The Ministry of Defence (MoD) data breach
Table of Contents
MoD data breach makes headlines after two-year secrecy
Recent publicity about the previously concealed data breach involving the Ministry of Defence (MoD) has led to widespread commentary in media, political and data protection circles.
What can organisations learn from this breach, both in terms of preventing and managing personal data breaches?
MoD data breach: the background
How the breach was discovered
For those who haven’t been following this story, I’ll provide the background. In August 2023, the MoD became aware that in the previous year, a spreadsheet containing details of applicants for its Afghan Relocations and Assistance Policy (ARAP) had been disclosed in error and was circulating online.
It was originally believed that only a small number of data subjects were contained in this spreadsheet, but investigations revealed that there was ‘hidden data’ in the document relating to over 18,000 people.
Why the ARAP scheme data was so sensitive
The ARAP scheme allowed individuals who worked in exposed or meaningful roles during the British presence in Afghanistan (such as functioning as translators for British Army units) to apply to be relocated with their immediate family to the UK. The obvious purpose of this policy was to protect Afghans who had worked with or cooperated with the UK Government to be protected from revenge by those hostile to the UK, after the British withdrawal from the country.
Risks and consequences for those affected
You may easily imagine that disclosure of the identities of those who had applied to the ARAP scheme could place them, and their families, in extreme danger. Even if such a threat to life did not ultimately result, the emotional distress to those affected could have been enormous. In terms of the number of data subjects, the sensitivity of the information and the potential impact on those involved, it is difficult to imagine a data breach of greater seriousness.
The breach triggered the creation of a secret resettlement scheme, the Afghanistan Relocation Route, to relocate those considered at greatest risk. There are varying reports about the cost of this scheme, but it has certainly run to hundreds of millions of pounds, and, as Article 82 of the GDPR permits data subjects to seek compensation for material or non-material damages resulting from a breach of the regulations, one has to assume there is a possibility of compensation claims as well.
The MoD’s emergency response
ICO reporting and the 72-hour deadline
The MoD reported the breach to the Information Commissioner’s Office within the statutory timeframe of 72 hours of becoming aware of the breach. In September 2023, the High Court issued a ‘super injunction’ preventing any reporting of the breach, or even the existence of the injunction itself. This injunction was granted on the basis that any reporting of the breach could further alert hostile parties to its occurrence and increase the threat to those affected.
The injunction remained in place for almost two years, making it one of the longest and most restrictive in UK legal history.
The injunction was lifted earlier this month in the High Court by the Judge who had reviewed and continued the injunction, in light of evidence from the MoD that keeping the injunction in place would no longer serve any protective purpose and its existence created a “scrutiny vacuum” preventing public accountability of the institutions involved.
It was only with the lifting of the injunction that the public was made aware of the breach and the various legal proceedings that had concealed it.
The impact of a large-scale personal data breach
We can see that a data breach, particularly of this magnitude, has many possible consequences. In no particular order, they are:
- Risk to the well-being of the data subjects affected,
- Reputational loss. How many people, data subjects and organisations such as intelligence partners might now think twice about engaging with and entrusting information to the MoD?
- Financial cost to manage the consequences of the breach, including the cost of potential compensation claims.
Why the ICO didn’t fine the MoD
With regard to the latter point, at present the MoD appears to have escaped a further possible financial cost – the issue of a monetary penalty by the ICO. Eyebrows have been raised about the decision of the ICO not to take any further regulatory action on this breach, but bear in mind the regulator does have the legal powers to issue significant fines if it sees fit.
An example of when this power was used can be seen in the Information Commissioner’s decision to issue a £750,000 fine to the Police Service of Northern Ireland (PSNI) for a similar breach in 2023, when the details of almost 10,000 PSNI employees were accidentally disclosed in hidden columns of a spreadsheet sent out in response to a Freedom of Information request.
It was believed this highly sensitive data had ended up in the hands of paramilitaries, creating a serious security risk to those affected. The original fine had been calculated at £5.6 million, but the ICO’s public sector approach, which is intended to minimise impact on public services that would only affect users of such services, reduced the size of the penalty.
What can we learn from the MoD data breach?
I have no intention of commenting on the appropriateness of the injunctions issued, but let’s look at what this all means in terms of the data protection legislation.
What is a data security breach?
Simply put, a data security breach is defined by the UK GDPR as:
“a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to [personal data].”
Do these events meet this definition? Absolutely. Indeed, this is about as bad as a breach can get.
Learn more from our experts in: What is a cyber incident?
Does an organisation have to report a data breach?
