Watchdog: UK's GCHQ cannot account for thousands of portable storage devices

The United Kingdom's signals intelligence agency, GCHQ, cannot fully account for thousands of portable data storage devices, according to an oversight report covered by The Record on October 30, 2026. The finding comes from the 2025 annual report of the Investigatory Powers Commissioner's Office (IPCO), the independent watchdog headed by Sir Brian Leveson that oversees the use of the UK's surveillance powers.

What happened

According to The Record, IPCO said GCHQ has not yet established 'a sufficiently clear understanding' of the scale, location and recoverability of missing portable storage devices, including USB sticks, external hard drives, compact discs and memory cards. The agency estimated the total losses as being 'in the thousands,' though no exact figure is given and it is unclear whether a subsequent audit has pinned down how many items are genuinely lost. The Record notes GCHQ characterizes the problem as a record-keeping failure rather than physically lost items.

Why it matters

The report says GCHQ uses removable media extensively and that it is essential to some operations, according to The Record. Some of the devices may contain data obtained under the Investigatory Powers Act, the law that grants UK agencies powers to intercept communications and hack suspects' devices. Importantly, the report does not allege that any devices reached adversaries, and The Record says GCHQ declined to state whether it is aware of any unauthorized access. The concern is one of control and accountability over sensitive media rather than a confirmed breach. IPCO also said the underlying issues were raised several years ago and expressed concern about how long GCHQ took to investigate.

GCHQ's response

The Record reports that GCHQ acknowledged its removable media management system 'was previously not sufficiently robust' to track registered items. A spokesperson said IPCO was right to flag the flaws in its data and that GCHQ had acted on all of the watchdog's recommendations. According to the report, GCHQ has completed a full audit of its holdings, updated its processes and tools, and kept IPCO informed throughout.

A separate finding

The same IPCO report flagged a distinct problem, The Record says: flawed GCHQ intelligence wrongly suspected innocent members of the public of terrorism-related criminality in 'a small number of cases.' This led to five port stops under counter-terrorism powers, during which people were detained, had their devices downloaded and had their biometrics taken. IPCO attributed the errors to an unnamed internet application that made GCHQ's target-discovery methodology unreliable -- a flaw the agency said it did not know about. The watchdog said the issue could not have been foreseen and that 'intelligence can sometimes simply be wrong.' GCHQ declined to comment on this point, according to The Record.

For organizations outside the intelligence world, the episode is a reminder that removable media remains a hard problem to govern at scale: without reliable inventory and lifecycle tracking, even a well-resourced institution can lose sight of where sensitive data physically resides.