The UK's spy watchdog, the Investigatory Powers Commissioner's Office (IPCO), has warned that GCHQ cannot account for thousands of removable storage devices that may hold sensitive data, including intercepted emails, texts and phone calls collected on national security grounds.
In a report, the commissioner, Lord Brian Leveson, said the issue was first raised years ago and voiced disappointment that it had not been resolved. It is unclear how many of the missing items, including USB sticks and memory cards, have been permanently lost.
Scope of the problem
The commissioner's report states: "GCHQ has now scoped the extent of the issue in terms of the maximum number of items of removable media that it cannot immediately locate and are therefore unaccounted for."
"This is a very significant number, which GCHQ currently estimate to be in the thousands, and there is a programme of further work to locate and account for as many of these devices as possible. Once that work is complete, GCHQ will be able to report how many devices have been confirmed as lost."
The report continued: "We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate."
Potential sensitive data
Some of the data on the devices could have been collected or held under the Investigatory Powers Act 2016, according to the report. This means they could include intercepted communications as well as information extracted from computers and phones.
In its 2024 report, IPCO said GCHQ and MI5 could not account for a large number of devices which could contain top secret information.
Lord Leveson said: "The Government Communications Headquarters (GCHQ) still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them."
He continued: "Operational pressures are real, but they do not reduce the need for lawful, consistent and well-understood safeguards. I will not hesitate to report failure to demonstrate real improvement."
GCHQ response
A GCHQ spokesperson said: "As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use. IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations."
"We recognise the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items. The findings in the report have been addressed comprehensively and all necessary steps to correct this issue have been taken."
