CGM, R (on the application of) v Secretary of State for Defence [2026] EWHC 2033 (Admin)

[2026] EWHC 2033 (Admin)

Case No AC-2025-LON-002572

IN THE HIGH COURT OF JUSTICE

KING'S BENCH DIVISION

ADMINISTRATIVE COURT

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 31/07/2026

Before

THE HONOURABLE MRS JUSTICE COLLINS RICE DBE CB

Between

CGMClaimant

SECRETARY OF STATE FOR DEFENCEDefendant

Between

SECRETARY OF STATE FOR FOREIGN, COMMONWEALTH & DEVELOPMENT OFFICEInterested Parties

DAMInterested Parties

DMRInterested Parties

DLRInterested Parties

DLYInterested Parties

DLSInterested Parties

Mr Tom Hickman KC&Mr David Sellwood (instructed by Deighton Pierce Glynn) for Claimant

Mr Alan Payne KC&Mr Alasdair Henderson (instructed by the Government Legal Department) for Defendant

Mr Zubair Ahmad KC&Mr Jesse Nicholls (instructed by the Special Advocates’ Support Office) as Special Advocates

This judgment was handed down remotely at 10.30am on 31 July 2026 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

.............................

THE HONOURABLE MRS JUSTICE COLLINS RICE

Mrs Justice Collins Rice :

Introduction

[1]The Claimant is an Afghan national. By this judicial review claim, he challenges a Ministry of Defence caseworker’s decision that he was not eligible for relocation to the UK through the Afghanistan Response Route (ARR).

Background

[2]The history and purpose of the ARR was set out in some detail in the Divisional Court judgment in R (CX1) v Secretary of State for Defence

[2024] EWHC 892

(a case which had originally included a rationality challenge to the underlying policy). The context is the Ministry of Defence data breach in February 2022 which resulted in the unauthorised disclosure of a set of personal data of some 25,000 applicants for admission to the UK under the Afghan Relocations and Assistance Policy (ARAP) and a further 75,000 of their family members. These applicants were, by definition, individuals claiming they were exposed to risk of reprisal from the Taliban regime on account of their past roles working for or with the UK Government in Afghanistan during the period of GIRoA (Government of the Islamic Republic of Afghanistan) – the internationally-recognised and supported government structure in place in Afghanistan from 2004-2021, before political and military power passed to the Taliban.

[3]The ARR was a swiftly-devised government policy response to the breach, when it became apparent in 2023 that the data disclosure had not been fully contained. It opened a new and bespoke UK relocation route for those affected by, and identified as being potentially at ‘highest risk’ as a result of, the data breach. It is common ground this was an ex gratia exercise of prerogative power by choice: the Secretary of State had no statutory duty to act, and is not susceptible to challenge on the basis of the fetter on his discretion represented by the policy. The ARR became operational in April 2024, proceeding through a small number of revisions over the course of the ensuing year.

[4]The policy, and those revisions, were expressed in a series of policy statements. These identified eligibility criteria, by reference to(a) certain specified and listed roles set out in an addendum to the policy, and latterly

(b) a further category of those who had held, or claimed to have held, ‘a different high-profile role not listed … but where it has been determined by the “decision maker” that they held a role which puts them at equivalent risk to those in the identified roles’ (‘condition B(iii)’). Written guidance was provided to case-working decision-makers to help them make those determinations.

[5]The ARR policy was entirely internal and undisclosed. The policy statements and guidance were classified internal documents. That was for two reasons: first, to protect the operational content and the identification of the operational roles to which the eligibility criteria referred, for national security reasons; and second, as part of the ongoing strategy to limit the perceived risk to individuals occasioned by the data breach, including by suppressing knowledge of the fact of the breach. As part of that strategy, the MoD obtained a court injunction in September 2023. That prohibited disclosure of the fact of the data breach and the existence of the injunction itself: it was a very rare super-injunction.

[6]Consistently with the terms of the super-injunction, the ARR policy operated by MoD issuing ‘invitation letters’ to individuals assessed as eligible. These letters did not identify the policy. The way they were drafted did not distinguish them from the wider ARAP context. They operated in practice to progress an individual into the entry clearance procedure and ‘leave to remain’ system administered by the Home Office, with a view to relocation in the UK.

[7]In early 2025, the MoD commissioned an independent review of the ARR. The reviewer, Mr Paul Rimmer, reported in June 2025. The report concluded that the fact of being included in the dataset, even if it came into the hands of the Taliban regime in Afghanistan, was ‘unlikely to substantially change an individual’s existing exposure given the volume of data already available’. It also appeared unlikely that merely being on the dataset would itself be grounds for targeting by the Taliban.

[8]The Rimmer Report resulted in a Government decision on 4th July 2025 to discontinue the ARR policy. No new ‘invitation letters’ were issued, no new principal eligibility decisions taken, and no right of review was available. But eligible individuals who had already received a letter would continue to progress towards relocation. (Transitional arrangements were also made for continuing to deal with decision-making about eligible principals’ family members.)

