The UK’s surveillance watchdog says GCHQ still cannot account for thousands of USB sticks, hard drives and memory cards, years after the problem first came to light. For every organisation that relies on asset registers to prove control of its data, the finding is a pointed reminder that tracking hardware is a governance issue, not a housekeeping chore.
What happened
The Investigatory Powers Commissioner’s Office (IPCO) published its Annual Report 2025 on 29 October 2026, laid before Parliament the same day. Among a long list of compliance findings across the intelligence agencies, police and other public bodies, one stands out for anyone working in governance, risk and compliance: GCHQ has been unable to locate a large quantity of removable media, some of which may hold material obtained under the Investigatory Powers Act 2016.
According to the report, GCHQ has now worked out the maximum number of items it cannot immediately find. It describes that figure as very significant and estimates it to be in the thousands. The missing kit spans USB sticks, CDs, memory cards, external drives and other portable storage, which the report says some of the agency’s working processes depend on.
The Investigatory Powers Commissioner, Sir Brian Leveson, writes that GCHQ still lacks a clear grasp of the “scale, location and recoverability” of what is missing, despite the underlying issues first being raised with him several years ago. IPCO says it is very concerned and disappointed at how long the investigation has taken.
GCHQ told The Register that its earlier removable media management system was not robust enough to track the items registered for use, and said it has acted on every IPCO recommendation. According to The Record, it would not say whether it knew of any unauthorised access. The report makes no claim that any device has reached a hostile state.
The detail
The problem, as IPCO frames it, is less about a single loss and more about a control that failed quietly for years. GCHQ had a register of removable media, but the data that system produced was unreliable, so the agency could not reconcile what had been issued with what could actually be found. Only now has it scoped the worst case, and a further programme of work is under way to locate as many items as possible. Once that finishes, GCHQ expects to be able to say how many devices are confirmed lost.
For the longer term, the agency has commissioned a new tracking tool covering where media is issued, stored and held, due in 2026. The Register reports GCHQ intends to have automated asset tracking running by the end of the year. IPCO will keep checking through inspections and by demanding regular written progress reports throughout 2026.
The removable media issue sits within a wider report that Leveson says raised acute questions about compliance and candour. He highlights MI5’s handling of the Agent X case, including false evidence given to the courts, which he describes as among the most serious matters he has dealt with. The report also criticises the National Crime Agency’s handling of a juvenile covert source, repeated basic interception errors at HM Prison and Probation Service and the Ministry of Defence’s application of detainee safeguards. Four incidents during 2025 were judged serious errors under the statute.
Why it matters for UK organisations
If the UK’s signals intelligence agency, with its vetting and security culture, can lose track of thousands of storage devices, few private organisations should assume their own registers are accurate. Removable media is precisely the asset class that drifts out of view: cheap, small, frequently reissued and often treated as consumable rather than as a container of regulated data.
The regulatory exposure is real. Under UK GDPR, organisations must apply appropriate technical and organisational measures to protect personal data, and the Information Commissioner’s Office has repeatedly treated unencrypted portable media as a failure of those measures. Regulated firms face similar expectations from the FCA and PRA on operational resilience and data governance, and organisations that will fall under the Cyber Security and Resilience Bill should expect asset management to feature in the security requirements that follow. A register that cannot be reconciled is not evidence of control; it is evidence of an assumption.
The other lesson is about time. IPCO is as frustrated by the pace of remediation as by the original failing, and a gap left open across several annual reports becomes a governance finding in its own right.
Expert view
In my experience, removable media is one of the most consistently weak areas we find on assessments, and it is rarely because nobody wrote a policy. The policy usually exists. What is missing is the joined-up evidence: a register that matches the hardware in drawers, logs showing which devices were mounted where, and a clean disposal trail. When we test endpoint controls, it is common to find that USB blocking is enforced on some machine builds but not others, or that exceptions granted years ago were never reviewed.
The GCHQ case also shows why a register by itself is weak assurance. If the system that records issue and return is unreliable, every downstream report built on it inherits the error, and nobody notices until someone attempts a full reconciliation. The fix is not more paperwork but automation that ties the device identity to the user and the endpoint at the moment of use.
Encryption matters enormously here. A lost encrypted drive with properly managed keys is an inconvenience and a reportable control gap; a lost unencrypted drive holding personal or sensitive data is a breach. According to Newsmax, IPCO’s previous annual report said most of the items GCHQ and MI5 could not then locate were encrypted or needed a PIN; this year’s report does not repeat that point.
What to do now
- Decide whether you need removable media at all. Block mass storage by default through endpoint policy and grant exceptions by named user, device and business reason, with an expiry date. This supports the Cyber Essentials secure configuration control.
- Allow only managed, encrypted devices. Issue hardware-encrypted drives with centrally managed keys, and block anything not on the approved list using device ID controls in your endpoint management or EDR tooling.
- Reconcile the register against reality. Run a physical count against your asset records now, then schedule it. Treat any device you cannot find as a potential incident until you can show what was on it.
- Log usage centrally. Collect device connection events in your SIEM so you can show which media touched which systems and when, and alert on unapproved devices.
- Track remediation at board level. If an audit finding stays open beyond one reporting cycle, escalate it with a named owner and a dated plan.
Bottom line
Nothing published so far shows that GCHQ’s missing media has caused direct harm, but the oversight verdict is clear: a weak tracking system went unchallenged for years and remediation has been slow. Every organisation handling sensitive data should take that as a prompt to check that its own asset records reflect what it actually holds, and to make sure portable storage is either encrypted and accounted for or not permitted at all.
Sources
- Investigatory Powers Commissioner’s Office: Annual Report 2025
- The Record: British spy agency cannot account for thousands of data storage devices, watchdog says
- The Register: British intelligence agency misplaced ‘thousands’ of storage devices, years later still can’t say how many
- Joshua Rozenberg: Spookwatcher spooked
- Newsmax via Yahoo News: UK Spy Agency Cannot Account for Thousands of Storage Devices
