London — The UK’s signals intelligence agency GCHQ cannot account for thousands of removable data storage devices, raising concerns over the security of sensitive intelligence information. The issue was highlighted in the annual report of the Investigatory Powers Commissioner’s Office (IPCO), published on October 29, 2026.
GCHQ has known about the problem for several years but still cannot establish the exact number of missing devices. These include USB sticks, external hard drives, memory cards, compact discs, and other portable storage media. IPCO described the number as “very significant,” with GCHQ estimating that the maximum could be in the thousands.
Missing Devices May Contain Sensitive Intelligence
Some devices may hold information covered by the Investigatory Powers Act 2016 (IPA), which governs communications interception and equipment interference.
The data could include intercepted emails, text messages, phone calls, and information extracted from monitored computers or phones. However, the report does not confirm the contents of the missing devices or suggest that they have reached adversaries.
Investigatory Powers Commissioner Lord Brian Leveson said GCHQ had yet to establish the scale, location, and recoverability of the missing media. He expressed concern over the delay and said the issue would remain under close monitoring.
GCHQ Introduces New Tracking System
GCHQ has launched a recovery programme to locate the missing devices. It is also introducing an automated equipment-tracking system, expected to become operational by the end of 2026.
A GCHQ spokesperson acknowledged that the previous management system was not reliable enough to track registered devices. The agency said it had acted on all IPCO recommendations, updated its procedures and tools, and conducted an equipment audit.
The new system is expected to provide a more accurate count of devices confirmed as missing.
Other Security Concerns Identified
The IPCO report also raised concerns about safeguards restricting foreign intelligence partners’ access to intercepted data collected by GCHQ. Inspectors found problems involving at least one foreign partner. Both sides agreed to address the weaknesses.
The report also identified a software bug in a target-discovery application that incorrectly flagged a small number of people as potentially involved in terrorism.
The errors resulted in five port stops under the Terrorism Act. Those stopped had their devices examined and biometrics taken.
GCHQ identified and reported the flaw. IPCO found no formal error under the Investigatory Powers Act because the activity was lawfully authorised and the faulty methodology was not foreseeable. GCHQ took steps to minimise the impact after discovering the problem.
Previous Military Document Security Breach
The findings follow a separate security incident involving the UK Ministry of Defence in March 2025.
On March 16, 2025, a football fan discovered classified military documents inside a black bin bag on a road in the Scotswood area of Newcastle. The bag had been left beneath parked cars, with papers spilling onto the road.
Several documents were marked “OFFICIAL – SENSITIVE”. They contained soldiers’ ranks, personal email addresses, shift schedules, and weapons-issue records.
The papers also detailed an intrusion detection system and access procedures for an arms storage facility at Catterick Garrison in North Yorkshire. They were handed to Northumbria Police, prompting an internal Ministry of Defence investigation.
GCHQ is the UK’s primary signals intelligence (SIGINT) agency, responsible for cybersecurity and protecting government and military information. It operates alongside MI5 and MI6 as one of the country’s three main intelligence agencies.
The IPCO report states that efforts to account for the missing devices will continue under close oversight into 2026.
——— End of Article ———