[9]The Report, and the discontinuance of the ARR policy, also led to the discharge of the super-injunction by the court shortly afterwards. Chamberlain J held in Ministry of Defence v Global Media and Entertainment

[2025] EWHC 1806 (Admin)

at [25]-[29] that there was no plausible basis for challenging the Report’s conclusions, and that they ‘fundamentally undermined the evidential basis’ on which the Court had relied in imposing and continuing the super-injunction.

The decision challenged

[10]The Claimant did not occupy any of the high-profile roles specifically listed in the addendum to the policy. It is common ground that his only route to ARR eligibility was via ‘condition B(iii)’ – a caseworker’s determination that he had held a ‘different high-profile role not listed’putting him at equivalent risk to those in the identified roles. It is also common ground that that was his only obstacle to eligibility.

[11]The Claimant’s ARR assessment is contained in a four-page document dated 1st May 2025. It states it was carried out in accordance with the ARR policy as it stood at the time, and with the relevant caseworker guidance.

[12]It sets out the underlying factual basis on which it was made. This included a witness statement dated from August 2022 which the Claimant had submitted in connection with his (ultimately unsuccessful) ARAP application. That set out that he had, since November 2017, been part of the Directorate of Protective Service of Government Officials (DPS) ‘providing the second ring of Presidential security and security to government officers. The job was to protect the Afghan President, Afghan Ministers and foreign political figures. This directorate was implemented with support from NATO, the directorate had responsibility to protect the President, it was an independent military organisation from the interior ministry and the police.’

[13]The witness statement says the Claimant received weapons and other training from, and with, UK and Afghan military forces with a view to protecting those senior individuals from terrorist attacks. It says he had a uniform, and a ‘military position one down from Captain’. His unit was ‘like a security guard for the President’ and his individual job was as a ‘bodyguard to our directorate president, General [name]’; he accompanied this individual at all times, including in meetings with the British military and NATO, and was privy to highly sensitive material concerning national security and terrorism on a regular basis.

[14]The statement mentions three terrorist attacks – two on ministry buildings, the other at Kabul University – to which he had been part of the response. The Claimant describes the intended targets being government ministers and the president of the university, and that the response had successfully protected them, including by evacuation.

[15]His witness statement describes how, once the Taliban had come to power, they came to DPS offices and seized property, weapons and databases. He was contacted by phone and pressed for information about those the DPS had been protecting. He says the Taliban had taken many of his colleagues, and imprisoned and abused them in order to find out information about the VIPs. There was an incident of an armed attack on his home. He feared for his liberty and life, and that of his family.

[16]A quantity of documentation was attached to this witness statement. There were witness statements from family members. The assessment decision refers also to a second witness statement from the Claimant dated 10th November 2023. This expanded somewhat on the earlier statement, explaining that his role in the DPS included being ‘part of the wider security team for the President of Afghanistan, and a member of the Quick Response Unit … which was a specialist anti-terrorism unit which responded to attacks or threats on government officials and high-profile government entities, both Afghan and foreign, including embassies. The Quick Response Unit had 115 members from the DPS. … The DPS initially responded to the Administrative Office of the President of Afghanistan, but this later changed to the National Security Council … [whose] two biggest financial and logistical supporters were the American and British Governments.’

[17]Also noted in relation to the factual basis of the decision was a letter from the Claimant stating he was ‘former Afghan special forces. I was a former member of the [DPS] providing second ring Presidential security. I was part of the Crisis Response Team and the main aim of my unit was to protect the President and high-level government ministers (domestic and international) from terrorist attack. I was the bodyguard to our directorate president, General [name]’.

[18]The assessment decision then sets out a very brief summary of the evidential picture, along the lines that the Claimant ‘was a member of the security detail responding to visits by VIPs and providing security to those events. This job title does not correspond to a senior level of staff.’

[19]The assessment continues with a short set of responses to questions as follows: 1. Has the [individual] taken action to prevent Taliban activity? This could be in roles relating to counter-terrorism, counter-narcotics, anti-corruption, activities to prevent organised crime. The applicant was a Security Guard in a wider circle of the Presidential Protective Service of Government Officials (PP[S]). The evidence from the applicant suggests they were fulfilling the requirement of his job description and role within PPS, rather than military action against the Taliban, like the other high profile roles listed in Addendum A. 2. Is the applicant likely to be publicly recognised for holding the role? Reputation for carrying out this work? The applicant has not provided any specific information regarding this. 3. Has the result meant the Taliban would have taken notice? The applicant has not provided any specific information regarding this. 4. How long was the role held for and what proportion spent on anti-Taliban activities? The applicant was employed in his role for 3 years. There is no evidence of specific anti-Taliban activities carried out as part of PP[S].

