Summary
- IPCO says GCHQ has yet to establish a sufficiently clear account of missing removable media.
- Some devices may contain material associated with powers under the Investigatory Powers Act.
- The watchdog continues to monitor the agency's asset tracking and remediation work.
The UK’s intelligence oversight watchdog has raised continuing concerns about GCHQ‘s inability to account for removable storage media potentially containing sensitive information handled under investigatory powers legislation. The questions concern the location and recoverability of devices recorded in historic inventories, rather than a confirmed theft of material.
The Investigatory Powers Commissioner’s annual report for 2025, published on 29 October 2026, identifies continuing weaknesses in the agency’s ability to establish a satisfactory account of the media. The watchdog has maintained scrutiny over an issue which began before the latest reporting period. The final number and status of relevant devices remain unresolved in the public material.
Removable media can include USB drives, external disks, optical discs, and memory cards. Such equipment may be used for specialist analysis, for transferring information between controlled environments, or for retaining material gathered through authorised capabilities. A reliable register should establish when an item was issued, who controlled it, and how it was returned or disposed of.
The lack of a complete custody record is a governance failure even where there is no evidence of access by an unauthorised party. An unaccounted device might have been destroyed without a correctly completed record, retained in another secure location, misplaced, or taken. Those possibilities have different implications, and the published oversight findings do not determine which applies to every item.
Where storage devices contain information acquired using statutory investigative powers, questions over custody can intersect with legal duties on retention, access, handling, and destruction. The Investigatory Powers Act sets controls governing the use of intrusive capabilities and the safeguards surrounding information obtained through them. Those safeguards depend on accurate records throughout the material’s lifecycle.
The presence of encryption can help protect information if physical equipment is lost, although the protection depends on how the encryption is deployed and how access keys are managed. Encryption also does not produce an inventory, demonstrate that a device was destroyed, or explain which particular records it contained.
Historical gaps can be especially difficult to resolve after staff have changed roles, storage procedures have been redesigned, or technology has been replaced. Updating current inventory software helps prevent new inconsistencies, but it may not establish what happened to media issued years earlier when older records were incomplete.
This separates the question of improving procedures from the question of resolving the outstanding devices. A new control can govern how future storage is issued or retired while leaving unresolved whether an older item remains in custody. The commissioner’s continuing examination concerns assurance over those existing gaps as well as the adequacy of controls going forward.
Information security teams normally assess the confidentiality, integrity, and availability of digital assets through technical controls and records of access. Physical storage requires equivalent attention to people, locations, handovers, and disposal. The weakest link may be an incomplete custody trail rather than a flaw in an online service.
A credible investigation also needs to distinguish between an absent record and evidence that the item itself is missing. Devices may have been transferred or destroyed without every required administrative step being recorded. Establishing those outcomes would reduce uncertainty, but retrospective reconciliation depends on records and testimony that may no longer be available.
The public report does not prove that hostile actors acquired devices or accessed the material potentially contained on them. Reporting an unaccounted item as a stolen intelligence device would therefore go beyond the established findings. Equally, the absence of proven theft does not establish that all devices remained under authorised control.
GCHQ’s handling of the issue is subject to continuing oversight rather than a completed assurance finding. The commissioner’s office is concerned with the agency’s ability to demonstrate where relevant material is held and whether its lifecycle has been managed within the required safeguards.
The unresolved status of the media leaves a practical question about accountability: which records can be reconstructed, and which losses of certainty cannot be eliminated? The annual report documents continuing concern over that position, without making a finding that a particular quantity of secret data has reached unauthorised recipients.
The watchdog will continue examining the agency’s response and evidence for reconciliation. Until that work establishes the fate of the outstanding media, the security consequences remain an issue of uncertain custody and potential exposure, not a verified compromise of the underlying intelligence material.
