Spies may have lost thousands of hard drives filled with secrets, report warns

Security chiefs may have lost thousands of memory sticks and hard drives that could be filled with secrets, a damning report has found. The UK's spy watchdog, the Investigatory Powers Commissioner's Office (IPCO), said spooks at GCHQ are unable to account for a huge number of storage devices. These may contain sensitive data, including intercepted emails, texts and phone calls collected on national security grounds. The commissioner, Lord Brian Leveson, said he first raised the issue years ago - and voiced his disappointment that it had not been resolved.

It is unclear how many of the missing items - also including USB sticks and memory cards - have been permanently lost. GCHQ is the UK's intelligence, security and cyber agency. The commissioner's report states: "GCHQ has now scoped the extent of the issue in terms of the maximum number of items of removable media that it cannot immediately locate and are therefore unaccounted for. "This is a very significant number, which GCHQ currently estimate to be in the thousands, and there is a programme of further work to locate and account for as many of these devices as possible.

"Once that work is complete, GCHQ will be able to report how many devices have been confirmed as lost." The report continued: "We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate." Some of the data on the devices could have been collected or held under the Investigatory Powers Act 2016, the report says. This means they could include intercepted communications as well as information extracted from computers and phones.

In its 2024 report, IPCO said GCHQ and MI5 could not account for a large number of devices which could contain top secret information. Lord Leveson said: "The Government Communications Headquarters (GCHQ) still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them." He continued: "Operational pressures are real, but they do not reduce the need for lawful, consistent and well-understood safeguards.

I will not hesitate to report failure to demonstrate real improvement." A GCHQ spokesperson said: “As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use. IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations. "We recognise the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items.

The findings in the report have been addressed comprehensively and all necessary steps to correct this issue have been taken."