[20]On that basis, the assessment concluded that eligibility condition B(iii) was not met.

[21]This is the decision challenged in these proceedings. There is a small amount of supplementary material relating to this decision. One is an earlier brief ‘ARR Assessment’ summary extract dated 24th September 2024 noting ‘Applicant was employed as a member of the presidential security team, which is not considered a high risk role…’. Another is a brief extract dated 9th January 2025 is to similar effect, noting that the Claimant’s role was not recognised as ‘high profile’ and ‘does not put the applicant at the highest risk.’

The challenge

[22]The Claimant advances two grounds of challenge to the lawfulness of the ineligibility decision.

[23]The first is that the decision-maker misapplied the ARR policy (an error of law); alternatively, that the application of the policy was irrational and productive of an irrational decision. All four of the questions featuring in the decision should, on the materials before the decision-maker, have been answered in the affirmative. The Claimant had taken action to prevent Taliban activity, because his role involved protecting VIPs from terrorist (Taliban) attacks, and responding to terrorist attacks. He had been identified and targeted by the Taliban because of his role. So the decision-maker ought rationally to have found condition B(iii) met.

[24]The second is that the decision was procedurally unfair. The decision was taken in secret and the Claimant was not aware of the ARR policy until 11 days after its discontinuance. He was not told of the decision’s date, contents or reasons until 6th March 2026 and given no opportunity to seek to modify it. That was particularly objectionable where some of the reasons suggested that insufficient information had been available to the decision-maker. It would have been open to the decision-maker, consistently with the terms of the super-injunction, to request further information from the Claimant, but no effort had been made to do so. The reasoning he had been provided with did not sufficiently explain the decision.

Legal principles and approach on review

[25]For guidance on approaching review of a decision taken in purported exercise of an unpublished internal policy, I was taken to the review of the authorities and the statements of principle in the decision of the Supreme Court in Mandalia v Home Secretary [2015]UKSC 59 at [29]-[31]. The UKSC there endorsed, as a free-standing principle of fairness, that individuals have a basic public law right to have their case considered in accordance with whatever policy has been chosen for its determination (provided it is a lawful policy), independently of whether or not they are aware of that policy. Where a public authority has adopted a policy or practice, representing how it proposes to act in a given area, the law will require it to be honoured unless there is good reason not to do so. The proper interpretation of any such policy is a matter of law which a court must decide for itself; it does not defer to the subjective interpretation of a decision-maker.

[26]For a very recent summary restatement of principles – and an example of their application in a context relevant to the present – I was referred to the two judgments of Saini J in R (CHD) v Secretary of State for Defence. The first (

[2026] EWHC 566

(Admin) at [18]-[19]) includes this: First, as to interpretation of policy. An executive policy such as the ARAP Policy is to be interpreted objectively by the court, according to the natural and ordinary meaning of the words used, read as a whole and in context, and having regard to the purpose underlying the policy. Interpretation is an objective question of law for the court. The court is not concerned with whether a caseworker’s interpretation of a policy was reasonable. Second, as to rationality. Leading Counsel each referred to ‘process’ and ‘outcome’ rationality in their submissions and it is helpful to be clear what each of these terms mean. A claimant may complain that a public body has erred in the process of reasoning by which it reached a decision (sometimes referred to as ‘process rationality’), or the claimant may complain about the outcome (sometimes referred to as ‘outcome rationality’). Process rationality includes the well-known requirement that the decision-maker must have regard to all mandatorily relevant considerations and no irrelevant ones, but it goes further. So, in addition, the public body’s process of reasoning should contain no logical error or critical gap. As sometimes said in the cases, a decision that ‘does not add up’ is one where there is an error of reasoning which robs the decision of logic. Another more practical way of putting this is to ask whether the body’s conclusions rationally flow from the evidence, or whether there is an unexplained evidential gap or leap in reasoning which fails to justify the conclusion. … Outcome rationality … on the other hand is concerned with situations where the process of reasoning is not materially flawed, but the outcome is outside the range of reasonable decisions open to a decision-maker.

[27]The second CHD decision (

[2026] EWHC 1744 (Admin)

) dealt specifically with a challenge to a decision in purported compliance with the ARR policy. Saini J said this (at [7]-[9]): In approaching the Decision and in particular the Defendant’s reasons, it was not in dispute that the context before me is one where the court must closely analyse the reasons to determine whether they provide cogent justification for the action. Essentially, this is a situation where ‘anxious scrutiny’ is required by the court given the interests at stake. See also in this regard CX1 and others v Secretary of State for Defence

[2024] EWHC 891 (Admin)

at [53]. Mr Payne KC stressed however certain additional contextual matters which he argued should affect any public law scrutiny of the Decision. This included the fact that the Decision was ‘internally’ made in some haste and in circumstances of secrecy (with reasons not for communication to the Claimant), and that it was necessarily brief and should be taken to have been informed by the factual material. Mr Payne KC also underlined that I should take into account that the Decision was not made by lawyers and should not be subject to detailed forensic analysis. He emphasised that the ARR Policy is intended to be strictly applied as a matter of prerogative powers to a carefully targeted group of high profile individuals, even though those subject of the data leak went into many hundreds of thousands of persons including dependants. The ARR Policy states in terms at [2] that it is to apply to the ‘highest risk cohort’. I accept each of these general points made by Mr Payne KC. Mr Buley KC did not take issue with them but he rightly emphasised that the Defendant was nevertheless obliged to act lawfully in accordance with the policy he himself had promulgated.

