Speeches by Williams.

“But if you are asking about others in the system, in the immediate investigations we did, we engaged with the Metropolitan police. There was no evidence of malicious intent or criminal wrongdoing. As I have already said, data breaches like this are often the case of well-intentioned individuals trying to do the right t…”

“The question of super-injunctions and parliamentary transparency, as I said previously—I stand by this—is unprecedented. Of course, there is a point about what level of knowledge and insight you need for effective scrutiny. It will be a matter for the Committee to take a view on whether, if we had read in only the Chai…”

“Our personal reflections on the lesson are about accepting that sometimes time does not allow that luxury. But, as far as possible, you want to be really clear about the outcomes that you are trying to achieve, and therefore really clear about the respective departmental responsibilities that need to be brought to bear…”

“Yes.”

“We got to a cross-Government SRO, albeit working out of the MOD, in spring of 2024. We have had a conversation about whether we could have got to that point either in the autumn of 2023 or at the end of 2021 or start of 2022. There may well have been some missed opportunities.”

“Yes. First, I think that would have helped from the start. Secondly, I think it would definitely have helped earlier after the data breach. With the best will in the world—and I am thinking about a range of departmental responsibilities—this was a deeply toxic issue.”

“And they will have had views about the capability of other bits of Government to do it.”

“Yes, I think so. In the end, you can have a nice, logical civil service official model of how Departments should work together under Cabinet Office co-ordination—and you need that underpinning—but you definitely also need the political will for it to happen.”

“To the specific question, I think there was a window of opportunity in late ’21 for us to take a different approach. Again—and we got there in the end, after the discovery of the data breach—do you reset the approach for dealing with that? There is some challenge over this period, in that the incentives and levers acro…”

“I think that plays to the second of our lessons about how you shift from a crisis response to a sustainable programme. Part of the challenge here is that despite our best efforts, we were in a wave of crises, as it were, getting to the point early in 2022 when we had over 100,000 applications. Perfectly rightly, much o…”

“Mr Bailey and Chair, thank you. I appreciate that we are tight for time, but if I may, I have two very brief points of contact before I come to the specific question. First, Mr Bailey, you mentioned my appearance in front of your sister Committee in the autumn. I would like to start this session by repeating the apolog…”

“I have a couple of observations, and then Mr Lincoln may want to come in on this. One of the lessons about setting up for success is absolutely being clear about the roles and responsibilities of individual Government Departments in what needs to be a joined-up response, as well as being clear about where the lead sits…”

“Within central Government, in the end, the key people in other Departments who needed to be engaged were within the circle of knowledge of the super-injunction anyway. This can be quite easily overlooked, but I pay tribute to both the civil servants and members of the armed forces who worked under incredibly difficult …”

“You are certainly right that when we think about risk—when we set at the Defence Board level a risk appetite for the Department to operate within—we are thinking both about the likelihood of those risks materialising and the consequences of them doing so. Sometimes you can mitigate both parts of that equation, and some…”

“There were 39 recommendations from McIvor and the majority of those were implemented pretty quickly—”

“The implementation of the DACS database, for instance, meant much greater access controls—the ability to understand who was viewing data and to control that data view. We had introduced processes by which emails outside Government systems needed a double lock; that is not particularly relevant to this data breach. Ther…”

“Recommendations around changes of policy, oversight of policy or introduction of controls were implemented, I would say, almost immediately, so within a month or two. That accounts for 25 or so of the 39 recommendations. There are also a number of recommendations that are, if you like, never really done. One of the imp…”

“The initial focus, in terms of relocations and resettlement immediately after the breach, was to ensure that we were running the pipeline of ARAP-eligible individuals as well as we could. There is a substantial overlap, in terms of the dataset that was part of the data breach, between those who would be eligible under …”

“If I broaden it out from the Triples—I will come back to the Triples at the end—part of the reason I am sitting before you today as the former permanent secretary of the Ministry of Defence, rather than the current one, is that I accept that an element of the buck for this departmental failure has to stop with me. It i…”

“No, I don’t think so. As I say, from conversation with the Defence Secretary, the principal reason why I have moved on is about that refresh of the leadership for the rest of the Parliament; I don’t think there are that many times when a Defence Secretary gets to get a new perm sec, a new CDS and a new National Armamen…”