Britain's signals-intelligence agency, GCHQ, still lacks a clear picture of how many removable storage devices it has lost, where they are or whether they can be recovered, even though some may hold data collected under the country's surveillance law, the Investigatory Powers Commissioner said in his 2025 annual report published Thursday. The finding shows how losing track of ordinary hardware can undercut data safeguards, even at a spy agency.
What Happened
The commissioner, Lord Leveson, oversees how UK public bodies use covert investigatory powers. In the report, he wrote that GCHQ has not established "a sufficiently clear understanding" of the scale, location and recoverability of lost media that may contain data gathered under the Investigatory Powers Act 2016, although the problem was first raised with him several years ago. Removable media covers items such as USB sticks, external drives and memory cards.
GCHQ has worked out the maximum number of items it cannot immediately locate. The report calls it a very significant number that GCHQ estimates is in the thousands. That is a ceiling on items unaccounted for, not a count of devices confirmed lost; GCHQ will report that figure once a search program ends. A new tool to track removable media is due to come into use in 2026, the report says.
A GCHQ spokesperson told The Record that its management system for removable media "was previously not sufficiently robust" and that the agency has acted on all of the commissioner's recommendations.
Other Findings
The report raised significant concerns about whether overseas partners with access to GCHQ's raw bulk interception data, the large-scale collection of communications, were complying with enhanced protections for journalistic and legally privileged material. A GCHQ review found inadequate arrangements for journalistic material at one major overseas partner, which the report does not name; both committed to fixing it.
Separately, GCHQ's target-discovery work misidentified a small number of people as suspected of terrorism-related activity because one internet application behaved in an unusual way. Police acted on the intelligence, including five port stops under the Terrorism Act 2000, in which travelers were detained, their devices downloaded and biometrics taken. The commissioner concluded the flaw was not foreseeable and did not count as an error under the law, but said the people concerned suffered serious prejudice.
The report also describes the commissioner's investigation into false evidence given to the High Court and the Investigatory Powers Tribunal in the case known as Agent X, and it recorded four serious errors across the agencies it oversees.
Why It Matters
For boards and security chiefs, the lesson is basic: data controls fail if an organization cannot inventory the devices that carry its data. For U.S. and other allied officials, the overseas-partner findings show that one country's legal protections depend on how its intelligence partners handle shared data.
What to Watch
The commissioner will require written progress reports from GCHQ throughout 2026. Watch for a confirmed count of lost devices, the tracking tool's rollout, and inspections of how overseas partners seek permission to query protected material, which the report names as a 2026 focus.
