Speeches by Williams.

“Yes. We will have notified it at the time. Information around that breach and, indeed, three other similar breaches, which we have chosen to treat, effectively, as a single issue, were then published in our 2021-22 accounts. We were engaging the ICO in the autumn of 2021, and we engaged it afresh with our discovering t…”

“The Comptroller and Auditor General is looking to produce a report for the first part of next year.”

“In terms of breaches that we have notified to the Information Commissioner relating to Afghan resettlement, there have been seven.”

“Yes, I suppose so. It is possible that, in the further work that the NAO will do on the Government’s broader resettlement schemes—we have had good engagement with the team at pace over this summer—we will be able to provide a more detailed breakdown that will allow the Comptroller and Auditor General to give you more a…”

“The review in 2023 assessed our full range of data protection policies against the information commissioner’s checklist for what effective management of personal data should be. It looked not only at issues within the Afghan resettlement team or in our use of IT, but at the full range of data protection policies, how a…”

“The figure of £850 million—there is a forecast element in there, and some of those variables and assumptions will change—is a materially right number.”

“In the autumn of 2021, there was, in fact, more than one breach associated with the use of email addresses in the “to” field, rather than in the “blind copy” field. If you want to send an email to a group of people while keeping their contact details private, you send the email to yourself, and blind copy them, so that…”

“There are two reasons. First, given that the scheme itself was covert, in keeping with the super-injunction, reporting of separate costs would clearly breach the super-injunction. More practically, much of the activity to identify, relocate and resettle individuals under the secret scheme and under the open ARAP scheme…”

“Clearly, we have looked, and I am not aware of other incidents in which there has been embedded data in emails that have been sent outside.”

“I wonder whether I might look to Mr Wilson to answer this one.”

“In terms of how frequently individuals were emailing data outside of the Department for third-party verification, as it were?”

“With hindsight, it is not sustainable to have kept the Comptroller and Auditor General at arm’s length for a period of two years. Had we expected it to be two years when this started, I would have felt more clearly about the need to bring him in then. Not much of the expenditure for the Afghan response route had been i…”

“Thank you, Chair. If you would allow me to make a couple of opening points, first, I would just like to add my personal apology, as Permanent Secretary at the Ministry of Defence, to those of the defence ministerial team to all those who have been affected by this data breach. I deeply regret that the breach happened. …”

“My point is that we did respond to the incidents from autumn 2021, but the nature of those incidents was different from the one that happened in February 2022. Once that breach became known to us, we ran a much more fundamental review of our data protection and information handling, both contributing to a cross-Governm…”

“I have been trying to set out for you the facts of what happened. As I said in my opening apology, the breach itself is clearly a serious error, and the Department has fallen short of the standards that you would expect. The response to that data breach, in terms of the policy response and our relationship with the cou…”

“First, I do not imagine that we have gone through this period feeling, from an accounting officer perspective, anything other than deeply uncomfortable. Nevertheless, it is a degree of discomfort that, equally, I was willing to wear and accept. That is on me rather than on the Ministers I have supported through this pr…”

“What I am trying to say is that it was a conscious decision to email a limited number—around 150 names—to a small, select group of people outside of the Department in order to gather evidence to support our assessment of resettlement applications. The data provided included an embedded spreadsheet, the existence of whi…”

“The proposal and request for a parliamentary oversight committee looking at more sensitive aspects of defence work, particularly defence and nuclear enterprise, is being considered at the highest level within Government. I do not know, if we had had it, whether that would have been used. I know that I sound like a stuc…”

“It has high consequences.”

“Just to be clear, it had not been circulated to 18,700 people. It was a spreadsheet that had details of 18,700 applications on it that had been emailed externally to a very small group—single figures—of people who were advising us on their knowledge of whether individuals had worked for the Afghan national security for…”