Britain's signals intelligence agency has lost thousands of storage drives containing sensitive data and can't account for their whereabouts, according to the Investigatory Powers Commissioner's Office's annual report published October 30, 2026. GCHQ has been aware of the missing removable media for several years but still lacks a clear picture of the full scale of the problem or where the devices ended up. The drives may hold data related to the Investigatory Powers Act, which governs Britain's surveillance and interception activities.
The report characterizes the quantity of missing drives as "a very significant number," though GCHQ has established only the maximum potential count of lost devices rather than a precise figure. The agency has launched a recovery effort to track down as many of the missing items as possible and plans to roll out an automated asset-tracking system by year's end, after which it expects to provide a more accurate tally. Beyond the storage device losses, the report documents other serious lapses, including inadequate controls on overseas intelligence partners' access to bulk-intercepted data and a software flaw that incorrectly flagged individuals as potential terrorists. The software bug affected a web application used by a small segment of the public and resulted in five port stops under the Terrorism Act, causing what the report termed "serious prejudice" to those wrongly detained.
Investigatory powers commissioner Lord Brian Leveson wrote that he "remain[s] concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media," noting the issue was first brought to his attention years ago. According to the report, while GCHQ recognized the technical and practical difficulties involved, "the passage of time without a comprehensive account heightens the importance of sustained senior focus and assured remediation." The commissioner also flagged "significant concerns" about lax protections restricting foreign partner agencies when they access bulk-intercepted material gathered by GCHQ, particularly regarding journalistic content. An internal investigation found insufficient arrangements governing one partner's access to journalistic material, though both GCHQ and the overseas agency pledged to fix the gap.
The report explains that GCHQ's earlier management system for removable media wasn't robust enough to track registered items effectively, producing flawed data that obscured the true extent of the losses. Digital forensics expert Peter Sommer told The Register that given the highly sensitive nature of GCHQ's work, the commissioner is right to worry, especially since the problem has persisted for years. A GCHQ spokesperson said the agency has taken action on all of the commissioner's recommendations and implemented comprehensive steps to correct the tracking issue, adding that multiple safeguards exist to reduce risks from removable media. The software bug that led to the wrongful Terrorism Act detentions was deemed unforeseeable despite the agency's technical expertise, and IPCO ruled no legal error occurred under the Investigatory Powers Act because the activity was lawfully authorized and the flawed methodology was unintentional.
The report makes clear that sustained leadership attention and guaranteed fixes are essential moving forward, particularly given the potential sensitivity of the material on the missing drives. GCHQ's planned automated tracking system represents the agency's main bet for resolving the long-running inventory problem and preventing future losses. The missing storage drives join a pattern of device losses across Britain's public sector, from the Ministry of Defence misplacing USB drives with classified information to police forces losing thousands of devices over the years. Agencies handling intelligence operations face a balancing act between operational agility and ironclad accountability that becomes exponentially harder as data volumes grow and partnerships multiply across borders.