UK's Ministry of Defence fined $440,000 for email blunder revealing details of Afghan interpreters

The British Ministry of Defence (MoD) has been fined $440,000 for revealing the personal details of interpreters fleeing Taiban-ruled Afghanistan. The details of as many as 265 people who may have been eligible to come to the UK under theAfghan Relocation and Assistance Policy (ARAP), were mistakenly copied into an email.

UK Information Commissioner, John Edwards said the error had let those down to whom the country owed so much.

"This was a particularly egregious breach of the obligation of security owed to these people, thus warranting the financial penalty my office imposes today," he added.

The error saw the addresses of hundreds of people, including the Afghan interpreters openly included in the "to" field of the email, rather than the blind carbon copy (Bcc) field. As a result, everyone who received the mail, sent by ARAP, was able to view the emails of others.

Further information about those trying to leave Afghanistan, including one person's location, was then exposed when two people responded to the email by selecting "reply all".

An interpreter, whose identity was exposed, told BBC during an interview that the mistake "could cost thelife of interpreters", some of those who were still living in Afghanistan.

"Some of the interpreters didn't notice the mistake and they replied to all the emails already and they explained their situation which is very dangerous. The email contains their profile pictures and contact details."

Watch |Microsoft AI team accidentally leaks 38TB of private company data

Blunder comes to light

The blunder first came to light in September 2021, a month after the Taliban took over Afghanistan as Britain engaged in a chaotic and heavily criticised evacuation of its assets from the country.

The then defence minister Ben Wallace told the parliament he was apologetic for the breach.

"I apologise to those Afghans affected by this data breach and with whom we are now working...to provide security advice," said Wallace.

At the time, the authorities advised the concerned people to change their addresses and relocate while informing their team about the new place of operation via a secure form.

The investigation found that the MoD failed to comply with the data protection requirements for technical processes to safeguard data.

Edwards' office said it had reduced an initial fine of $1.25 million to $877,000 before slashing it down to$440,000. It said the extensive cooperation by the MoD was the reason for reducing the penalty.

(With inputs from agencies)