Written evidence submitted anonymously.

I am an independent volunteer caseworker who has been assisting targeted Afghans in escaping from the Taliban for four years. I am also known as Person A.

SUMMARY

● I was the person who discovered the April 2022 data breach in August 2023, and notified the MOD.

● The super-injunction was handled badly, as was the ARAP resettlement process during the period covered by it.

● The wrong people were prioritised for expedited evacuation.

● Afghans have been adversely affected by the data breach, in some cases fatally.

● The Rimmer Review reached incorrect conclusions. The Taliban continue to target former ANDSF. The information contained in the dataset should remain protected indefinitely to protect those who remain in Afghanistan.

● The Afghan Resettlement Schemes remain unfit for purpose.

On 13/08/2023 I was contacted by AB, one of the Afghans I was assisting, and alerted to the fact Athat someone was posting anonymously in a Facebook group claiming to have access to the ARAP database. AB tested this person, and the following day they proved they had access to information from the database. The anonymous poster claimed to be in possession of 33,000 records. I told AB to immediately alert the duty caseworker in Pakistan. Separately, I contacted the Armed Forces Minister James Heappey via email, and alerted my contact CD at Presidium Network, who had direct connections into both USG and UKG at a high level. I received no reply from the Armed Forces Minister until 21/08/2023 when I tagged him in a post on Twitter.

Separately from all this, in Pakistan, AB had been informed by the Caseworkers that it was an old database, and that there was “no cause for concern”. A ‘global’ Whatsapp message was sent to all families in Pakistan stating:

“We have been informed that there may have been a potential data breach of your contact information. To protect you, do not respond to emails or WhatsApp/text messages from people stating they are from UK Government departments. Check with your ARIT caseworker if you receive any emails or messages.”

At no point were I, or AB, formally debriefed or interviewed about how we discovered the data breach. We were not given any advice or warnings, but we chose to keep the information about the breach quiet due to the potential security implications for both the country and individual Afghans if the breach became public knowledge. I advised the families I was in contact with at that time to change their location and phone number, citing a number of arrests that had been made recently by the Taliban, and explaining that I was concerned one of their colleagues’ phones had been compromised. Despite the downplaying by the caseworkers in Pakistan, I went with the maxim of better safe than sorry.

On 14/09/2023 I was contacted by email by the then-Director of DARR, EF, requesting a meeting. It was framed as being in regard to the advocacy work I had been doing, and there was no mention of any legal ramifications or repercussions. Unlike the press representatives, I was not told that I would require legal representation. The meeting took place on 18/09/2023 and I was served with the super injunction simultaneously via email whilst on the Teams call.

It was an extremely surreal and somewhat frightening experience. One minute I was hoping and expecting to be working alongside the MOD to solve the multitude of mistakes that had led to hundreds of Afghans being incorrectly rejected, and next minute I'm being told I've been served with a world's first contra mundum super-injunction, and that if I even tell anyone I've been served with it, I'll be going to jail.

Somewhat naively, I expected the injunction to be in place for a number of weeks, at most a few months, whilst the MOD made hasty efforts to locate, protect and evacuate the Afghans affected by the breach, and inform NATO partners. Many of the Afghans who applied to ARAP did not meet the eligibility requirements for resettlement to the UK, but were under the mistaken belief that having worked with NATO countries they would be considered. As part of proving their cases, they provided contact details for named individual officers - from the UK and NATO partners - who would vouch for them, and there was the distinct possibility this information had been exposed during the breach. I was never involved in these processes and was only ever updated by the MOD legal team about conditions of the injunction changing following hearings.

As time went on, it became increasingly obvious that the ARAP application process was not fit for purpose. Woefully understaffed, and without the in-country knowledge to make assessments, the pathway ground pretty much to a halt. A new Director took charge, and GH became the point man where we took queries. We had a flurry of approvals, but very few people that we were dealing with were actually called forward to Pakistan to begin their evacuations. Many of the families who had been called forward then sat in Pakistan for extended periods waiting for their UK visas to be issued. Everything was painfully slow.

I began receiving more and more requests for help from Triples, where previously I had worked mainly on NDS cases. It was clear that many had a cast iron case for relocation to the UK. Some had even been called forward for evacuation during Operation Pitting but hadn't made it into the airport before the airlift ended. They then had resettlement refused under ARAP. We managed to get some of these cases approved quite quickly, but others with strong evidence are still waiting now. We have a number of families where siblings served alongside each other in UK-affiliated units. One has been evacuated, and the other is still waiting, despite having near identical eligibility and evidence.

