GCHQ has failed to account for thousands of removable storage devices, according to the 2025 report from the Investigatory Powers Commissioner's Office (IPCO). The devices include USB sticks, external hard drives and memory cards.
The exact number remains unconfirmed, but the report says GCHQ itself estimates that the total is “in the thousands”. The agency is carrying out further work to locate the devices and determine how many have been definitively confirmed as lost.
IPCO said it was “very concerned” and “disappointed” by the time GCHQ has taken to investigate the issue and implement corrective measures. The matter had already been raised in the watchdog's 2024 report, which said GCHQ and MI5 had been asked to review how removable media was allocated and audited.
Many of the missing devices are believed to be protected by encryption or PIN access. However, the report noted that the sensitivity of the information potentially stored on them means the situation could still present a significant risk.
IPCO acknowledged the technical and practical difficulties involved in the investigation but called for continued oversight at senior level. GCHQ has also commissioned a new tool to monitor the issue.
Sources: TechRadar.