© National Audit Office 2025

The Afghanistan Response Route

A report by the National Audit Office

Session 2024-25
3 September 2025
HC 1288

This factual report has been prepared for the Public Accounts Committee to support its scrutiny of the Ministry of Defence’s activities relating to the Afghanistan Response Route.

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2024, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £5.3 billion. This represents around £53 for every pound of our net expenditure.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 2 September 2025

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

1 September 2025

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

017048 09/25 NAO

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

Alice Broughton and Grace Williams, under the direction of Helen Holden.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

Key facts

What this report is about

1 This is a factual report about the Afghanistan Response Route (ARR) scheme, which the Ministry of Defence (MoD) set up to mitigate the security risks arising from a data protection breach and the unauthorised disclosure of personal information which occurred in February 2022.

2 We have prepared this report for the Public Accounts Committee to support its scrutiny of the MoD. It describes:

the key events and decisions which led to the creation and public disclosure of the ARR scheme;

the number of individuals who have been and are expected to be resettled through the ARR scheme; and

the associated costs which the MoD has already incurred, and the future costs which it expects to incur.

3 This report does not seek to evaluate the MoD’s management of or spending on the ARR scheme. We carried out our fieldwork in July and August 2025, following the disclosure of the ARR scheme when the High Court super-injunction relating to it was lifted on 15 July 2025. We focused on establishing the facts of the ARR scheme. We did not assess the evidence which led to the super-injunction being issued, maintained and then lifted or any other aspects of the legal process.

4 The MoD, the Home Office and the Ministry of Housing, Communities and Local Government are responsible for delivering different parts of the government’s Afghanistan resettlement schemes. This report focuses on the MoD and its role in relation to the ARR. We have reviewed financial information on the costs of the scheme, but we have not audited this information. We did not look at the other Afghanistan resettlement schemes for which the government is responsible. We plan to assess the government’s Afghanistan resettlement schemes overall, including their costs, in a separate report for Parliament, to be published in Spring 2026.

Findings

Background

5 Between October 2001 and late August 2021, the UK had a military presence in Afghanistan. During this 20-year period, the UK government employed local Afghan citizens to assist British forces. This work sometimes came with significant risk to those Afghan citizens and their families, who feared reprisals from the Taliban. Since 2010, the UK government has offered the possibility of resettlement for those in Afghanistan, primarily focusing on those it employed. Figure 1 sets out the government’s Afghan resettlement schemes between 2010 and 2025.

Afghan Relocations and Assistance Policy scheme

6 On 1 April 2021, the government launched the Afghan Relocations and Assistance Policy (ARAP), replacing the Intimidation Policy which had been in place since 2010. The scheme is for Afghan citizens who worked for or with the UK government in Afghanistan in exposed or meaningful roles. It could include an offer of relocation to the UK for those deemed eligible by the Ministry of Defence (MoD) and who are deemed suitable for relocation by the Home Office. The government did not set up the scheme with a limit on the number of eligible individuals.

7 The government accelerated and expanded the ARAP scheme when the security situation in Afghanistan changed drastically in the weeks following the scheme’s launch. On 14 April 2021, following announcements by the United States government and NATO to withdraw troops by 11 September 2021, the UK government confirmed that it would withdraw all remaining British service personnel in Afghanistan. Due to the deteriorating security situation in Afghanistan, on 1 June 2021, the UK government announced that it would rapidly accelerate applications to the ARAP scheme and broaden eligibility criteria.1 On 15 August 2021, the Taliban captured the country’s capital, Kabul, and the Afghan president left the country.

8 The MoD is the lead department for the ARAP scheme, and is responsible for processing applications, assessing eligibility, and relocating Afghan citizens and their families to the UK once entry clearance has been granted by the Home Office. The Home Office and the MoD initially worked together to provide temporary or ‘transitional’ accommodation to resettled Afghan citizens, but from 1 March 2025 the MoD has been responsible for providing this.

Key events leading to the creation and disclosure of the Afghanistan Response Route

The February 2022 data incident

9 On 22 February 2022, a Defence official emailed a spreadsheet of Afghan applicants to the Afghan Relocations and Assistance Policy (ARAP) and the previous Ex-gratia scheme from the MoD’s systems to a trusted source outside the MoD. At end-July 2025 the MoD reported that this spreadsheet contained details relating to 18,700 applicants.2 The spreadsheet comprised 33,345 lines of data which contained the names and contact details of applicants and, in some instances, information relating to the applicants’ family members. The official involved thought they were sharing a more limited data set with an external party for a legitimate operational reason, but the spreadsheet they sent contained data that was not evident to the individual sending it.

10 The MoD reported that it first became aware of the data breach on 14 August 2023, 18 months after it occurred, when personal details of 10 individuals from the dataset were posted online on Facebook.3 The MoD identified the data compromise in several ways, including by contact from two journalists.

11 In the days after it discovered the data breach, the MoD contacted Facebook to remove the posts online, conducted an internal investigation and reported the incident to the Metropolitan Police and the Information Commissioner’s Office (ICO). The police decided that no criminal investigation was necessary. The ICO subsequently decided that it was not in a position to conduct its own independent investigation into the data breach at that time, because of the restrictions resulting from the super-injunction and the classification of much of the relevant material as Secret or Top Secret. Instead, it decided to review, oversee and propose lines of inquiry to the MoD’s internal investigation team.

12 As part of its internal investigation the MoD provided to the ICO details of its data protection policies, as well as training and guidance for staff on the risks of sharing information by email, that were in place at the time of the data breach in February 2022. It also explained some of the measures being adopted to minimise the risk of an incident like this occurring again. In information that it released regarding its involvement in the investigation, the ICO noted that, due to the urgency with which the MoD was operating at the time of the breach, there was “inherently some risk” that the MoD was having to take, by sharing some data externally in order to validate the identity of those coming to the UK.4 At the time, the MoD’s systems were not set up for this and the MoD team was working at pace due to its assessment that there was a clear threat to life. The ICO also noted that, in its view, the MoD did have processes and policies in place that are designed to address the risks, but also that since the data breach took place, the MoD had taken steps to implement improved systems and processes.

13 The ICO did not issue a fine for the February 2022 data breach, but told us that it continues to engage with the MoD in relation to the incident. In 2023, the ICO fined the MoD £350,000 for a separate data breach which happened in September 2021, when emails were sent using the ‘to’ field rather than the ‘bcc’ field, identifying Afghan applicants to the ARAP scheme to each other.5

14 In the days following the incident the UK government attempted to contact applicants to the ARAP scheme and other eligible persons in Pakistan advising that their contact information may have been compromised by a data incident. The MoD told us it did not attempt to contact other potentially affected individuals at that time to reduce the risk that the information would be shared more widely and to allow time to consider how best to address the implications for affected individuals.

15 The dataset also contained some names of UK Members of Parliament, senior UK military officers and UK government officials who were connected to some of the Afghan applicants. The MoD told us that this was a small number of cases and that the risk to these individuals, who are in the UK, was considered to be extremely low. The MoD told us it continues to make all reasonable efforts to contact those affected to provide security advice and support and that only a small number of people remain to be contacted.

16 The media reported in August 2025, as we were preparing this report, that there had been a further data breach from an MoD sub-contractor providing ground handling services at London Stansted Airport. This reportedly involved information on 3,700 Afghan citizens who travelled to the UK between January and March 2024. The MoD told us that this was not a breach of its own systems but was a cyber incident involving a third party sub-contractor. Also in August 2025, the MoD reported that there had been 49 separate data breaches between 2021 and 2025 at the unit handling applications from Afghan citizens to relocate to the UK. Of these the MoD assessed that seven met the threshold for notification to the ICO, including the February 2022 data breach. The MoD told us that it had handled all breaches in line with ICO’s policies and processes.

The granting of a super-injunction

17 Following its discovery of the data breach, on 25 August 2023 the MoD decided to apply to the High Court for an injunction to prevent the data loss becoming public. Although the MoD did not originally apply for a ‘super-injunction’, on 1 September 2023 the High Court granted this form of legal ruling, which prevented disclosure of both the data breach and the existence of the injunction itself. In reaching its decision to grant the super-injunction, the High Court accepted the MoD’s assessment that, if the existence of the data loss became widely known, the Taliban would be highly likely to obtain the data, which would put the safety and lives of many individuals and their families at risk.

