GCHQ Cannot Account for Thousands of Removable Storage Devices

The UK intelligence and cybersecurity agency GCHQ has failed to establish the location or status of thousands of removable storage devices, according to a 2025 report by the Investigatory Powers Commissioner's Office (IPCO).

The devices include USB sticks, external hard drives and memory cards. The exact number is unconfirmed; the estimate of “in the thousands” comes from GCHQ, the report says. GCHQ has commissioned a new tool to monitor the issue and is working to locate and account for as many devices as possible. The report says the agency will be able to state how many have been confirmed as lost.

IPCO said it was disappointed by the time taken to investigate and address the issue, which had been brought to its attention years earlier. The watchdog had also raised the matter in its 2024 report, after asking GCHQ and MI5 the previous year to review their internal allocation and auditing of removable media.

Many missing devices were previously reported to be encrypted or PIN-protected. IPCO's latest report acknowledges technical and practical difficulties in the ongoing investigation and calls for continued oversight at senior level. It does not confirm how many devices are lost or establish that data on them has been accessed.