Afghanistan Response Route (ARR)

Status / emerging findings

• 49 data breaches occurred at the unit handling Afghan applications by August 2025; seven were serious enough to report to the Information Commissioner's Office
• The Department knew of data management risks when setting up ARAP in April 2021 but failed to implement adequate safeguards before the February 2022 breach exposed many thousands of Afghans to Taliban violence
• A September 2023 High Court super-injunction silenced media reporting of the breach itself and the injunction's existence; the Department withheld this from Parliament, blocking effective scrutiny of ARR spending
• The Department made only targeted improvements after three autumn 2021 breaches, then continued experiencing breaches including the major February 2022 incident
• Resettlement of affected individuals will take years; costs to the public purse remain substantial and incompletely accounted for

Why it matters

The Ministry of Defence's failure to protect Afghans' data—and then to inform Parliament—raises fundamental questions about government accountability, national security vetting, and whether public money spent on damage control and resettlement was properly scrutinised.

Tone arc

Report opened critical and remained unsparing: the Committee framed systemic negligence ('fell below standards the public and Parliament should expect'), escalated to constitutional concern over the super-injunction blocking parliamentary oversight, and documented 49 breaches as evidence of persistent failure rather than isolated incident.

Key witnesses

Ministry of Defence (Department under scrutiny), Comptroller and Auditor General (C&AG), Information Commissioner's Office (ICO), HM Treasury, High Court (super-injunction grantor)