UK data regulator defends decision not to investigate MoD Afghan data breach

The UK's data protection regulator declined to launch an investigation into a leak at the Ministry of Defence that risked the lives of thousands of Afghans connected with the British Armed Forces. The MoD was responsible for the accidental data breach, which took place in February 2022 and is likely to have cost more than £850 …

[Will Godfrey]

No Surprise there.

Never mind the victims of the fuckup. Clearly the right arses need to be covered.

[NoneSuch]

Re: No Surprise there.

Arse covering indeed. Why would anyone ever help the UK again in an armed conflict?

The Americans screwed over tens of thousands starting in Vietnam and every other area of conflict it has been in since. "Help us and we'll protect you," didn't work out that well for those that literally risked their lives and were left on the runway watching the last evacuation jet leave.

[Anonymous Coward]

Re: No Surprise there.

Well, as an alternative to arse covering, what punishment do you think should be handed out, and to whom?

[Anonymous Coward]

Re: No Surprise there.

It's shockingly stupid isn't it. Best to keep as far from American foreign "policy" as possible. Now this from the UK but who's more stupid, the government or the people who get involved. We prove time and time again that the West is not to be trusted. Makes me ashamed, it's not what I want our country to be. There is true value in honour.

Nothing to investigate my arse.

[MyffyW]

WTAFF

It cost nearly a billion quid. A billion effing quid of yours and my money, because someone cocked up. There is no way that should be left to internal processes.

[Anonymous Coward]

Re: No Surprise there.

For a regulator that is driven by ‘impact related’ issues this is clearly horseshit.

Do they need a body of a dead Afghan interpreter dumped on their door by the Taliban ??

ICO another shitty regulator not fot for purpose.

Curious what the cost of the breach of £850m attributed too - Not like they removed any more afghans. Many people utterly shamefully just abandoned. Was £850m the entire cost of running away like a pussy from Afghanistan ??

[Empire of the Pussycat]

Nothing to see here, move along now

No need, no, not even a little bit, you can trust us, it's just another one-off.

[An_Old_Dog]

Gobbledygook

"It's just that information systems make it quite difficult to store classified material and to make a meaningful decision."

That's right up there with, "Do you carry your lunch, or do you walk to work?"

[Guy de Loimbard]

Re: Gobbledygook

Couldn't make that line up if you tried.

"We store data in this thing, but we can't make a decision because old Johnny rubber desk over there may be in the pooh pooh!!"

[elsergiovolador]

Lessons

What about lessons to be learned?

[Blazde]

For the ICO to go in and start investigating [an incident, it] can actually get in the way

They're absolutely right. It'll be much more hassle and embarrassment for the establishment to investigate, and any action will only force a change of processes in an attempt to prevent a repeat of the incident. That change will cost money and probably also cause some kind of delay for future emailing of spreadsheets, which is presumably a vital daily activity. Much better to just hope and pray a repeat incident doesn't happen again before the involved personnel have moved on. By then it'll be somebody else's problem.

[Dave@Home]

"Edwards told MPs the ICO decided not to investigate because it might hinder the MoD's response.

away and shite

[Anonymous Coward]

Re: "Edwards told MPs the ICO decided not to investigate because it might hinder the MoD's response.

That might be correct, but the fact that so many don't believe it tells a story. Now fellow sceptics, apply that scepticism widely because there is so many lies we are told yet collectively we fall for them every time.

[ParlezVousFranglais]

"For the ICO to go in and start investigating [an incident, it] can actually get in the way"

It's f***ing SUPPOSED to get in the way - that's what the sodding legislation is there for, to stop either malicious or incompetent treatment of other people's data.

This is a blatant cover-up, no more, no less, and means that the MoD can continue this abuse of trust with absolutely no ramifications - absolutely shocking...

[tiggity]

FFS

Peoples lives at risk & their families.

But it appears (poor, brown skinned Afghan*) life endangering incidents don't matter as much as financial data breaches

* I leave it as an exercise for each individual reader (based on how poor a view of the ICO they have) to guess whether the response would have been different if they were white British (and wealthy and / or influential)

[Anonymous Coward]

Re: FFS

Exactly, this is a perfect demonstration of how little they care. But don't fool yourself it's because they are brown skinned, they care no more for us, the only difference is the come back had it been voters.

