Public investigation into SAS leads to deleted computer evidence

As the BBC has revealed, the public inquiry into alleged war crimes committed by the SAS in Afghanistan has uncovered a previously deleted database that could contain crucial evidence.

The files were permanently deleted from a server by a British special forces contractor in 2016 during an SAS murder investigation.

But the public investigation team has now secured backups of the server – which is part of a special forces communications system codenamed “Sonata” – and is said to have been created before the files were deleted.

The backups likely contain information about SAS operations in which members of the elite regiment were suspected of unlawfully killing unarmed Afghan prisoners and civilians.

A spokesman for the investigation confirmed to the BBC that they had received the backups, adding: “We now have the relevant material and are considering a technical solution to retrieve and review the data to determine its relevance to the investigation.”

The spokesman said that over the course of several days of hearings on computer evidence last December, the inquiry team was contacted by someone offering access to the backups, but the inquiry declined to comment on the source of the offer.

This is the first time that investigators outside of the British Special Forces have obtained backup copies of Sonata, blocking previous attempts by the Royal Military Police (RMP) to copy the server.

To the horror of RMP investigators, in 2016 a contractor hired by the UK Special Forces (UKSF) during the murder investigation ran a program on the server that could irretrievably delete previously deleted files.

This process, known as ‘zeroing’, contravened the RMP’s explicit instructions to UKSF that no data should be tampered with before the server was copied.

During the force’s investigation into the SAS, the RMP quickly identified Sonata as a possible source of key evidence. However, according to lead investigator Maj Jason Wright’s internal log, the RMP’s efforts to access or copy the server met resistance and delays from the UKSF from the outset.

According to the logbook, Maj Wright, then a Captain, also encountered resistance within the RMP. He wanted to use the force’s legal powers to seize the server, but his superior, Gold Commander John Harvey, instructed Maj Wright not to use them.

After months of downtime, UKSF informed the RMP of its intention to migrate the server’s contents to a new system. If RMP investigators waited for this process to be completed, they would then be able to take physical possession of the old server and all data stored on it.

According to RMP Warrant Officer James Priddin, who led the technical effort to seize the server, this plan was agreed at the highest levels, following a “gentlemen’s agreement” between then-Director of Special Forces General James Chiswell and then-Head of RMP Brigadier General David Neal that the RMP would not seize the server using police powers.

Ministry of Defence documents disclosed during a court case several years later revealed that shortly before this agreement was concluded, Brigadier Neal had been accused by an RMP colleague of attempting to wrongfully close down a separate SAS murder investigation.