18 The High Court and the Court of Appeal upheld the super-injunction in several subsequent private hearings and judgments between 2023 and 2025. This meant that journalists who were aware of the data loss could not report on it. The data loss was not publicly disclosed in the House of Commons. In its November 2023 judgment to maintain the super-injunction, the High Court noted that the injunction did not constrain what could be said in Parliament, but the Parliamentary authorities might regard the existence of an injunction as relevant to their decisions about what could and could not be raised.6 This means that the issue could have been raised in Parliament while the super-injunction was in place. In his statement to the House of Commons on 15 July 2025, the Secretary of State for Defence said that ministers had decided not to tell Parliamentarians about the data incident at an earlier stage because the widespread publicity would increase the risk of the Taliban obtaining the dataset.7 The data loss was also not reported in the MoD’s Annual Report and Accounts for 2023-24.8

Establishing the Afghanistan Response Route

19 In autumn 2023, the government began work to establish the Afghanistan Response Route (ARR). This was a new resettlement scheme specifically designed for people whose details were in the compromised dataset and who were not eligible for the ARAP scheme but were at high risk of reprisals by the Taliban as a result of the data breach. This scheme was covered by the super-injunction.

20 On 16 November 2023, the Domestic and Economic Affairs Committee, a Cabinet committee, tasked the MoD with making plans to relocate an initial cohort of around 150 people and their immediate family members. On 19 December 2023, the committee agreed that a new route, the ARR, should be established. On 25 March 2024, the committee agreed for the MoD to offer relocation to a further cohort of around 2,300 individuals and 11,500 family members under the ARR. The committee was responsible for further key decisions relating to the ARR during 2023 and 2024. The government launched the ARR in April 2024, when it sent the first letters inviting people to relocate to the UK under the ARR.

The Rimmer review, lifting of the super-injunction and disclosure of the ARR

21 In January 2025, the MoD commissioned an independent review of the government’s policy response to the February 2022 data breach, which focused on the risks to the individuals affected. The review, known as the Rimmer review after its author, was completed in June 2025.9 It found that the ARR policy “… appears an extremely significant intervention, with not inconsiderable risk to HMG [His Majesty’s Government] and the UK, to address the potentially limited net additional risk the incident [the data breach] likely presents.” It said it appeared unlikely that merely being on the dataset would be grounds for targeting by the Taliban, and that it was plausible that the contents of the dataset had not spread as widely or rapidly as was initially feared. Following the review, the Secretary of State for Defence decided to close the ARR and to apply to discharge the injunction.

22 On 15 July 2025, based on the findings of the review, the High Court judge lifted the super-injunction which had kept the existence of the ARR secret. On the same day, the Secretary of State for Defence made a statement in the House of Commons disclosing the February 2022 data breach and the subsequent creation of the ARR to Parliament.10 He also announced the closure of the ARR, with no further new offers of resettlement in the UK. Immediately in advance of the public announcement, the MoD sent a notification to all contactable individuals affected by the incident. Figure 2 shows the key events and decisions which led to the creation of the ARR and its operation up to 15 July 2025.

Resettlement activity through the Afghanistan Response Route

The resettlement offer

23 The released dataset included details of people who had applied either for the ARAP scheme or the Ex-gratia scheme prior to February 2022. These people did not automatically become eligible for UK resettlement because of the data breach. Of those included, the government considered some to be at higher risk because of the incident and the MoD wrote to those people offering resettlement in the UK, under what became known as the Afghanistan Response Route (ARR). The MoD wrote to those it assessed were:

at the highest risk of targeting by the Taliban as a result of the data breach;

located in a high-risk country (including Afghanistan itself and some other countries); and

had not previously been found eligible under other resettlement routes.

The remaining people in the released dataset continued to have their applications considered under the ARAP scheme, where consideration had not already been completed.

24 Although the government’s criteria for offering resettlement under the ARR and ARAP schemes are different, the resettlement offer was the same and included:

arranging, or approving and paying for, relocation to the UK;

‘transitional’ accommodation provided, funded and allocated by the government for up to nine months;11

support to find a settled home;

integration support, including help to find work and to learn English;

permission to stay in the UK permanently (‘indefinite leave to remain’) and to work; and

access to education, healthcare, benefits and other public services.

Numbers of people resettled

25 In July 2025, the UK government closed both the ARAP and the ARR to new applicants. By the end of July, of the 18,700 principal applicants (principals) to the ARAP and the previous Ex-gratia scheme, who were included in the data breach, 4,716 had been offered resettlement in the UK, 13,958 had been told they were ineligible, and 26 were awaiting a decision. Of the 4,716 who had been offered resettlement, 1,531 were offered resettlement through the ARR directly as a result of the data breach, while 3,185 were already eligible for other reasons through the ARAP scheme.

26 Principals could also apply to bring their family members to the UK. At the end of July 2025, the MoD estimated that, including both the 1,531 principals and their family members, the ARR would result in 7,355 people being resettled in the UK directly as a result of the data breach.12 These numbers are from MoD management information dated 31 July 2025. These figures may change as applications are received and processed.

