GCHQ cannot account for a very significant quantity of removable storage devices, according to the Investigatory Powers Commissioner’s Office annual report. The UK signals-intelligence and cybersecurity agency has begun efforts to find the media and replace its unreliable tracking process.
The oversight finding was identified in the commissioner’s annual review, as first reported by Tom’s Hardware. The Register characterized the scale as thousands of devices, while the report itself uses the less precise description of a very significant number.
GCHQ’s previous system did not reliably track media
GCHQ acknowledged that its former removable-media management system did not consistently track registered items. The agency said it has acted on recommendations from the Investigatory Powers Commissioner’s Office and introduced measures intended to reduce the risks associated with portable storage.
Lord Brian Leveson, the investigatory powers commissioner, said GCHQ had yet to establish the number of devices involved, where they were located or how likely recovery would be. The agency knows an upper limit for the potentially unaccounted-for media, though it has not determined the exact total.
The lapse raises oversight concerns around surveillance records
The devices may contain information associated with the Investigatory Powers Act, the 2016 law that sets the framework for communications interception and related UK data collection. IPCO oversees how public authorities use those powers, making reliable records of agency-held material a basic part of effective scrutiny.
GCHQ performs functions broadly comparable to those of the US National Security Agency, so a tracking failure of this scale has implications beyond routine IT asset management. Removable media can carry sensitive material outside central systems, where its handling and access controls may be harder to monitor.
GCHQ plans to deploy automated asset tracking to create a more accurate inventory. It remains unconfirmed how many devices are unaccounted for, what information they held, whether any data was accessed or disclosed, and how many items can be recovered. Reports also differ on when the automated system will be operating, with timelines described as either by the end of the year or before 2027.
This article was produced with AI assistance from multi-source reporting and is published under our editorial standards.
