GCHQ Cannot Account for Thousands of Removable Media, IPCO Says

GCHQ removable media that may hold sensitive intercept data is still unaccounted for, years after the problem was first raised, according to the Investigatory Powers Commissioner. In his 2025 annual report, laid before Parliament on 29 October, Lord Leveson says the agency estimates the number of USB sticks, external hard drives, compact discs and memory cards it cannot immediately locate to be “in the thousands”.

The finding is one of five the commissioner singled out. “The Government Communications Headquarters (GCHQ) still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them,” he said in IPCO’s statement on the report. The report does not say that any of the devices have reached a hostile party, and it does not say how many have been confirmed as lost.

What the report says about GCHQ removable media

The detail sits in paragraphs 4.66 to 4.68. IPCO says removable media “are utilised extensively” at GCHQ and are “an essential component of some of GCHQ’s operating processes”. The agency has now scoped “the maximum number of items of removable media that it cannot immediately locate and are therefore unaccounted for”, which IPCO calls “a very significant number”.

That figure is a ceiling, not a count of losses. GCHQ is running further work to find as many of the devices as possible, and IPCO says that “once that work is complete, GCHQ will be able to report how many devices have been confirmed as lost”. Some of the items may contain data gathered under the Investigatory Powers Act 2016, the law that governs interception, equipment interference and bulk powers.

“We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” the report says. GCHQ has commissioned a new tool to monitor the issue, storage and location of removable media, which IPCO says “will come into use in 2026”. The watchdog will require written progress reports through the year.

GCHQ told The Record that its “management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use”, and that “the findings in the report have been addressed comprehensively and all necessary steps to correct this issue have been taken”. The Record reported that a spokesperson declined to say whether the agency knew of any unauthorised access to the missing media.

Five port stops after a flawed GCHQ method

The removable media finding was not the only GCHQ issue. The report describes a case in which GCHQ “misidentified selectors in a small number of cases that were wrongly suspected of being involved in terrorism-related criminality”, because a particular software application “operated in an unusual way” that its target discovery method did not account for.

The selectors went to police and led to “five port stops under Schedule 7 to the Terrorism Act 2000” against people later found to be uninvolved. IPCO concluded that the error was not foreseeable and was not a “relevant error” under the Act, but said the people stopped suffered “serious prejudice”, including detention, device downloads and biometrics being taken.

The report also says IPCO raised “significant concerns” about whether overseas partners with access to GCHQ’s unselected bulk interception product were complying with enhanced protections for journalistic and legally privileged material.

Agent X and the wider picture in the IPCO annual report

Lord Leveson called the Agent X case, involving false evidence about an MI5 covert source given to the High Court and the Investigatory Powers Tribunal, “as serious as anything I have dealt with as Commissioner”. TSN covered MI5’s own view of emerging threats earlier this month.

The report also criticises the National Crime Agency’s handling of a juvenile covert human intelligence source, interception failings in prisons and the Ministry of Defence’s handling of detainee safeguards. Four errors met the serious error definition, and communications data applications rose 8.7%, or 28,028, in 2025.

“None of these are minor administrative failings,” Lord Leveson said, while concluding that “independent oversight is working”. In a written statement to Parliament, the Prime Minister called the report “a positive assessment” overall and told both Houses there is “material considered too sensitive for the open report, on which I have been briefed separately”.

A ceiling figure shows GCHQ lacked a reliable register

The most telling phrase in the report is “cannot immediately locate”. GCHQ’s estimate is not a count of devices known to be gone. It is the number its records cannot match to a location, which means the core failure IPCO describes is one of record-keeping: for years, the agency could not say with confidence what portable media it held or where it was. GCHQ’s own statement points the same way, describing a tracking system that was “not sufficiently robust”.

That matters because asset registers are the first control any security auditor checks. Regulated firms are routinely asked to show where sensitive data lives and on what devices; the same discipline is behind the supply-chain weaknesses inspectors found in police data suppliers and the liability debate in the UK Budget. GCHQ is also home to the National Cyber Security Centre, which advises organisations on exactly this kind of control, so the finding carries a reputational cost beyond the agency’s walls.

The open report gives no timeline for the final count, and the Prime Minister’s statement confirms a closed annex exists. Whether the confirmed-lost figure is ever published, or is reported only in that closed material, will show how far the public can judge the risk. With the Cyber Security and Resilience Bill raising expectations for private-sector providers, the state’s own record will be watched.

What IPCO will look for in 2026

IPCO says it will track GCHQ’s progress through inspections and regular written reports during 2026, by which point the new tracking tool should be running. The next annual report is the first place a confirmed-lost figure could appear.

Sources

• IPCO: Publication of Investigatory Powers Commissioner’s 2025 Annual Report (29 Oct 2026)
• Annual Report of the Investigatory Powers Commissioner 2025, HC 253 (PDF, 29 Oct 2026)
• UK Parliament: Written statement HCWS430, Annual Report of the Investigatory Powers Commissioner 2025 (29 Oct 2026)
• The Record: British spy agency cannot account for thousands of data storage devices, watchdog says (30 Oct 2026)

Related stories

• MI5 Chief Says AI-Enabled Bioweapons Are His Biggest AI Worry, and Launches an AI Threat Assessment Centre
• Police Data Suppliers Hit by Multiple Cyberattacks, Inspectors Say
• UK Budget Pledges to Consult on Who Is Liable for Cyber Breaches