The UK signals intelligence agency GCHQ cannot account for thousands of portable storage devices, according to the Investigatory Powers Commissioner’s Office (IPCO), which oversees the UK’s surveillance powers.
What happened
- IPCO’s annual report for 2025 says GCHQ cannot account for thousands of USB sticks, external hard drives, CDs, memory cards, and other portable media.
- The Commissioner, Sir Brian Leveson, said GCHQ had not yet worked out how many devices are missing, where they are, or whether they can be recovered, and raised concern about how long its investigation was taking.
- Some devices may hold data obtained under the Investigatory Powers Act. The report does not say that any device has reached a hostile party.
Why it mattered
Even an organisation whose whole purpose is protecting sensitive information struggled to track removable media over several years.
Lessons for organisations
Keep an up-to-date register of removable media, restrict its use to approved encrypted devices, and reconcile the register regularly (ISO/IEC 27001 controls A.5.9 and A.7.10).
Source: The Record
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
