GCHQ cannot account for thousands of data storage devices

The Investigatory Powers Commissioner’s Office found that GCHQ was unable to account for thousands of portable data storage devices as of its 2025 annual report. The missing equipment includes USB sticks, external hard drives, CDs, and memory cards. The devices may contain sensitive or classified data obtained under the Investigatory Powers Act 2016, including intercepted communications and information extracted from computers or phones. The report does not allege that any devices have fallen into unauthorized hands, and the absence of an allegation is not a finding that no compromise occurred.

The commissioner’s office first intervened in 2023, directing MI5 and GCHQ to examine how they issue and track portable media. The 2023 report did not mention the problem at all, so the 2024 edition was the first to address it publicly, recording that both agencies were unable to find a substantial number of devices potentially holding data classified from OFFICIAL-SENSITIVE up to TOP SECRET. Most unaccounted items in that earlier count were encrypted or required a PIN to access. The 2025 edition focuses on GCHQ alone and does not provide an update on MI5, though the commissioner has raised the matter with the agency for years, and IPCO said the historical gaps stemmed from weak controls, not from any specific theft or adversary action.

Sir Brian Leveson, the Investigatory Powers Commissioner, said GCHQ has not developed a clear picture of how many devices are missing, where they are, or whether recovery is possible. “We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” IPCO said. Leveson said the unresolved issue undermines confidence in data safeguards, noting that consistent and well-understood protections matter even under operational pressure. A year earlier, in 2024, Leveson had said GCHQ still could not explain the fate of removable media that might hold sensitive data, despite raising the matter years before.

GCHQ acknowledged that its previous system for tracking registered portable media was inadequate, leading to inaccurate records. The agency says it has completed a comprehensive audit of its portable media devices and revised its procedures and tools to reduce risks, and it claims to have addressed every recommendation IPCO made. A GCHQ spokesperson would not say whether anyone unauthorized has accessed the missing media, while acknowledging the old tracking system was inadequate. The agency has produced no evidence that unauthorized parties accessed any device.

GCHQ’s current estimate places the number of portable media items it cannot find in the thousands, but the report describes this figure as an upper limit, not a verified count of lost items. The agency is conducting an effort to locate and account for as many devices as possible, and the agency will publish a confirmed loss figure only after that work concludes. IPCO will require GCHQ to submit written progress reports at regular intervals during 2026, and a new tracking tool will come into use in 2026. Whether this new tool replaces or supplements earlier tracking systems is unclear.

GCHQ makes extensive use of removable media, which play an essential role in some of its operations. The lost devices stem from a past lack of strong audit controls over the issuance and return of removable media, according to IPCO. The devices may contain data obtained under the Investigatory Powers Act 2016.

IPCO’s remit includes vetting requests for intrusive surveillance and checking that safeguards under the Investigatory Powers Act 2016 are followed. The office monitors how UK intelligence agencies exercise their surveillance powers and has jurisdiction over more than 600 public bodies, ranging from intelligence agencies and law enforcement to police, councils, and prisons. All public bodies are required to have adequate safeguards in place for material obtained through investigatory powers. Under Section 234(6) of the Act, the annual report is presented to Parliament, and the public version is not the complete document as some sensitive details were withheld for reasons of national security, with the commissioner sending a separate letter to the Prime Minister about the withheld material.

The same report identifies problems with how foreign partners access data obtained through bulk interception. It also describes how a software error resulted in people being wrongly detained under the Terrorism Act, and it criticizes MI5 for its management of informant Agent X and for presenting false evidence to the High Court. These issues, together with the removable-media problem, point to broader challenges across the intelligence community.