Analysis

(a) The policy and guidance documents

[28]There is no challenge in these proceedings to the lawfulness of the ARR policy. There was no dispute before me as to the meaning of the policy. But it is important to be clear at the outset about the interpretative basis on which I am approaching the key issue of its application to the Claimant’s case.

[29]The context of the policy – the data breach and the super-injunction – are of course key. The version of the policy statement current at the time of the decision (version 3.0 dated 22nd January 2025) states that the ARR was for ‘those who are at highest risk due to the [data breach] incident’. Two components of that formulation are salient. The first is ‘highest risk’. That is an evaluative and comparative concept. This was not a policy aimed at all those who were at risk, or even at high risk, but only those who were assessed to be at the highest risk. The second is ‘due to’. That is a causational reference. This was not a policy aimed at all those who were at personal risk in Afghanistan because of their past jobs, but only a specific cohort of those considered to be at highest risk, caused or enhanced as a result ofthe data leak.

[30]The policy sets out (at [25]) that ‘highest risk’ translates into a caseworker assessment that all of the eligibility criteria had been met. That is the context for the decision points in condition B(iii) that a caseworker must have assessed an individual to have held a high-profile role which put them at equivalent risk to those in the identified and listed roles. There are two components there. The role must itself have been high-profile. And the role must have put an individual at equivalent risk to those in the listed roles.

[31]The policy provides that this caseworker assessment was to be made ‘in accordance with the MoD’s caseworker guidance’. There is no challenge in these proceedings to the lawfulness of the guidance. The version of the guidance in force at the time states (at [2]) that ‘Under the Afghanistan Response Route (ARR) the risk to individuals is determined by whether they held, or claimed to hold, high profile roles’. That faithfully replicates the policy, including its central focus on the identification of a high-profile role as the first, and mandatory, gateway into potential eligibility.

[32]The guidance begins by addressing the difference between cases in which the high-profile role was itself mentioned in the leaked dataset and those where it was not; in the former case that fact itself was a risk factor, but in the latter caseworkers may need to establish whether the high-profile role was actually held. A caseworker unsure about whether a role was high-profile was advised to seek management guidance, such as where ‘an otherwise non-high profile role is linked to a high-profile role’. A specific example of an ambivalent case of this sort is given by way of some subordinate or support roles auxiliary to high-profile roles.

[33]It is notable that the guidance provides for all cases in which a caseworker proposes to make a positive eligibility assessment under condition B(iii) – that is, beyond the listed high-profile roles – to be referred to a senior decision maker and complex case panel before a final eligibility recommendation could be made. That panel in turn was required to note that the ARR policy provided that ‘The Secretary of State for Defence will act as the ‘decision maker’ for ARR eligibility decisions, on a case-by-case basis, under Condition B(iii)’; and the guidance provided that ‘all cases where a new type of role is being considered for a positive eligibility decision under condition B(iii) by the senior decision maker / complex case panel should be referred to the Secretary of State’ accordingly. A decision to admit an individual through the condition B(iii) gateway on the basis of their role, in other words, appears to have required either a ministerial decision or a ministerial precedent. That is material to interpreting the policy and the guidance. This was not apparently intended to be a routine or broad gateway, and caseworkers were not encouraged or empowered themselves to take an expansive view of it.

[34]For the case-by-case exercise of considering whether a high-profile role put an individual ‘at equivalent risk to those in a listed high-profile role’, caseworkers were addressed to two specific categories of no relevance to the present case, and then to ‘consider’the four questions set out in the Claimant’s assessment. The first asks whether, within the role, the individual had ‘taken action to prevent Taliban activity’, as to which caseworkers were guided by some role examples. The second addresses the individual’s personal (public) profile as a result of occupying the role. The third asks specifically about the role resulting in the Taliban ‘taking notice’. The fourth raises the practical issues of the duration of the tenure of the role and the extent of anti-Taliban activity within the role.

(b) The application of the policy

[35]The first question for the caseworker here was whether the Claimant had occupied a ‘high-profile role’. There is no challenge in the present case to the lawfulness of the policy’s clear and undoubted focus on ‘high-profile’ roles. This deliberate limitation on the scope of the policy, and of the size of the potentially eligible cohort as a result, was identified and underlined in CX1. During the currency of the policy there had been proper concerns that it needed to be carefully contained and managed, precisely in order not to draw attention to its existence. So prioritisation was the key (‘highest risk’) and the policy expressed that in the first place by reference to high-profile roles.

