Ministers must have power to sack civil servants after 'extraordinary' MoD data breach, Badenoch says

Exclusive

By Frankie Elliott

@Frank_Elliott_

Kemi Badenoch claimed the catastrophic Ministry of Defence data breach proves ministers should have the power to sack civil servants who "know they can do whatever they like".

Listen to this article

Loading audio...

The Conservative leader made the declaration after it was revealed the government spent nearly two years using an unprecedented superinjunction to prevent the public from learning about the breach that exposed the personal details of thousands of Afghans who had worked with UK forces.

The breach, which happened under the previous Tory government, involved the Afghan Relocations and Assistance Policy (ARAP) - a scheme set up to offer sanctuary in the UK to Afghans who supported British military operations during the 20-year war in Afghanistan.

Defence Secretary John Healey refused to say whether anyone has lost their job over the scandal - something which Ms Badenoch said was "extraordinary".

Read more: How the UK silenced a scandal: My two year battle to reveal the truth by Lewis Goodall

John Healey offers 'sincere apology' from Government for personal data leak of Afghans

"The first thing that came to mind is that this is what people are angry about, that if you had been working in a job in the private sector and something like that had happened, you'd be out on your ear," the Leader of the Opposition told LBC's Ian Dale.

"And it just reminded me of one of the frustrations I had as a Minister, that because you couldn't sack civil servants, they kind of knew that they could do whatever they liked. At worse, they'd be moved to another department."

Ms Badenoch, who worked in the Cabinet for prime ministers Liz Truss and Rishi Sunak from 2022 to 2024, stressed the breach happened before she joined the Cabinet and said the number of people who knew about the breach was "very small".

"I only heard about it yesterday, so I had a briefing on it as Leader of the Opposition. It's the most extraordinary story." she said.

The Tory leader's comments come after Mr Healey said that the defence official responsible for the Afghan data breach is “no longer doing the same job on the Afghan brief” when asked if they are still employed by the British government.

"In the end, this is bigger than the actions of a single individual. For me as Defence Secretary now in this government, my biggest concern and my first focus coming into government was to try and get a grip of something that was entirely unprecedented."

Further asked if he believes anybody should be fired over the data breach, Mr Healey said: "My first priority was not trying to conduct some sort of witch hunt on the defence official that released the spreadsheet that caused this profound data loss…

"My argument to you is that accountability can start today, accountability in due course, as the facts of this are properly scrutinised and examined that will come."

More than 18,000 applicants were affected by the data breach, with names and contact details, email addresses and phone numbers leaked. When family members are included, the number of people potentially put at risk rises to around 100,000.

The MoD sought and was granted a contra mundum superinjunction -- a rare legal order that not only barred publication of the story but also prevented anyone from revealing that an injunction even existed. In court, it was described as “constitutionally unprecedented”.

The News Agents’ and LBC presenter Lewis Goodall was barred from reporting it and initially forbidden from even informing his editor. Court hearings were held in secret, with even media lawyers excluded from “closed sessions”.

The injunction was originally presented as a short-term emergency measure to protect lives while the government identified and helped those most at risk.

But subsequent hearings revealed that the number of people the MoD planned on assisting was just 200 individuals, plus their dependents -- a fraction of those affected. Eventually, though there is some dispute about the figures, at least 6,900 people have now been brought over as a result of the breach.

Between 80,000 and 100,000 people, including the estimated number of family members of the Arap applicants, were affected by the breach and could be at risk of harassment, torture or death if the Taliban obtained their data, judges said in June 2024.

However an independent review, commissioned by the Government in January 2025, concluded last month that the dataset is “unlikely to significantly shift Taliban understanding of individuals who may be of interest to them”.

Around 4,500 people – made up of 900 Arap applicants and approximately 3,600 family members have been brought to the UK or are in transit so far through the Afghanistan Response Route.

A further estimated 600 people and their relatives are expected to be relocated before the scheme closes, with a total of around 6,900 people expected to be relocated by the end of the scheme.

The story, first reported today in a special episode of The News Agents podcast, shows how that secrecy was maintained far longer than journalists believed was necessary or justified.

The case has raised serious concerns about democratic accountability. Parliament was kept in the dark throughout, knowledge of the injunction was limited to only a handful of senior ministers including -- the Prime Minister, the Defence Secretary, the then-Shadow Defence Secretary, and the Speaker of the House of Commons.

During private hearings, MoD officials admitted delays were caused by “a lack of ministerial decisions”. Evidence presented to the court suggested political considerations -- such as pressure to reduce asylum hotel use -- may have influenced who would receive help.

The superinjunction was finally lifted on Tuesday following a ruling by Mr Justice Chamberlain, who had earlier warned the secrecy had effectively put British democracy “into cold storage”.

Since then, the government has quietly shut down the ARAP scheme to new applicants. Charities have criticised the move as "shutting down a lifeline" for Afghans still living in fear of Taliban reprisals.

The MoD says that the cost of the 6,900 who have been brought over because of the data breach will be £800m. But submissions seen in court suggest the total cost of Afghan relocations could now be some £7 billion- much of which Parliament hasn’t had the opportunity to scrutinise.

Exclusive: Media gagged over MoD leak that put 100k Afghan allies at risk

Speaking in the Commons, Defence Secretary John Healey said the information leak "led to the High Court granting an unprecedented super injunction and the previous government establishing a secret Afghan resettlement route."

He went on to announce a change to government policy and a closure of the secret resettlement route.

"It is unprecedented, and to be clear, the court has always recognised the parliamentary privilege of proceedings in this House, and ministers decided not to tell parliamentarians at an earlier stage about the data incident as the widespread publicity would increase the risk of the Taliban obtaining the data set, Mr Healey said.

Adding "as parliamentarians and as government ministers, it has been deeply uncomfortable to be constrained from reporting to this Hous,e and I'm grateful today to be able to disclose the details to Parliament."

Reading a summary of his judgment in court, Mr Justice Chamberlain noted that the grant of the superinjunction had "given rise to serious free speech concerns".

He added: "The superinjunction had the effect of completely shutting down the ordinary mechanisms of accountability which operate in a democracy.

"This led to what I describe as a 'scrutiny vacuum'."

Although the injunction has ended, much of the case remains secret. Journalists involved say it highlights deep concerns about unchecked executive power, press freedom, and how easily transparency can be suspended — even in the UK.

This is not the first time the MoD has faced criticism over the handling of sensitive data under the ARAP scheme.

In 2023, just two years after the Taliban takeover, the Information Commissioner’s Office fined the department £350,000 for a separate data breach. Officials had used the 'To' field instead of blind carbon copy (BCC) in a mass email to 265 ARAP applicants, revealing their addresses — and in some cases, profile photos — to each other. Two recipients accidentally replied to the entire list, with one disclosing their location.

The ICO found the MoD had failed to put basic safeguards in place, leaving sensitive personal data at risk. Its investigation revealed that no specific procedures or guidance had been issued to staff working on ARAP at the time.