In some cases, yes. A breach must be reported to the ICO (or other appropriate UK GDPR supervisory authority) unless it is deemed “unlikely” to result in risk to the rights and freedoms of those affected. Such a report has to be made within 72 hours of the breach being discovered. The MoD appears to have complied with this requirement.
Learn more in our Guide to GDPR Accountability
When must you report a data breach?
The legislation also says, however, that if the breach is likely to present a high risk to the affected data subjects, they should also be notified without undue delay.
This is to enable affected data subjects to take any steps they might need to take personally to protect their interests. It is troubling that news reports suggest that the MoD did not inform the affected data subjects at the time of the breach, and they only discovered their data had been disclosed at the same time as the rest of the world when the injunction was lifted.
If this is the case, those most affected were prevented from knowing and acting upon, potentially serious risk to their lives. It is not clear at this point why the MoD did not comply with this obligation.
What should organisations do to comply with breach reporting requirements?
Organisations should develop and communicate to staff data breach procedures so that their employees can recognise a potential breach when it occurs and promptly escalate it to ensure it is properly investigated and risk assessed.
Employees should be encouraged to act swiftly if a breach is suspected, rather than ignoring it or hoping it will go away. Remember, the clock for the 72 hours to report a breach (if required to do so) starts ticking the moment the breach is discovered.
Specific data protection training (including refresher training on an annual basis) can help staff keep personal data secure and also understand what to do if a breach occurs.
An identified individual (or individuals) within the organisation should be nominated as the point of escalation for any suspected breaches and have the skills and knowledge to manage and assess the situation.
Read more advice from our experts in: What to do after a data breach?
How can data breaches be prevented?
There is no one simple answer to this, but the GDPR requires organisations to take appropriate technical and organisational measures to keep personal data secure. These measures will depend on a number of factors such as the types of personal data you process, risks to its security and the possible consequences of a security breach.
You can also take into consideration your organisation’s own resources, but this should never justify the avoidance of implementing measures you could reasonably be expected to put in place because of time, cost and resource constraints. You can see from this that a small business handling non-sensitive personal data will not be expected to have the same level of security as organisations such as MI5.
Implement technical and organisational security measures
Technical measures could include measures such as firewalls, ensuring that software security patches are promptly installed, and keeping documents under lock and key.
Organisational measures might include controls such as limiting access to personal data on a ‘least privilege’ basis and implementing processes, policies and training as to how personal data is handled.
The MoD breach is eerily similar to the PSNI breach I have mentioned. Both involved spreadsheets being sent out with ‘hidden’ information that had not been noticed. This is an almost classic scenario that organisations should be careful to guard against.
Avoid the hidden spreadsheet data trap
Before being disclosed, spreadsheets should be carefully examined to see if there are any hidden columns or rows that a recipient can reveal to find data that was never meant to have been provided. Another option to consider is that spreadsheets can be converted into PDF documents to avoid this risk.
If you’d like to understand more about creating effective cyber incident response plans and incident communication plans, our free guide to incident response is a great place to start.
What went wrong?
Ultimately, the MoD is accountable under the GDPR for the breach. There are reports in the media that the individual who sent the spreadsheet is still working for the MoD, and some have questioned why this is the case.
Human error vs organisational accountability
Let’s not be too quick to pass judgment, however, as I said, organisations are required to implement technical and organisational measures to keep personal data secure, and an individual’s error can sometimes reflect an organisational failing. Factors that might be considered here could include:
- Was this person properly trained in data protection?
- Were there policies in place restricting the format in which personal data is disclosed, or requiring double-checking for hidden data?
- Was this person’s workload and working conditions managed in a manner that they weren’t overworked, pressured or distracted in a way that could have led to the breach?
- Were they told by an authority figure to send the information in a manner, format or with an urgency that prevented proper consideration of security, and they felt unable to refuse?
These are all points that should be considered when a data breach occurs that involves human error.
Whilst it is very unlikely that most organisations will experience a data breach of this magnitude and severity, the MoD breach is a good prompt for reflection on how well you are positioned to prevent and/or manage a breach.
Key lessons from the MoD data breach
While most organisations won’t face a breach of this scale, the MoD incident is a stark reminder of the need for strong prevention measures and rapid, compliant breach response processes.
Ready to talk to us about your data protection requirements?
Evalian provides outsourced Data Protection Officer services and can provide all the advice and support your organisation needs to put in place robust data security measures, and implement procedures to promptly identify, assess and manage any breaches that might occur. Please get in touch if you would like an informal chat or to discuss how we can support your organisation.
