Thousands of GCHQ storage devices remain unaccounted for, according to the Investigatory Powers Commissioner’s Office (IPCO). Its 2025 annual report says the UK intelligence agency cannot immediately locate the items, some of which may contain sensitive information.
Regulator identifies gaps in device tracking
The equipment includes USB sticks, external hard drives, compact discs, memory cards and other removable media. According to IPCO, GCHQ uses these devices extensively, and they support essential parts of some operating processes. However, weaknesses in tracking have left the agency unable to establish the whereabouts of thousands of registered items.
GCHQ has estimated the maximum number of devices it cannot immediately locate. Nevertheless, that figure does not represent a confirmed total of permanently lost equipment. The agency must complete further work before it can establish how many items it has actually lost.
This distinction matters when assessing the regulator’s findings. An unaccounted-for device may reflect an incomplete tracking record rather than a confirmed disappearance. However, the scale of the uncertainty has prompted IPCO to require continued oversight.
Some GCHQ storage devices may hold sensitive data
The report raises concerns that some unaccounted-for media could contain information associated with the Investigatory Powers Act. That could include potentially sensitive material connected to the agency’s work. However, the supplied findings do not establish what information each device contains or whether anyone outside GCHQ accessed it.
GCHQ acknowledged the risks and commissioned a new tool to monitor the storage and location of removable media. The initiative aims to improve its ability to account for equipment across its systems. Meanwhile, IPCO said it would monitor progress through regular inspections and written updates throughout 2026.
The regulator’s focus therefore extends beyond establishing a final count of lost devices. It also covers GCHQ’s efforts to resolve the tracking problem. Regular reporting will allow IPCO to assess the agency’s progress towards completing that work.
Agency says it has addressed recommendations
A GCHQ spokesperson acknowledged that its previous tracking system lacked sufficient robustness. As a result, the agency struggled to keep track of registered removable media. The spokesperson said GCHQ had acted on all recommendations from the regulator.
In addition, the agency said it maintains several measures to reduce the security risks associated with removable storage. It described its response to the findings as comprehensive and said it had taken the necessary corrective steps. However, those assurances did not provide a final public total of confirmed losses.
The unresolved count remains separate from the improvements to tracking procedures. Although GCHQ says it has addressed the recommendations, the report describes further work to determine the status of unaccounted-for items. Until that process concludes, the number of GCHQ storage devices confirmed as lost remains unclear.
0 responses to “GCHQ storage devices: Thousands remain unaccounted for”