Government accused of ‘downplaying’ data leak risk to Afghans who aided UK forces

The leak contained a list with details of people who had worked closely with UK forces and had applied to be resettled in the UK after the Taliban took over in Afghanistan in 2021. The leak happened in February 2022 but was not discovered until August 2023.

The then Conservative government won a n unprecedented super-injunction banning any mention of the leak in public, on the grounds that individuals named in the dataset and their families “would be at grave risk, including risk of death” if it fell into the hands of the Taliban.

It was not until July that a judge lifted the super-injunction and details of the leak became public. At the same time, the Afghanistan Response Route, an emergency resettlement scheme that had been set up for people in most danger, was closed.

In parliament, the defence secretary, John Healey, confirmed that “a very significant element” in both decisions was a report he had commissioned into how great a risk the leak remained in 2025, three years after it occured – the Rimmer review.

That review, which was overseen by retired defence intelligence official Paul Rimmer, sits at the heart of the argument about the government’s approach. It was carried out at speed by a small team and relied heavily on information from government, the courts and intelligence services. It concluded that it was “highly unlikely” that merely being named on the dataset would be grounds for being targeted by the Taliban given the volume of other information already available. But from the outset, the review’s critics worried that it did not take proper account of what Afghans were saying.

Last week, the defence select committee published written evidence it had received for its inquiry into the leak. The contrast with Rimmer’s conclusions is striking.

A key piece of evidence is a survey carried out for the charity Refugee Legal Support by two academics long involved with former interpreters or soldiers who worked alongside the British in Afghanistan: Prof Sara de Jong of York University and Prof Victoria Canning of Lancaster University.

Of 231 Afghans who said they had been told by the Ministry of Defence (MoD) that their data had been breached, 49 said either a family member or a former colleague had been killed as a result of the leak.

The committee also released a statement provided anonymously by Person A, who discovered the leak and alerted the government. In it, Person A said it was “patently obvious that the so-called amnesty for former [soldiers] did not exist, and that a specific Taliban unit named Yarmouk 60 had been tasked with hunting UK-affiliated Afghan special forces.

“Where principal applicants could not be found, they targeted family members. We feared that these families may have been affected by the data breach (and later discovered that many had been) but due to the terms of the injunction, we were prevented from warning them.”

Yarmouk 60 is mentioned more than once in the published evidence. Information about it is sketchy, but a report in a specialist defence journal agrees with Person A’s assessment of its role, and evidence submitted to the committee by journalists confirms that they have heard the same information from sources on the ground: “There has been disbelief among Afghans and those seeking to help them at the findings of the Rimmer review. What, they ask, about Yarmouk 60? Some of those who provided evidence question the report’s conclusions.”

Even allowing for the fact that some of the evidence published by the defence select committee last week comes from organisations that campaign for better treatment of Afghans who worked with British forces – organisations that may be natural critics of the government – it paints a picture of the risk posed to people on the leaked list that is unrecognisable from the one painted by Rimmer.

An MoD spokesperson stood by the review’s conclusions and the level of expertise it drew upon: “The independent Rimmer review, conducted based on existing assessments, expertise and reflections from current Afghanistan work, focused on those most able to provide a high level of insight into the situation as of spring 2025.”

But according to Canning, insights have moved on. “Although the Rimmer review gathered a lot of information available at the time, the evidence amassed through this survey calls earlier findings into question. It demonstrates that the breach has had serious human impacts, and now is the time for government action and redress.”

The journalists who submitted evidence to the committee also noted how the MoD has adapted its position over time. When it was arguing for the super-injunction in 2023 and 2024, the MoD said in court that “families have been placed at direct risk of serious harm or death” and “secrecy has to be maintained to protect life”.

By June this year, Rimmer was making almost precisely the opposite case, saying the additional risk from the leak was “low” and “it is possible that HMG [His Majesty’s government]has inadvertently added more value [in the Taliban’s eyes] to the dataset through the use of an unprecedented super-injunction”.

To Afghans who were caught up in the leak but have not been given the right to settle in the UK, the changing arguments have sometimes looked convenient, rather than principled.

The government’s most recent estimate is that 7,355 Afghans will be resettled in the UK under the response route as a direct result of the data breach. The statistics suggest that they will include about 1,500 of the nearly 19,000 people whose data was originally leaked. The rest will be family members.

Photograph by SHAH MARAI/AFP via Getty Images