[Dave Null]

Probably pragmatic

...I mean, if they fine the MoD, they're fining the UK taxpayer...I'd imagine the MoD have agreed to document what process improvements they intend to make etc. Yes, a massive fuck up, but I'm not really sure what practical use the ICO fining them would have right now.

[Anonymous Coward]

Re: Probably pragmatic

Depends where the fine goes. Just fining is pointless unless, like clinical negligence, it is used to help the victim live. If not it would just go to help fund government incompetence and we'd have to pay more tax to replace the money for the MoD.

[Cynical Pie]

Re: Probably pragmatic

Proceeds from MPNs issued by the ICO go into the Treasury so any fine to central government is in effect pointless as it it just taking out of the Treasury backed MOD account to give it back to the Treasury

[Doctor Syntax]

Re: Probably pragmatic

They need to be able to hold individuals responsible. Not necessarily the individual who sent the email but whoever was responsible for the process that required and/or allowed sending data in s spreadsheet instead of being exported as some other form such as CSV or PDF.

[Anonymous Coward]

Public Sector Data Protection compliance standards

"In a joint committee with DSIT and the Cabinet Office, Edwards said there would be a plan to raise standards by the end of the year."

I don't how they could make Public Sector compliance standards any worse lol.

BTW, not data protection related, did you know that organisations responding to FOI Requests are not required to provide only accurate information? They can respond with information that they know to be inaccurate/untrue (indeed they can state "facts" that they know to be untrue and which are provably untrue) and the ICO don't care: "It falls outside of the remit of the Commissioner to consider this. FOIA concerns access to information, not the accuracy of such information."

[Anonymous Coward]

Re: Public Sector Data Protection compliance standards

Oh don't worry about a digital id linked to all the data the government has on you. It will be safe .....

[Blazde]

Re: Public Sector Data Protection compliance standards

They can respond with information that they know to be inaccurate/untrue (indeed they can state "facts" that they know to be untrue and which are provably untrue) and the ICO don't care: "It falls outside of the remit of the Commissioner to consider this. FOIA concerns access to information, not the accuracy of such information."

But only if the organisation doesn't have the accurate information you've asked for, presumably? That's fair. You can't force an organisation to acquire potentially costly 'accurate' information just because of an FOI request, and we can't have a situation where the ICO is arbiter of what constitutes accurate information anyway.

Indeed, being able to assess for yourself whether some public sector information is inaccurate or not by requesting it, is a desirable feature of the system.

[Anonymous Coward]

Re: Public Sector Data Protection compliance standards

"But only if the organisation doesn't have the accurate information you've asked for, presumably?"

Nope, I had a FOI Request and subsequent ICO complaint regarding said FOI Request where the ICO requested the organisation provide a current accurate membership list of a group, the org continued to insist that the May 2023 list they had provided to me was the current membership list despite the org having authored a document in Nov 2024 that contained a more up-to-date list.

Despite me providing evidence to the ICO of the existence of this more up-to-date membership list the ICO didn't bother to pursue that aspect of my complaint any further.

[VoiceOfTruth]

Translation

>> Information Commissioner John Edwards, who oversees government data protection, said his office decided not to launch an investigation into the historic leak after meeting with MoD officials.

Edwards was told to get lost. He's not in charge of anything. He can go back to pretending he's important.

[Doctor Syntax]

Great. MoD commits massive security breach but won't allow proper investigation because of security.

And can we jus recite once more:

"Excel is not a database"

[gnasher729]

This is just shameful. They put the lives of people at risk who helped the UK army in their operations in Afghanistan. That wasn’t a mistake. That wasn’t carelessness. That was not giving a f*** about people’s lives who gave much needed support to the UK.

[Anonymous Coward]

Strokes chin

Not suspiciously convenient at all.

[redpola]

I get that this is difficult and unusual owing to the sensitivity of the data but

SOMEONE screwed up.

WHO screwed up. HOW they screwed up. WHAT will be done to prevent this again. These are not sensitive data.

Add in that it’s a billion quid of our money and put at risk the material safety of people and the families of people who actively served the UK.

This needs more of a resolution than this.

[Anonymous Coward]

....and then there's OFWAT........

.......and our rivers overflowing with sewage!!!

Can someone explain why ABSOLUTELY nothing passed by the "great and the good" working (?) in SW1.............

..............is EVER ENFORCED??

Oh....don't forget that other joke called GDPR!!

[collinsl]

Re: ....and then there's OFWAT........

The rivers are cleaner than they've been since the 1800s, we're just much better at monitoring them than we used to be.