27 Figure 3 shows the numbers of people affected by the data breach who have been offered resettlement in the UK, under the ARR and ARAP schemes. An estimated 23,463 people – including principals and family members – affected by the data breach were eligible for resettlement in the UK under both schemes.

28 The total number of people affected by the data breach who are resettled in the UK could be higher than the estimated 23,463 who have so far been found eligible. This is because some people, who had their initial application for the ARAP scheme rejected, reapplied before the scheme was closed to new applicants in July 2025. Meanwhile, the MoD is also reviewing some rejected applications from people in the Afghanistan special forces, known as ‘Triples’. The MoD estimates that these applications could result in a total of up to 27,278 people being resettled in the UK.

29 Many of those invited to the UK under the ARR have not yet arrived. The MoD told us that it considers individuals are ready to relocate to the UK when they have completed their biographic checks, moved to a third country and obtained a UK Visa, issued by the Home Office under its standard visa assessment processes. Some factors beyond the MoD’s control could prevent people from relocating straight away, such as waiting for third-country exit visas. According to Home Office immigration statistics published in August 2025, 3,383 people had arrived in the UK under the ARR by June 2025.13

Costs associated with the February 2022 data breach

30 The UK government is incurring a range of costs because of the February 2022 data breach. As part of producing this report we requested documents to support the MoD’s estimates in relation to the historic and expected costs of the ARR and other Afghan resettlement schemes. Within the time frame available we were unable to obtain the standard of assurance on these costs that we would normally expect. This section of the report presents the MoD’s key estimates, which we will examine further in our report to be published in Spring 2026.

31 Figure 4 sets out the MoD’s estimate of the actual and future costs to the whole of government associated with the data breach. Paragraphs 32 to 37 provide further information on the MoD’s approach to estimating costs in each category. In total the MoD estimates that the cost to the UK government of the data breach will be around £850 million in ARR resettlement costs, at least £2.5 million in legal costs, and an unknown amount in relation to compensation claims.

Costs of the ARR scheme

32 The MoD is not able to determine exactly what it has spent on resettling people through the ARR scheme. This is because it did not separately identify the costs of the ARR scheme in its accounting system, meaning that these costs were not visible in its management accounts, but instead included them within its total spending on Afghan resettlement activities. The MoD told us it did this to comply with the terms of the super-injunction.

33 Although it does not know exactly what it has spent on the ARR, the MoD has attempted to estimate this cost. The MoD estimates that, as of July 2025, the government had spent around £400 million on resettling people through the ARR and that it would spend around a further £450 million on the scheme. The MoD estimated the costs to the whole of government to be £128,000 per resettled individual, of which an estimated £53,000 would be met by the MoD. At the time of publication, the MoD had not provided us with sufficient evidence to give us confidence regarding the completeness and accuracy of these estimates.

Costs of investigating the data loss

34 MoD started an investigation shortly after 14 August 2023 when it became aware that personal details of Afghan citizens had been posted on Facebook by someone who claimed that the source was an MoD data breach. The MoD does not know what it spent on internal staff costs for the investigation because it did not capture these separately in the accounting system. It did not incur any external costs in investigating the data breach.

Costs of the super-injunction

35 The Government Legal Department (GLD) provides legal representation and advice to the MoD. By August 2025, the GLD had billed the MoD £2.5 million, including VAT, relating to the proceedings for Ministry of Defence -v- Global Media and Entertainment Limited and others. In addition to work which directly relates to the proceedings, this figure also includes fees for policy work, operational matters and other related litigation. It does not include internal MoD costs for maintaining the super-injunction.

36 The MoD expects to pay further legal costs, but at the time of publication it had not estimated this figure. This will include the defendants’ legal costs, Special Advocates costs and other work for which the GLD has not yet billed the MoD.14

Compensation claims costs

37 In July 2025, following the public disclosure of the February 2022 data breach, several law firms reported that they were assisting affected individuals in seeking compensation from the government. At the time of publication, the MoD told us it had not received any claims for compensation and does not yet know whether it may need to pay out against future claims. The MoD has previously agreed to make payments to individuals affected by another data breach. For the incident which occurred in September 2021 (paragraph 13), the MoD said that it would pay up to £4,000 to each of 277 individuals who were affected; at the time of publication, the MoD had not made these payments.

