GCHQ, the intelligence agency based in Cheltenham, cannot account for thousands of USB sticks, hard drives and memory cards that may hold sensitive data. The finding is in the annual report of the Investigatory Powers Commissioner, Brian Leveson, published on Thursday 29 October.
What Happened
Mr Leveson says GCHQ still cannot explain what has happened to removable media that may hold sensitive data, years after he first raised the issue with the agency. He said the devices may contain data held under the Investigatory Powers Act 2016, which covers intercepted communications such as emails, texts and phone calls, as well as material taken from people’s computers and phones.
Thousands of Devices Unaccounted For
GCHQ currently estimates the number of missing devices to be “in the thousands” and is working out how many have been confirmed as lost. The report says the items are used extensively and are an essential part of some of GCHQ’s operating processes.
A GCHQ spokesperson said its management system for removable media “was previously not sufficiently robust to effectively track the items that were registered for use”. The agency said it had acted on all of the watchdog’s recommendations.
Background
The watchdog disclosed last year that GCHQ and MI5 had been unable to locate considerable numbers of storage devices, some of which may have held information classified TOP SECRET.
The same annual report also covers MI5. It found serious and systemic failures in the agency’s conduct in the case of an abusive informant known as agent X, after MI5 gave false evidence to three courts. Errors by MI5 involving agents rose from four in 2017 to 21 in 2025.
What Happens Next
GCHQ is working to confirm how many of the devices have been lost, and Mr Leveson has said he remains concerned about the delay in that work. Separately, the High Court is due to decide what action, if any, to take against MI5 over the agent X case.
This is a developing story and will be updated as more information becomes available.
