Science & Tech · Cybersecurity · 4 hrs ago
GCHQ cannot account for thousands of storage devices, watchdog says
UK intelligence agency GCHQ cannot account for thousands of storage devices, a watchdog says.
The missing items include USB sticks, hard drives and memory cards that could hold highly sensitive information gathered or held under the Investigatory Powers Act.
The Investigatory Powers Commissioner oversees how UK intelligence agencies use their spying powers.
The commissioner said GCHQ still could not explain what happened to the devices, despite the issue being raised years ago.
The watchdog is concerned by the delay and says GCHQ is working to establish how many devices are confirmed lost.
GCHQ said its former tracking system was not robust enough and that it has acted on the watchdog’s recommendations.
The devices’ whereabouts remain unclear, and the information they may contain could include intercepted messages or data taken from computers and phones.
GCHQ cannot account for thousands of removable storage devices that could contain sensitive data, according to a report by the Investigatory Powers Commissioner’s Office.
The watchdog said the agency still does not know the exact scale, location or recoverability of the missing devices.
GCHQ said its previous system for tracking removable media was not sufficiently robust and that it has acted on the watchdog’s recommendations.
The agency is working to locate devices and plans to introduce an automated asset-tracking system by the end of the year.
The report said the issue had been known to officials for several years.
- Who
- GCHQ, the British signals intelligence agency, cannot account for the devices. The Investigatory Powers Commissioner’s Office raised concerns.
- What
- Thousands of removable storage devices are unaccounted for and may contain sensitive, potentially Investigatory Powers Act-related data.
- When
- The issue had been known for several years. The watchdog’s report was published on October 29, 2026.
- Where
- Britain.
- Why
- GCHQ’s previous management system for removable media was not sufficiently robust to track devices registered for use.
Investigatory Powers Commissioner’s Office
GCHQ
Scale and tracking
Investigatory Powers Commissioner’s Office
The watchdog said GCHQ still lacked a sufficiently clear understanding of the scale, location and recoverability of the missing media.
GCHQ
GCHQ said its previous tracking system was not sufficiently robust and that it is working to locate devices and improve tracking.
Response
Investigatory Powers Commissioner’s Office
The watchdog said it remained concerned and was disappointed by the time taken to investigate.
GCHQ
GCHQ said it had acted on all the watchdog’s recommendations and taken the necessary steps to correct the issue.
The underlying issues with GCHQ’s removable-media tracking were first brought to the commissioner’s attention.
IPCO disclosed that GCHQ and MI5 had been unable to locate considerable numbers of storage devices.
IPCO published a report saying that thousands of GCHQ storage devices were unaccounted for.
GCHQ plans to have an automated asset-tracking system in place.
- Agency
- GCHQ
- Missing devices
- Thousands of removable storage devices
- Potential data
- Investigatory Powers Act-related data
- Watchdog
- Investigatory Powers Commissioner’s Office
- Planned tracking system
- Automated asset-tracking system by the end of 2026
3 sources
What people are saying
I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data, notwithstanding that the underlying issues were first drawn to my attention several years ago
still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them
As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use.
We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate