GCHQ Lost Thousands of Storage Devices and Can't Find Them

Key Takeaways

• The Investigatory Powers Commissioner's Office (IPCO) published its 2025 annual report on 29 October 2026, raising continuing concerns about lost GCHQ removable media.
• GCHQ estimates that the missing USB sticks, external hard drives, compact discs and memory cards number "in the thousands," but it has not established an exact count.
• The Register reports the drives may contain data related to the Investigatory Powers Act, the law that authorises GCHQ's interception of communications.
• IPCO does not allege that any device reached an adversary, and GCHQ declined to say whether it knew of unauthorised access.
• Journalists and activists cannot control how an agency stores data, but they can shrink what is collectable by using end to end encryption and deleting old email.

What Did GCHQ Lose?

GCHQ lost removable storage: according to The Record, the missing items are "USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices." The agency cannot say exactly how many.

That uncertainty is the core of the finding. The Register reports that GCHQ has scoped the maximum number of drives that could be lost, without knowing the real figure. Lord Leveson, the Investigatory Powers Commissioner, described it as "a very significant number."

What is on the devices is also unknown in public. The Register says they may hold material related to the Investigatory Powers Act. Neither outlet reports a breakdown of contents, and none of the coverage claims the data was stolen.

How Long Has the Watchdog Known?

The watchdog has known for years. The commissioner said the underlying issues "had been raised several years ago," as The Record reported, and IPCO said it was "disappointed with the time it has taken GCHQ to investigate."

GCHQ's response, via a spokesperson, conceded the point. Its "management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use." The agency says it has run a full audit, updated its processes, and that "the findings in the report have been addressed comprehensively."

Per The Register, GCHQ plans an automated asset tracking system by the end of the year, after which it expects to give a more precise number. So the honest answer to "how many?" is still: ask again in 2027.

What Else Did the Report Find?

The lost media is not the only finding that should worry reporters. The Register notes IPCO raised concerns about safeguards on overseas partners' access to bulk intercepted data, and that one partner had inadequate arrangements for handling journalistic material.

• Misidentified selectors: The Record reports that in a small number of cases flawed intelligence pinned the wrong phone numbers or online accounts. IPCO wrote that "intelligence can sometimes simply be wrong."
• Port stops: A software bug led to five stops at UK ports under the Terrorism Act, though IPCO ruled no error as defined by the IPA occurred.
• MI5's Agent X: Leveson called the case "as serious as anything I have dealt with as Commissioner."

Why Email Users Should Care

Most coverage frames this as an embarrassing inventory problem. The bigger lesson is about data minimisation: every copy of intercepted material creates another place it can leak, and this report shows that even a top tier intelligence agency could not say where thousands of copies went. Once your email is collected, its safety depends on the weakest storage practice of whoever holds it, including foreign partners with access to bulk data.

Standard email is a soft target for that kind of collection. Messages travel and sit on provider servers in a form the provider can read, and headers such as sender, recipient and timestamps stay visible even when content is protected. For a reporter, that metadata alone can map a source network. We covered how that plays out when states target the press in our pieces on Morocco's Pegasus campaign against journalists and the Chosen Brick spyware advisory.

This is not unique to spies. UK public bodies have a pattern of losing control of sensitive data through third parties, as we saw with UK police supplier breaches. Assume any copy that exists can eventually escape.

What Can Journalists and Activists Do?

You cannot audit GCHQ's drawers, but you can reduce what is worth collecting. The UK National Cyber Security Centre, part of GCHQ itself, publishes guidance for high risk individuals that is a reasonable baseline. Beyond it:

• Move sensitive conversations off plain email. Use end to end encrypted messaging with disappearing messages for source contact.
• Encrypt email you must send. PGP or a provider with end to end encryption between users protects content, not headers.
• Delete what you no longer need. Set retention rules and clear old threads with sources. A message that no longer exists on a server cannot be copied to a USB stick later.
• Separate identities. Use a dedicated account for source work so metadata does not link it to your personal life.
• Encrypt your own removable media. If an agency can lose thousands of drives, so can a newsroom. Full disk encryption makes a lost stick useless to the finder.

Looking Ahead

The next marker is GCHQ's automated asset tracker and the count it promises. Watch whether IPCO's 2026 report, or the commissioner's published annual reports after it, finally state a number and say whether any lost device held intercepted communications. Until then, the safest assumption for anyone whose email might be collected is simple: the less of it that exists, the less of it can go missing.