GCHQ missing storage devices remain an unresolved accounting problem: Britain’s signals intelligence agency estimates that the number of unaccounted-for USB sticks, external drives, memory cards and other removable media runs into the thousands, according to the Investigatory Powers Commissioner’s Office.
The watchdog’s annual report does not establish that thousands of devices were lost or stolen, nor does it show that an unauthorized person accessed their contents. It says GCHQ still needs to determine how many items are actually missing.
That distinction is doing a lot of work. The agency uses removable media extensively in some operations, and the devices may contain information obtained under the Investigatory Powers Act, the law governing powers including communications interception and device hacking. Such material can include intercepted communications or data extracted from computers and phones, according to reporting on the watchdog’s findings.
Investigatory Powers Commissioner Sir Brian Leveson said GCHQ had not developed a clear enough account of the scale, location or recoverability of the media, despite the underlying problem having been raised several years earlier. IPCO said it remained concerned and criticized the time GCHQ had taken to investigate.
Are GCHQ’s thousands of storage devices confirmed lost?
No. The available findings describe devices that GCHQ cannot yet account for, rather than a confirmed number of losses. The agency is carrying out work to establish how many devices are definitively missing. The report also does not allege that adversaries obtained the devices or that their data was compromised.
IPCO oversees how UK intelligence agencies use investigatory powers. Its concern is therefore not just office inventory. Media linked to those powers could hold highly sensitive intelligence material, even if the report does not establish what was on any particular device.
The issue also predates the latest report. IPCO had previously asked GCHQ and MI5 to review how they allocated and audited removable storage. A prior watchdog report said both agencies had been unable to locate considerable numbers of devices that could contain TOP SECRET information, while most of those unaccounted-for items were encrypted or required a PIN. Encryption can prevent a device’s contents being read without the necessary key, but it does not fix a broken record of where the hardware went.
What does GCHQ say it is fixing?
GCHQ acknowledged that its former system for managing removable media was not robust enough to track items registered for use. In a statement, the agency said IPCO was right to identify flaws in the data produced by that system and said it had acted on all of the watchdog’s recommendations.
GCHQ also said it had measures to reduce risks from removable media and that it had addressed the report’s findings. IPCO, however, said it would continue to monitor the remediation work and seek regular progress reports. Until GCHQ completes its reconciliation, the number of devices actually lost, and any resulting exposure, remains uncertain.
This story draws on original reporting from The Record.
