British spy agency cannot account for thousands of data storage devices, watchdog says

British cyber and signals intelligence agency GCHQ cannot account for thousands of “USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices,” the official watchdog has disclosed.

The Investigatory Powers Commissioner’s Office (IPCO) in its annual report for 2025, published Thursday, said it was “very concerned” and “disappointed with the time it has taken GCHQ to investigate” the issue.

The commissioner, Sir Brian Leveson, said GCHQ had “not yet established a sufficiently clear understanding of the scale, location and recoverability” of the lost devices, and said the underlying issues had been raised several years ago.

The report describes removable media as “utilised extensively” by the agency and an essential component of some of its operating processes. GCHQ estimated the total losses as “in the thousands.”

Some of the devices may contain data obtained under the Investigatory Powers Act, including powers allowing spies and police to intercept communications and hack suspect devices.

The report does not allege that any of the devices have fallen into the hands of adversaries. A spokesperson for GCHQ declined to answer whether it was aware of unauthorised persons accessing any of the missing media.

They said the agency acknowledged its “management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use.”

Framing the issue as a record-keeping problem, rather than one of lost items, the spokesperson said IPCO was “right to note the flaws in the data the system produced, and we have taken action against all their recommendations.”

“We recognise the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items,” they added. “The findings in the report have been addressed comprehensively and all necessary steps to correct this issue have been taken.”

It is understood GCHQ has since conducted a full audit of the items it holds and updated its processes and tools, and has kept IPCO informed of its progress. It is unclear whether the audit has established how many items are lost.

Errorism

IPCO’s report also reveals that flawed GCHQ intelligence misidentified selectors — identifiers such as phone numbers or online accounts — in “a small number of cases” where innocent members of the public were “wrongly suspected of being involved in terrorism-related criminality.”

The misidentifications led to actions against members of the public, including five stops at ports (potentially including airports and international train terminals) under counter-terrorism powers. At these stops, people were detained, had their devices downloaded and biometrics taken.

According to the report, the misidentifications occurred because of “a particular software application” which was not named. It was described as “one of a class of internet applications used by a relatively small section of the public. However, this particular application operated in an unusual way which meant, unbeknownst to GCHQ, that the target discovery methodology was unreliable.”

Target discovery is the process of identifying previously unknown people who may be of intelligence interest, typically using communications data.

The report did not explain how the app frustrated this process. The possibilities include a range of technologies that route traffic through other users’ devices that could make innocent people appear to be in contact with a suspect.

IPCO said GCHQ could not have foreseen the issue. It added “although the impact on those affected is highly unfortunate and regrettable, intelligence can sometimes simply be wrong.”

The agency “acted to minimise the effects of these misidentifications as soon as it became aware of the issue,” said IPCO.

GCHQ’s spokesperson declined to comment on the target discovery issue.

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79