Total cost to the Ministry of Defence of Afghan resettlement activity

38 Between 1 April 2021, when it launched the ARAP scheme, and 31 March 2025, the MoD recorded total spending of £563 million on Afghan resettlement schemes, including the ARR. During this period, the MoD received funding from the Reserve for this spending.15 In July 2025, HM Treasury wrote to the MoD to confirm £1.5 billion funding from 2025-26 to 2028-29 through the departmental Spending Review process for its Afghan resettlement schemes. Figure 5 sets out at a high level the MoD’s actual spending and future funding on Afghan resettlement schemes. It does not include related spending incurred by other departments. We are intending to perform further analysis of these costs in our report on Afghan resettlement schemes, which is due for publication in Spring 2026.

1 Ministry of Defence, Plans to bring vulnerable Afghan interpreters to the UK accelerated, (news story), 1 June 2021.

2 In his statement to the House of Commons on 15 July 2025, the Secretary of State for Defence said that the spreadsheet included 18,714 applicants. The MoD told us that the data were routinely cleansed and assessed and that the exact figure was subject to change. The total of 18,700 applicants is from MoD management information at 31 July 2025.

3 Paul Rimmer, The Independent Policy Review, June 2025.

4 The Information Commissioner’s Office, MoD data breach – Record of ICO involvement in the data breach announced by the MoD on 15 July 2025, August 2025. Available at: https://ico.org.uk/media2/kjwpmmdy/record-of-mod-data-breach.pdf

5 The fine related to three separate incidents, all of which occurred in September 2021.

6 Royal Courts of Justice, Secretary of State for Defence vs Persons Unknown [2023] EWHC 2999 (KB), November 2023. Available at: https://www.judiciary.uk/wp-content/uploads/2025/07/MOD-Judgment-No-1-1.pdf

7 Ministry of Defence and the Rt Hon John Healey MP, Oral statement on Afghan data breach, 15 July 2025.

8 The Annual Report and Accounts (ARA) includes a section where data losses reported to the Information Commissioner’s Office should be summarised. At the time of this report’s publication, the MoD’s ARA for 2024-25 had not yet been published.

9 Paul Rimmer, The Independent Policy Review, June 2025.

10 Hansard HC Debate, Volume 771, column 149, 15 July 2025. Available at: Afghanistan – Hansard – UK Parliament, https://hansard.parliament.uk/Commons/2025-07-15/debates/52337725-C8E1-4D11-952A-BA4A9C1CCEE6/Afghanistan#contribution-F69676C1-770D-467A-85C9-BAD46B7DC61F, (accessed 28 August 2025).

11 This is in either serviced accommodation, hotels or Defence estate accommodation. Prior to 1 March 2025, the government provided accommodation until a permanent or ‘settled’ home was found. From 1 March 2025, the MoD has been responsible for providing transitional accommodation for up to nine months.

12 The total number is an estimate because, although the ARR was closed on 4 July 2025, applications from some individuals and their family members were still being processed.

13 Home Office, Immigration System Statistics, year ending June 2025, How many people come to the UK via safe and legal (humanitarian) routes?, 21 August 2025.

14 Special Advocates are independent barristers with a higher level of security clearance who can represent the interests of a party in court hearings from which that party has been excluded, known as ‘closed’ hearings.

15 The Reserve is a centrally held fund that can be used to fund unexpected demands on government departments.

Appendix One

Our approach

Scope

1 We produced a factual report on the Afghanistan Response Route (ARR). The report has been prepared for the Public Accounts Committee to support its scrutiny of the Ministry of Defence (MoD).

2 We have set out:

the key events and decisions which led to the creation and public disclosure of the ARR;

the number of individuals who have been or are expected to be resettled through the ARR; and

the associated costs which the MoD has already incurred, and the future costs which it expects to incur.

3 We have not evaluated the MoD’s management of or spending on the ARR scheme. We focused on the MoD’s role in relation to the ARR. We did not look at the other Afghan resettlement schemes for which the government is responsible.

4 We carried out our fieldwork in July and August 2025, following the disclosure of the ARR scheme when the High Court super-injunction relating to it was lifted on 15 July 2025.

Methods

5 In examining these issues, we drew on a variety of evidence sources. We reviewed key documents including:

financial information provided by the MoD;

management information provided by the MoD; and

Cabinet committee papers relating to key decisions on the ARR scheme.

6 We obtained relevant documents and data from the MoD and discussed these with MoD officials. We also engaged with other government departments involved, including HM Treasury and the Cabinet Office.

Design and Production by NAO Communications Team
DP Ref: 017048-001