GCHQ cannot account for thousands of storage devices, watchdog says
Britain’s spy agency GCHQ cannot account for thousands of portable storage devices that may hold sensitive data, the UK’s official surveillance watchdog has said. The devices — USB sticks, external hard drives, compact discs and memory cards — were used in GCHQ’s work, and some may hold information gathered under the Investigatory Powers Act, the law governing British surveillance powers.
The finding comes from the 2025 annual report of the Investigatory Powers Commissioner’s Office (IPCO), published on Thursday 29 October. Commissioner Lord Brian Leveson said GCHQ had still not worked out how many devices were missing, where they were, or whether they could be recovered, although the problem was first raised several years ago.
The report does not say that any of the devices have fallen into the wrong hands, and the exact number confirmed lost is not yet known. GCHQ has worked out the maximum number it cannot immediately locate — described in the report as “a very significant number” — and says a new automated tracking system should be running by the end of the year. GCHQ said its old tracking system was “not sufficiently robust” and that it had acted on all of the watchdog’s recommendations.
The same report found that a software fault at GCHQ wrongly flagged a small number of people as possible terrorists, leading police to stop five people at ports under the Terrorism Act. The watchdog said the error was not foreseeable and that no error had been made under the terms of the Act, but called the impact on those affected “highly unfortunate and regrettable”.
Why it matters
GCHQ is Britain’s signals-intelligence agency, and the data on these devices could include intercepted communications and material gathered by hacking. The watchdog’s concern is not only that the devices are missing, but that years passed without a clear count of what was lost — a gap that makes it hard to judge the risk.
What happens next
GCHQ is carrying out further work to find as many of the devices as possible, and the watchdog says it will keep tracking progress through inspections and regular written reports during 2026. The next annual report is expected to be the first place a confirmed number of lost devices is published. The watchdog said overall it was satisfied that independent oversight of Britain’s covert powers was working.
This article is for general information and education only. It is not legal or financial advice.
Sources
- https://www.theregister.com/security/2026/10/30/british-intelligence-agency-misplaced-thousands-of-storage-devices-years-later-still-cant-say-how-many/5306605 (The Register, 30 October 2026)
- https://www.computerweekly.com/news/366652841/UK-surveillance-watchdog-disappointed-over-government-investigatory-powers-failings (Computer Weekly, 29 October 2026)
