot get places elsewhere. There has not been a resource problem; the challenge is whether people have been asking for the resource within the system to do this.

I am delighted to hear from my right hon. Friend just now that Admiral Key has got a knighthood. There has not been one earned by anyone better for many years.

The challenge of this event is not the accident, the mistake, that we can see happened. I think we all sympathise with the Ministry of Defence and indeed the Secretary of State; accidents do happen. The challenge is that there are people still there and that the co-ordination for getting people out is still complicated. Will my right hon. Friend commit to working to get a single point of contact for all those in Afghanistan who are seeking to leave? The system whereby some have to apply to the MOD, and others to the Foreign Office or through the Home Office, is excessively complicated and is leading to obstacles, including on at least four different occasions that I can speak of. People are stuck in Lashkar Gah, Kabul or Mazar-e-Sharif, trying to get out, but they are still not getting the smooth transfer that we need.

I am grateful to my hon. Friend, who makes a really important point. I would ask colleagues to have some understanding of this. The MOD, which is of course charged with defending the nation, has in very short order had to turn part of itself over to processing visas and doing the job that traditionally we would have done in the Home Office. We have taken that on ourselves because of the pace, urgency and, in the earlier time, danger.

As I have said, 68,000 emails arrived, many of which are speculative, concerning refugee status, so not even for the Foreign Office. It is a very big enterprise to take on, which is why I was determined to give all that resource. However, I would ask colleagues to remember that, at the same time, we are doing that in an Afghanistan that we have no control over. We are doing it in what for many is a dangerous environment, with the Taliban clearly in some cases actively seeking out people that they wish to deal with—murder, or whatever they are up to. At the same time, we are dealing with an ever-moving situation on the ground, and not everyone who comes out communicates back.

When I look at the spread of where people have gone to third countries, we find people in Australia, people who got on the next flight, people in other parts of Europe and people in the United States. The United States brought some people back to Germany who immediately claimed asylum to the United Kingdom. We find, when we contact people, that some are saying, “Thank you very much, but I am quite happy to stay where I am in sunny California or Australia or somewhere like that.” Some have been here for a very long period of time and have not engaged.

The next stage, which I commissioned today, is, quite rightly, a full and detailed survey of the people we have brought back to know even more about them. Obviously, there are data protection issues we have to cross, but it is really important that we get to the bottom of that.

This is another in a long line of serious errors regarding the Government’s Afghan relocations that will cost lives. Can the Secretary of State please advise us how many of the 260 interpreters the Government have been unable to make direct contact with since the breach?

Of the 260, there were eight we have not had comms with since the end of Operation Pitting. We have continued to try. The data breach happened at about 5.30 yesterday afternoon and we have engaged with as many of them as possible. I can give the House a rolling update of how many of the 260 have responded. A number have already changed their email address. There is a link in the email that allows them to communicate that securely, but I will keep the House updated on exactly the number as we go. The other point is that the numbers are changing every day, either because people crop up and say, “Actually, I’m in London or Australia,” or because of what is happening on the ground and they make it across the border. Often, when they are travelling, they are not in communication.

Between 2001 and 2014, UK forces employed 2,850 interpreters. From 2014, they were on sub-contracts, so we are looking at 300 or 400 more. The relocation programme up till April this year relocated 440 interpreters. I can account for about 99 interpreters who were rescued during Operation Pitting. What assessment has the Secretary of State made of how many interpreters—not families, but interpreters—the MOD has been able to rescue from Afghanistan? It jars slightly with numbers in the low hundreds that he is presenting to the House today.

I am listening to my hon. Friend. Where I take issue with him is that it is not 99. Some 650 principals, not families, came out through Operation Pitting. There were: 850 under categories 1 and 2; 836 under category 4; and 50 under other categories. Some 650 of those were interpreters either through contractors or directly employed, or supporting in the contractor role.

The Secretary of State’s anger at hearing the news is not in any way misplaced, and I thank him for coming to the Chamber and making his statement. It seems to me that there is a wealth of difference between a mass email and individual one-to-one contact. Can I seek an assurance that every one of the people we know about is in proper one-to-one contact, either by text or other means, with somebody in the Ministry of Defence or the FCDO who can mentor them, talk to them and help them face this huge problem?

I cannot give the hon. Gentleman the assurance that they have all replied, but we have absolutely taken a view that they should be case managed, on top of the weekly update. To do that, we find it is best through email because of the security issues. Earlier on I was pushing for voice, but actually—I made the point about the Taliban being in control of the telephone network—we are probably better doing it through other means, so it is important that we do that. He is absolutely right. Only today, I pressed on unlimited resource. How many people have we got working on this? Why do we not have more? We have, in total, 50 people dealing with the ARAP scheme. One of our biggest challenges in the past two weeks was clearing or separating away the 68,000 to focus on the people who come within the criteria that we can put the resource on to. The hon. Gentleman’s ambition and my ambition are the same: we are there, but it is often in slow time because of the delay in the response to our emails.

Internet banking constantly asks customers if they are sure they wish to proceed. Surely it would not be too difficult to have an automated reminder or check, if it looks as if an email of a sensitive nature is going to be sent to multiple recipients? In that connection, I have here a printed list of 70 former long-term employees on British contracts in Afghanistan. I propose to hand it to the excellent new Parliamentary Private Secretaries to the Defence ministerial team. When I am informed of a secure address to which I can send it electronically, I will be happy to do so.