An independent oversight body says GCHQ cannot locate thousands of removable storage devices that may contain sensitive data. The report does not allege any device reached adversaries. GCHQ says its tracking system was previously not robust enough and that it has acted on all recommendations.
GCHQ cannot account for the whereabouts of thousands of storage devices that could contain sensitive material, according to an official watchdog. The 2025 report from the Investigatory Powers Commissioner's Office (IPCO) concluded that the agency has failed to establish the location or status of thousands of removable devices such as USB sticks, external hard drives and memory cards. IPCO also flagged a very significant number of GCHQ drives that have been missing for years and have yet to be found.
The media covered includes USB sticks, external hard drives, compact discs, memory cards and other portable storage devices. IPCO said GCHQ uses removable media extensively and that it is essential to some of the agency's operating processes. Some of the media may contain data related to the Investigatory Powers Act 2016. The exact number of missing devices is unconfirmed, but GCHQ estimates it to be in the thousands, and the IPCO report matches that estimate. GCHQ is undertaking work so it can report how many have been confirmed as lost.
Oversight body voices concern
IPCO said it remains very concerned by the scale of the losses and is disappointed with the time GCHQ has taken to investigate. Commissioner Sir Brian Leveson wrote that GCHQ has not yet established a sufficiently clear understanding of the scale, location and recoverability of the lost media that may contain data tied to the Act. He added that the underlying issues were first drawn to his attention several years ago. He said he will keep monitoring progress closely given the potential sensitivity of the material involved. According to The Register, GCHQ officials have known about the lost media for years but are still unsure about the scope of the problem.
GCHQ's response
A GCHQ spokesperson acknowledged that its management system for removable media was previously not robust enough to effectively track the items registered for use. The spokesperson said the agency has taken action against all of IPCO's recommendations. The report describes a programme of further work to locate and account for as many of the devices as possible. GCHQ has also commissioned a new tool to monitor the issue, storage and location of removable media, with use planned for 2026.
The report does not allege that any device has ended up in the wrong hands or fallen into the hands of adversaries. When approached by The Record, a GCHQ spokesperson declined to say whether the agency was aware of any unauthorised access to missing media.
Innocent people wrongly flagged
The same IPCO report disclosed that flawed intelligence from an unnamed app led GCHQ to misidentify selectors in a small number of cases. In those cases, innocent members of the public were wrongly suspected of involvement in terrorism-related criminality. The report attributes this to an unnamed software application that operated in an unusual way, making GCHQ's target discovery methodology unreliable without the agency's knowledge. Five people wrongly flagged were stopped at UK ports under counter-terrorism powers, detained, and had their devices downloaded and biometrics taken, despite having no involvement in the activity under investigation.
