The UK’s spy agency struggles to locate thousands of USB sticks
The United Kingdom’s intelligence agency GCHQ has lost thousands of storage devices that may contain sensitive data.
GCHQ. By Shutterstock
Follow us
- GCHQ cannot immediately locate thousands of removable storage devices, including USB sticks and hard drives.
- Some missing devices may contain data tied to the UK’s Investigatory Powers Act.
- The regulator says GCHQ must keep reporting progress throughout 2026.
- GCHQ says it has addressed the regulator’s recommendations and improved media tracking.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
According to the Investigatory Powers Commissioner’s Office (IPCO), a large number of USB sticks, external hard drives, compact discs, memory cards, and other portable media storage devices have gone missing.
The IPCO’s Annual Report of the Investigatory Powers Commissioner 2025 says that these items are utilized extensively and are an essential component of some of GCHQ’s operating processes.
“GCHQ has now scoped the extent of the issue in terms of the maximum number of items of removable media that it cannot immediately locate and are therefore unaccounted for. This is a very significant number, which GCHQ currently estimates to be in the thousands,” the report states.
Once that work is complete, GCHQ will be able to report how many devices have been confirmed as lost.
Some of these storage devices may contain IPA-related data, which refers to the Investigatory Powers Act of 2016, a British law that gives law enforcement, surveillance, and intelligence agencies the legal power to monitor communications and collect data.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
This means that some flash drives may have potentially sensitive information on them, which has led to concerns with the IPCO. GCHQ has recognized the risks of the missing storage devices and therefore commissioned a new tool for monitoring the storage and location of removable media.
“We will continue to monitor GCHQ’s progress in bringing this issue to a conclusion, both through our regular inspection activity and by requiring regular written progress reports from the organization throughout 2026,” the regulator notes.
A GCHQ spokesperson told news outlet Politico the agency’s system for tracking removable storage devices wasn’t robust enough, making it difficult to keep tabs on registered items. He acknowledged the shortcomings highlighted by the IPCO and said GCHQ had taken action to address all of the regulator’s recommendations.
“We recognize the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items. The findings in the report have been addressed comprehensively, and all necessary steps to correct this issue have been taken,” the spokesperson added.
