Allied Intelligence — 2026-10-30

IPCO Report Finds GCHQ Cannot Account for Thousands of Storage Devices Containing Classified Data

BLUFGCHQ's multi-year failure to track removable media holding intercepted communications marks a systemic accountability gap that will persist until a confirmed loss count replaces the current "thousands" estimate.

The Investigatory Powers Commissioner's Office (IPCO) said in its 2025 annual report, released Thursday, that GCHQ cannot account for thousands of removable media devices, including USB sticks, external hard drives and memory cards 12. Commissioner Brian Leveson said GCHQ "still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it," and that the devices may contain Investigatory Powers Act data such as intercepted communications 13. GCHQ estimates the number is "in the thousands" and is still working to establish how many are confirmed lost 13. A GCHQ spokesperson said its tracking system was "previously not sufficiently robust" and that it has acted on all IPCO recommendations; Computer Weekly reported GCHQ introduced a monitoring tool this year, while Yahoo News reported it is scheduled to enter use in 2026 12. Yahoo News noted the findings do not establish theft or unauthorized access 1.

Analysis
GCHQ's failure to account for removable media is now a multi-year oversight problem, not a one-off audit gap: IPCO first raised it in 2023, and the 2024 report flagged the same shortfall at GCHQ and MI5. The devices may hold Investigatory Powers Act material, including intercepted communications, yet no source reports theft or unauthorized access. Poor issue-and-return record-keeping, rather than physical loss, may instead account for much of the gap, since the 2024 report said most missing items were encrypted or PIN-protected. The new tracking tool, described as introduced this year by one outlet and due in 2026 by another, is the next checkpoint, and IPCO will require written progress reports through the year. A confirmed loss count, not the current "thousands" estimate, would show the possible harm. Confidence is high, based on four outlets reporting consistent core facts and GCHQ's on-record acknowledgment, though two relay Politico, which limits independence, and the tool's timing rests on conflicting accounts.

4 sources

UK Spy Agency Cannot Account for Thousands of Storage Devices - Yahoo News
UK surveillance watchdog 'disappointed' over government investigatory powers failings - Computer Weekly
GCHQ cannot account for thousands of storage devices - Mezha
British intelligence lost thousands of flash drives with secret data - ZN.ua