British spies can't find thousands of USBs and hard drives with top-secret data

Britain’s Government Communications Headquarters, known as GCHQ, cannot determine the location of thousands of portable storage devices that may hold highly sensitive national security data, according to a new report released on Thursday. The Investigatory Powers Commissioner Office, or IPCO, stated that a significant quantity of USB sticks, hard drives, and memory cards are missing from the agency’s inventory. The oversight body, which monitors how British intelligence services exercise their legal authorities, expressed deep concern over the situation. It criticized the slow pace of the internal investigation conducted by GCHQ regarding the disappearance of these items. Investigatory Powers Commissioner Brian Leveson highlighted the duration of the issue in his remarks. He stated that GCHQ still cannot explain what happened to the removable media that might contain sensitive information. Leveson noted that he first raised this specific problem with the agency several years ago. The report indicates that the missing hardware could store data related to the Investigatory Powers Act 2016. This legislation governs the collection and retention of certain types of intelligence. Such data carries a high level of sensitivity and includes intercepted communications like emails, text messages, and phone calls. It also encompasses information extracted from individual computers and mobile phones. GCHQ currently estimates that the number of unaccounted-for devices is in the thousands. The agency is working to verify exactly how many units have been confirmed as lost. Once this verification process is complete, GCHQ intends to report the final figures. The IPCO report emphasizes that the agency’s previous management system for tracking removable media was not robust enough to effectively monitor registered items. Consequently, the data generated by that system contained flaws, which the watchdog correctly identified. This finding builds on disclosures made last year by the IPCO. At that time, the office revealed that both GCHQ and the Secret Intelligence Service, commonly known as MI5, failed to locate large numbers of storage devices. Some of those missing items potentially held information classified as top secret. The current report reiterates the severity of the risk associated with losing control of physical media that stores such high-level secrets. The watchdog remains disappointed with the time it took for GCHQ to conduct its inquiry into the matter. In response to the findings, a GCHQ spokesperson acknowledged the deficiencies in their past practices. The spokesperson admitted that the management system for removable media was previously insufficient for effective tracking. They agreed with the IPCO’s assessment regarding the flaws in the data produced by that system. GCHQ stated that it has taken action in accordance with all recommendations issued by the commissioner’s office. The agency emphasized its awareness of the critical importance of securing removable media within its infrastructure. To address the vulnerabilities, GCHQ said it is applying a range of measures designed to mitigate the risks posed by these devices. The spokesperson asserted that the findings detailed in the report have been comprehensively addressed. All necessary steps to correct the issue have been taken, according to the agency. The statement underscored the commitment to improving security protocols for portable storage units used in intelligence operations. The release of this report highlights ongoing challenges in the physical security of digital assets within the British intelligence community. While electronic safeguards are often discussed, the loss of physical hardware presents a distinct threat vector. The IPCO continues to play a crucial role in holding these agencies accountable for the proper handling of classified materials. The focus on portable media reflects the increasing reliance on small, easily misplaced devices in modern surveillance activities. The discrepancy between the estimated number of missing devices and the confirmed losses remains a key area of scrutiny. Until GCHQ completes its verification work, the exact scale of the loss will remain an estimate. The IPCO’s criticism of the investigation timeline suggests that internal processes may need further acceleration. Stakeholders in national security are watching closely to see if the implemented measures prevent future incidents of missing equipment. The involvement of MI5 in similar issues, as noted in last year’s disclosure, points to a broader systemic challenge rather than an isolated failure at one agency. Both organizations operate under similar legal frameworks and face comparable operational pressures. The potential exposure of top-secret information through lost hardware underscores the stakes involved in maintaining strict chain-of-custody procedures. GCHQ’s admission that its tracking system was flawed provides insight into why the devices went missing. Without reliable automated tracking, manual errors or procedural lapses can lead to unrecorded movements of equipment. The corrective actions mentioned by the spokesperson aim to close these gaps. However, the effectiveness of these new measures will likely be subject to continued review by the IPCO. The report serves as a formal record of the agency’s struggles with asset management. It documents the period during which thousands of devices were untraceable. For policymakers and the public, it offers a glimpse into the logistical complexities of managing vast amounts of classified digital data. The emphasis on remedial steps signals an effort to restore confidence in the agency’s ability to protect state secrets. As the investigation concludes, attention will turn to whether any of the missing devices were recovered or if they remain permanently lost. The classification levels of the data stored on these devices will determine the extent of the potential breach. GCHQ’s cooperation with the IPCO in providing accurate figures is essential for resolving the matter. The ongoing dialogue between the watchdog and the intelligence service aims to ensure that such lapses do not recur in the future.