[36]Other than as indicated above, the necessary assessment of ‘high-profile’ is not further elaborated in the policy or the guidance. The Court in CX1 indicated (at [57]) that the task of the decision-maker was to give ‘individual consideration in each case to determine whether another high-profile person, albeit with a different role, falls within the highest risk category. It noted that the MoD caseworker should consider the information individuals had provided in their ARAP applications and assess ‘whether they are high-profile, and whether their role will expose them to the same risk as those in the identified roles’. I note the alternative formulation of ‘a high profile person’. Iagree with the observation of Saini J in CHD (No.2) at [21] that the policy did not require an assessment of whether a role was equivalent to one of the specified and listed roles. It simply had to be high-profile.

[37]The decision under challenge in my judgment sufficiently indicates, by citation of the relevant evidence and documentation before it, that the decision-maker did conscientiously address themselves to what the Claimant’s role was. It does not record, in as many words, an assessment of whether it was high-profile (although that was noted in the associated earlier documentation); it says the role, or job title, did not correspond to a senior level of staff.

[38]It is not suggested that it did. But the criticism is made that nothing in the policy required the relevant role to be senior. I agree with that. Not all of the specifically listed roles were senior. But some did distinguish by seniority. Seniority is not necessarily irrelevant to the question of whether a role is high- profile (or the holder ‘a high profile person’): there may well be some correspondence between the two. It would be a rational approach, and consistent with the policy and guidance, to take seniority or otherwise into account in considering whether a role was high-profile. It would also be rational, and in accordance with the policy and guidance, for the caseworker to hold in mind that this was a policy in particular focused on the potential revelation or enhanced exposure of an individual’s high-profile role as a result of the data breach, and of their ARAP candidacy for admission to the UK.

[39]Whether someone had a high-profile role is plainly an evaluative question. The Court in CX1 confirmed (at [48]) that decision-makers properly had ‘a very broad discretion’ in applying the criteria. That is consistent with there being potentially more than one rational conclusion available in many cases. Decision-makers were under no duty to take the view most favourable to an individual in those circumstances. On the contrary, while the evaluative discretion was necessarily broad, in order to take account of the open range of potentially relevant roles, it had to be applied in the context of a relatively narrow policy. Caseworkers were entitled to note the distinctively contained nature of the policy, in its application to a pre-identified set of roles and other high-profile roles subsequently approved at ministerial level. They were entitled, and indeed required, to take a correspondingly cautious approach to its application.

[40]I cannot easily see a misapplication of the policy in a finding that the Claimant did not have a high-profile role – if that is what it was. Of course, it is the case that auxiliary individuals occupying junior, or low-profile, roles might be particularly at risk precisely because of the inherent vulnerability that goes with not having a high-profile role but being in proximity to those who do. There is evidence in this case, for example, that the Claimant and his colleagues were targeted by the Taliban not because of the execution of their past role in its own right but because the role gave them access to information about individuals who did have high-profile roles, and which the Taliban sought to obtain. That might put them at high personal risk, but it did not necessarily by itself make the job a high-profile role. A high-profile role cannot simply be inferred, consistently with the policy, from the fact of an individual’s attracting Taliban attention (that may be necessary, but it is not sufficient). High-profile role is an explicit limiting factor of which a caseworker was required to be satisfied and has to be understood as such. Adjacent, supportive or auxiliary roles which were otherwise not high-profile seem to have occupied at best an ambivalent place in the scheme, but the ARR policy was at least principally aimed at the ‘highest risk’ occupiers of high-profile roles, rather than their support staff or auxiliaries, however vulnerable. No indication appears in the present case of any relevant ministerial precedent decision-making which might have assisted the Claimant.

[41]If the Claimant’s role was not assessed as being high-profile, that was the end of his eligibility journey. A caseworker was entitled to hold him ineligible on that ground alone. He did not pass through the gateway to the next stage, the ‘equivalent highest risk’ assessment based on considering the four questions.

[42]The decision challenged, however, does purport to make that assessment, by reference to those questions. Question 1 was about taking action to prevent Taliban activity. The caseworker’s note here refers to the Claimant’s role not involving ‘militaryaction against the Taliban, like the other high profile roles listed in Addendum A’. Objection is taken to this on the grounds that the action in question does not have to be military, and that in any event there was evidence before the decision maker that the Claimant’s role was military in character (he had a uniform, a military-equivalent rank, was trained by and with the military, was a General’s bodyguard, and so on). In my judgment, the caseworker would have been entitled to regard all the evidence that the Claimant had a militaryrole as at best equivocal. But I agree a military role was not required by the policy or the guidance in any event. Perhaps a military connection was not irrelevant to the proper application of the policy, but it was certainly not determinative.