At no point were we ever told if any of our families had been affected by the data breach, or given any indication that the ARR pathway had been implemented. In fact we were specifically told there was no avenue for Afghans to be evacuated to the UK, no matter how high their profile and risk, if they did not satisfy the ARAP criteria. To our knowledge, none of our high priority cases were evacuated under ARR.

We regularly updated DARR on the situation in Afghanistan as it pertained to individual cases. Most families were separated, with the principal applicant living separately to the spouse and children to minimise risk. Despite these precautions, many families faced repeat raids by the Taliban, assault, intimidation, threats and physical violence. Women, children and the elderly were all assaulted. Some were arrested and tortured. Property, businesses and land were seized, and houses were burned down. It was patently obvious that the so-called amnesty for former ANDSF did not exist, and that a specific Taliban unit named Yarmouk 60 had been tasked with hunting UK-affiliated Afghan Special Forces. Where principal applicants could not be found, they targeted family members. We feared that these families may have been affected by the data breach (and later discovered that many had been) but due to the terms of the injunction, we were prevented from warning them.

In Spring 2024, it felt very much that the safety of Afghans was being neglected in the run up to a

well-telegraphed General Election. It seemed as though heels were being dragged and there was a presumption that ARAP would become a new government's ‘problem’.

On 25/03/2025 I had a Teams meeting with Paul Rimmer to discuss the then-current situation in Afghanistan. I explained in detail what our families were facing, and he appeared unaware of the existence of Yarmouk 60. In tandem with the work I have been doing to assist targeted Afghans, I have also been documenting extra-judicial killings of former ANDSF. This document was provided to Paul Rimmer via email, and has been provided to the committee via the clerk as reference material. Come July 2025, when the injunction was lifted, I was extremely surprised that the Rimmer Review had found that UK-affiliated Afghans were at substantially less risk than when the injunction was granted. This was contrary to the evidence I and a number of caseworking colleagues had given. I was given no prior warning that the injunction was being lifted.

The injunction could have been reasonably justified if, in the near-two years that it was in place, the MOD had made concerted efforts to evacuate all the eligible, affected Afghans and to warn those who were affected but weren't eligible for resettlement so that they could take precautions to protect themselves. Unfortunately this didn't happen and it appears that those who didn't qualify for ARAP may have been prioritised for evacuation. The secrecy of the ARR route, and the sometimes bizarre choices of who was prioritised led to understandable frustration, confusion and mistrust in the Afghans left behind. It became increasingly difficult to advise patience when Special Forces who had served for 10+ years were watching dog walkers, farmers, barbers and gardeners being evacuated ahead of them.

Four years on from the Fall of Kabul, three years since the data breach, and two years since its discovery, many Afghans affected by the data breach are still waiting for approval and evacuation. There are families who received their initial approval more than 12 months ago but still have not had their Home Office approval for UK visas. These include Afghans affiliated with SIS and UKSF and those who served with current UK ministers. They are spread across the globe with unstable immigration status, in a number of countries including Belgium, Poland, Iran, Lebanon and Pakistan. There are implications for the UK's national security if these individuals are captured by bad actors. Some Afghans who we believe should be eligible have been rejected and had to file review requests, including applicants affected by the breach.

Due to the UK's failure to evacuate families in a timely manner, they have suffered mental health difficulties and real-world physical consequences such as rape and murder, arrest, imprisonment and torture, deportation from third countries to Afghanistan, homelessness and destitution. A number of Afghans evacuated to the UK have close family members remaining in Afghanistan and have applied for them to be brought out as they are being threatened, assaulted and harassed by the Taliban.

These applications are often refused, leaving the primary applicant vulnerable to extortion by the Taliban.

We originally raised concerns about issues with the Afghan Resettlement pathways in March 2023, prior to discovering the breach, when I authored a document entitled “Suggested Improvements to Afghan Resettlement Schemes” which was provided to the Cabinet Office. This was not acknowledged, and sadly few, if any, of our proposals ever came to fruition. In conversation with DARR on 24/07/2025, I requested some form of cross government meeting provision for those of us who assist Afghans outside of official channels, and on 08/09/2025 I was asked to expand on my idea with a view to it being implemented. On 12/09/2025 I provided DARR a brief titled “DARR Partner Engagement Forum - Brainstorming”. In this document I raised a number of issues and made a number of suggestions. It has been acknowledged, but to my knowledge not yet actioned.

9th October 2025