● Covered by 2 sources · 2 reportsMedium impact2 negative
GCHQ Cannot Account for Thousands of Data Storage Devices, Watchdog Reports
Key points
- GCHQ cannot account for thousands of portable data storage devices.
- Devices include USB sticks, external hard drives, and memory cards.
- Some devices may contain sensitive data obtained under the Investigatory Powers Act.
- IPCO expressed concern over the lack of progress in resolving the issue.
- GCHQ acknowledged tracking system deficiencies and is implementing new measures.
Thousands of Storage Devices Missing
The British cyber and signals intelligence agency GCHQ has reported that it cannot account for thousands of portable data storage devices. These devices include USB sticks, external hard drives, compact discs, and memory cards. The Investigatory Powers Commissioner’s Office (IPCO) highlighted this issue in its annual report for 2025, expressing significant concern.
Watchdog Expresses Disappointment
Sir Brian Leveson, the Investigatory Powers Commissioner, stated that GCHQ has not yet established a clear understanding of the scale, location, or recoverability of the lost devices. He noted that the underlying issues were first brought to his attention several years ago, and he is disappointed with the time taken to investigate. The report emphasizes that removable media are utilized extensively by GCHQ and are essential to some of its operating processes.
Potential for Sensitive Data Exposure
A key concern is that some of the missing devices may contain data obtained under the Investigatory Powers Act. This act grants powers to intelligence agencies and police to intercept communications and hack suspect devices. While the report does not allege that any devices have fallen into unauthorized hands, the potential sensitivity of the material involved is a significant worry.
GCHQ's Response and Remediation Efforts
GCHQ acknowledged that its tracking system for removable media had been insufficient. In response, the agency has taken steps to prevent similar incidents in the future. These measures include implementing a program to locate the lost media and developing an automated asset-tracking system, which is expected to be in place by 2027.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
The UK's GCHQ has misplaced a "very significant number" of removable storage drives containing potentially sensitive data, with the issue known for years without a clear understanding of the scope. The Investigatory Powers Commissioner's Office (IPCO) expressed concern over the lack of progress in locating the drives and establishing a comprehensive account. GCHQ acknowledged tracking system deficiencies and stated it has implemented measures and launched a program to find the lost media, with an automated asset-tracking system due by 2027.
The British cyber and signals intelligence agency GCHQ cannot account for thousands of portable data storage devices, including USB sticks and external hard drives, according to its official watchdog, the Investigatory Powers Commissioner’s Office (IPCO). This issue is concerning because some devices may contain sensitive data obtained under the Investigatory Powers Act, and GCHQ has not yet determined the full scale of the problem despite it being raised years ago.