[43]Objection is further taken that it must have been determinative here because the Claimant’s role did involve action to prevent Taliban activity, by protecting his VIPs from (Taliban) terrorist attacks both in safeguarding terms and, on three occasions, reactively. I agree the evidence supports that description of his role. At the same time, a personal protection role is, within the four corners of the policy and guidance, capable of being distinguished from what might ordinarily be understood as a ‘counter-terrorism role’ or even ‘anti-Taliban activity’. It seems to have been operationally confined to individual protection. A caseworker would have been entitled on the evidence to a rational and lawful conclusion that the Claimant’s role lacked the kind of personal accountabilities for decision-making, or the more strategic, targeted or proactive focus, that might have suggested ready equivalence with the examples given in the question.

[44]The decision maker in the present case noted in relation to questions three and four that the Applicant’s evidence was unspecific. Vigorous objection is taken to this by reference to the multiple instances cited in the Claimant’s narrative of his having been targeted by the Taliban on account of his persecutors’ interest in his role (and the same or worse having happened to his former colleagues). As I have noted, that appears to have been principally on account of his potential to yield information about his former VIP principals rather than by way of reprisal for his past role. But I agree there was evidence before the caseworker that the Claimant’s role was known to the Taliban during its currency and targeted for exploitation subsequently. There was at the same time no specific evidence before the caseworker capable of being extrapolated to a conclusion that the Claimant was at an enhanced risk from the Taliban, equivalent to that facing holders of the listed roles (at least some of which were covert), or indeed any enhanced risk, as a result of the data breach.

[45]Notwithstanding its tabular format, the ‘equivalent highest risk’ assessment required of the caseworker could not, consistently with the policy, have been intended to be a dissociated or mechanistic box-ticking exercise. Caseworkers were directed by the guidance to ‘consider’ the four questions and their answers. Saini J said at [19] of CHD No.2 that it would not be wrong for a caseworker to treat the questions and answers as determinative of the issue of whether an individual was at ‘equivalent highest risk’ and that it was not necessary to go on to perform some overarching risk assessment by reference to those words alone. But that is consistent with the legitimacy of a caseworker’s not losing sight of that formulation in the policy and guidance, nor of its essentially evaluative nature. Precisely because of the question format, a caseworker was required by the guidance and the policy to apply their mind to the point of each question and the evaluation of the answer by reference to it.

[46]I am not, in all these circumstances, able to identify error of law, misapplication of the policy or outcome irrationality in the decision that the Claimant was not eligible for an ARR invitation letter. The proper application of the policy and guidance to the evidence before the caseworker did not compel a finding that he held a high-profile role, nor that it was one placing him at the highest risk, equivalent to that of the specified high-profile roles, as a result of the data breach. These were evaluative matters to which more than one answer was potentially available. I am not persuaded the decision-maker failed to understand what the Claimant’s role was; on the contrary, they appear to have addressed themselves to the evidence for it in some detail and to have assessed it accordingly. The decision is consistent with the evidence that the Claimant may nevertheless have been at personal risk from the Taliban because of the access his job was assumed to have given him to information about high-profile individuals. But eligibility condition B(iii) required something different from and more than that, namely a high-profile role specification, and assessed ‘equivalent highest risk’, comparable to that of those in the listed high-profile roles, in the context of the data breach. The decision that he was not fell within the proper ambit of those rationally available on the evidence in proper pursuit of the ARR policy.

[47]The evidence before the caseworker of the Claimant’s risk at the hands of the Taliban rightly demands of a Court of Review the most anxious and attentive scrutiny of the decision-making. But it does not entitle the Court to expect or require a more expansive or inclusive approach to the policy than was properly available to the caseworker. Any policy demanding discrimination between those at high risk and those at the highest risk inevitably requires decision-makers to exclude candidates whose predicament none could envy. (c). Procedural fairness, the termination of the ARR policy, and the issue of remedy

[48]The Claimant accepted that the terms of the super-injunction prevented the disclosure of the data breach, and the ARR policy which was responsive to it, to the Claimant during the currency of the policy. But objection is made that the MoD could, and properly should, have proactively offered individuals a fair opportunity in real time to provide further evidence going to the ARR eligibility criteria, within the envelope of the ARAP process and without disclosing the existence of the separate ARR policy.

[49]It is said on behalf of the Claimant that, had he had an opportunity to provide more evidence addressed directly to the four specific eligibility questions, he must demonstrably have allayed the caseworker’s concerns about a lack of detailed evidence going to questions two and three of the test, and at least potentially elicited a positive decision. It is not said precisely what further evidence he would have provided. (I am aware of short witness statements postdating the ARR decision prepared for the purposes of this judicial review application, but they do not directly address, in terms, the condition B(iii) criteria as such.) It is also said that he was not informed of the decision and reasons promptly after the closure of the scheme.

[50]How easy – or even practicable – it would have been for the MoD to have invited individual representations during the currency of the policy without risking disclosing its existence and breaching the super-injunction is perhaps a matter of debate, if not of speculation. The absence of that feature did not noticeably trouble the Court in CX1, where a decision based on the available ARAP information was apparently envisaged as routine. ARR was a policy demanding, in its own terms, some urgency in its execution and a laser-like focus on those first in the listed high-profile roles, and then in other high-profile roles placing them at equivalent highest risk as a result of the data breach.

[51]Importantly perhaps, the ARR policy itself apparently envisaged a different solution to the challenge of operating an undisclosed casework policy in a procedurally fair (and properly informed) manner in any event. The expectation had all along been that, notwithstanding the super-injunction, the fact of the data breach would inevitably become public sooner or later during the currency of the policy, and potentially in an uncontrolled manner. The policy envisaged that, if and when it did, the ARR gateway would remain open for a limited period to enable applicants to apply for consideration against the criteria, with an opportunity to provide evidence in support; and the caseworker guidance set out that ‘individuals will be able to provide further evidence to support their claims’. There would, in other words, be a right of review in due course on a basis of full disclosure of the policy in circumstances ofcontinuing assessed risk arising out of the data breach. There is no direct challenge in the present case to the policy’s provision in this respect or otherwise. A right of review is essentially what the present Claimant now seeks to establish.

[52]It might well have been envisaged in those circumstances also that the level of detail in the reasoning provided (for negative decisions) would be scaled up from what are plainly short-form caseworker notes to the more comprehensive articulation of reasons that would usually be expected in a communication of a decision to an individual. I do not, however, consider the short-form reasons in this case inadequate to the point of procedural unfairness vitiating the entire decision. I am able adequately to perceive a rational flow from the evidence available to the decision made, for the reasons I have already given. I do not consider the reasoning – when all the underlying material is borne in mind – to disclose an unexplained evidential gap or leap in reasoning which fails to justify the conclusion that the Claimant was not eligible. His role was properly capable of being considered not ‘high-profile’; it was at most in the ambiguous auxiliary category. And in any event his risk of exposure as a result of the data breach was assessed as being not of the very highest order equivalent to that facing those in the listed roles. This was not a policy about freestanding assessment of the exposure of individuals to Taliban terror or reprisal in general. And, as I have said, the policy contained a right of review mechanism capable of completing any shortfall in the procedural fairness of individual decisions in due course.

[53]As things turned out, however, it was not the expected inevitable diffusion of knowledge of the data breach, but the Rimmer Report, that catalysed a government decision to disclose – and simultaneously revoke – the ARR policy in its entirety. There was as a result no period of time during which the ARR policy was both disclosed and operative (other than by reference to its transitional provisions for those who had already received invitation letters, and the matter of family members). The envisaged right of review fell with the policy, because inherent in the termination decision was an overall assessment that individuals were not, after all, likely to be at materially enhanced risk because of the data breach. The evidential base for the entire edifice had gone.

[54]There is no challenge in this case to the decision to close the ARR scheme – and nor is it easy to imagine much scope for such a challenge in light of Chamberlain J’s analysis in the MoD v Global Media case. The Rimmer Report had not only ‘fundamentally undermined the evidential basis’ for the super-injunction, it had done the same for the ARR policy. It had been a policy about the impact of the data breach on those in high-profile roles placing them at highest risk of the consequences of that breach. The Rimmer Report’s conclusions were that the assumptions about the consequential risk of the data breach on the basis of which the government had been proceeding were, at any rate given hindsight and the intervening passage of time, unrealistically overstated.

[55]Perhaps they always had been. The Report’s conclusions went further than identifying the redundancy of the ARR scheme. It described it as ‘an extremely significant intervention, with not inconsiderable risk to HMG and the UK, to address the potentially limited net additional risk the incident likely presents’. It was, in other words, not only unnecessary and inappropriate but potentially counterproductive. By establishing a costly bespoke scheme, and maintaining a super-injunction, the Report concluded it was possible the government had simply added artificial value to the leaked dataset, fuelling a possible perception it provided information ‘of considerably higher value’ than it did in reality, and piquing the interest of hostile state actors in accessing it.

[56]It is not, on a proper analysis, the application of the ARR policy during its lifetime which was capable of procedurally disadvantaging the Claimant; it was its termination, including its disapplication of the expected right of review. And there is no challenge in the present case to the revocation of the policy.

