The UK's Investigatory Powers Commissioner's Office (IPCO) says GCHQ cannot account for thousands of portable storage devices. The findings appear in IPCO's annual report for 2025, published Thursday.
IPCO Commissioner Sir Brian Leveson said he was "very concerned" and "disappointed with the time it has taken GCHQ to investigate" the issue. He said GCHQ had "not yet established a sufficiently clear understanding of the scale, location and recoverability" of the devices. He said the underlying issues were raised several years ago.
The report says GCHQ uses removable media extensively, and that it is an essential part of some operating processes. GCHQ estimated the total losses as "in the thousands." Some devices may contain data obtained under the Investigatory Powers Act.
The report does not allege that any devices have reached adversaries. A GCHQ spokesperson declined to say whether the agency knows of unauthorised access to the missing media. The spokesperson said the agency's "management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use." They said GCHQ has taken action on all of IPCO's recommendations. It is understood GCHQ has completed a full audit