[57]In this context, it was suggested on behalf of the Secretary of State that I look back at the recent case of R (EBA) v Secretary of State for Defence

[2026] EWHC 1131 (Admin)

. That was a case about the closure of the ARAP scheme. It is distinguishable on the facts of the situation of the claimant in that case (he had no application in the system at the time of the closure). It was, however, a case in which a challenge of procedural unfairness (among other challenges) was made in circumstances where a scheme was closed without giving notice or leaving open a possibility of subsequent access to it. The absence of notice in that case was however inherent in and necessary to the closure policy, and not on a correct analysis a discrete procedural choice about how to deliver it. A similar observation might be made in the present case: the decision not to preserve the right of review was inherent in the rationale of the decision to revoke the entire policy, rather than a discrete choice about how to close the policy. A procedural challenge to a closed policy cannot be deployed as a collateral means of challenging the fact or terms of its closure.

[58]I test that conclusion in this way. If I had (or ought to have) reached a view that the decision in this case was vitiated by public law error, I would have had to consider the question of effective remedy. The Claimant submitted that he was entitled (whether by the route of the Human Rights Act 1998 or the Senior Courts Act 1981) to an effective remedy for any public law defect. He asked for the decision that he was not eligible for the ARR scheme to be quashed, and remitted for a fresh decision.

[59]The Secretary of State’s position on this requires a little unpacking. It was put to me variously that with the closure of the ARR scheme the case had become ‘academic’ notwithstanding the decision’s continuing operative effect, and/or that he had taken a policy decision not to retake any ARR ineligibility decisions found in judicial review proceedings to have been unlawful. This latter was objected to as an impermissible attempt to oust the jurisdiction of the court, and as producing the irrational and unfair result that while the closure of the ARR gave those individuals offered ‘invitation letters’ the benefit of a decision to ‘honour’ eligibility and progression to entry clearance, those who ought lawfully to have been found eligible would be permanently disadvantaged by nothing other than the MoD’s own unlawful conduct.

[60]On closer inspection, however, the Secretary of State’s position appears simply to be this. The Rimmer Report not only impelled the closure of the ARR scheme, it effectively hollowed it out. The whole edifice had been raised on a premise about the consequential risks of the data breach that, if it had ever been valid, had since been substantially demolished. It would now be an exercise in fiction to attempt to undertake the assessment of causative and comparative risk envisaged by the ARR policy and guidance, where the causative component had been shown to have insufficient meaningful substance to be capable of sustaining any meaningful comparisons. If the data breach is not now understood to be a materially operative general risk factor in and of itself, there is little left with which an ARR decision-maker can any longer sensibly be asked to work. The fact that others may have had the benefit of the factual premise of causative risk in the past – rightly or wrongly – cannot be cantilevered out now to give a right to a ‘remedial’ decision on a discredited premise in the present.

[61]I consider the claim ‘academic’ in the specific, and perhaps unusual, sense that although the decision challenged could in theory be quashed for any relevant defect and declared unlawful, it cannot any longer meaningfully be retaken on its own terms, and the attempt ought not to be required. The position of individuals who had already had invitation letters ushering them through the ARR gateway (all unawares) into the entry clearance system is not capable of being compared to those who have not, but who might have been sent a letter – whether because their case had been mishandled, because a caseworker had not yet got around to considering it, or simply because although found eligible an invitation letter had not yet been issued (there is no suggestion of any applicable proper order of consideration of potential condition B(iii) cases). The position of those with letters necessarily turns on the fact of the invitation alone and not on the underlying premise of risk giving rise to it.

[62]The decision to close the ARR scheme is, to repeat, not challenged in the present case; nor is the premise on which it was closed and nor are the terms on which it was closed. The Claimant cannot in my judgment properly establish an entitlement in all these circumstances to have the scheme revived or to have his case reviewed in what could only be a fiction or simulacrum of accordance with the scheme. The inference of risk from a high-profile role consequential on the data breach is no longer factually sustainable in the first place, and so the comparative evaluation of ‘equivalent highest risk’ has nothing graspable with which to make comparison.

[63]The fact that the Claimant in this case was entirely unaware of the potential application of the ARR scheme to him until it the scheme was revoked – nor of its detail until some time afterwards – and the fact that in process terms he may be left with a sense of procedural incompleteness by the revocation of the scheme – is not particular to him, and not the product of procedural unfairness to him during the scheme’s lifetime. It is the product of the substantial collapse of the scheme’s underlying factual premise. The decision reached about him was not, in my judgment, vitiated by error of law or irrational in its outcome, nor procedurally unfair, for the reasons I have already given. But even if it was, the remedy he seeks cannot sensibly be reconstituted on the artificial and hypothetical counter-factual basis that the scheme’s underlying premise has not collapsed and that there is a generally operative material causative risk arising from the data breach. That was the whole premise of the ARR and the way it worked. It would no longer be practical, reasonable, just or appropriate to order an attempt at fresh decision-making as if nothing about the factual substructure of risk analysis had changed. And, realistically, the Claimant does not advance a case that any alleged fault in the decision-making could entitle him in these proceedings to anything more than reconsideration.

Decision

[64]The Claimant’s claim for judicial review is dismissed.