The Record reported that the UK's surveillance watchdog, the Investigatory Powers Commissioner's Office (IPCO), says GCHQ cannot account for thousands of portable storage devices, such as USB sticks, hard drives, discs and memory cards. IPCO said this in its 2025 annual report, published Thursday. It criticised how slowly GCHQ looked into the matter. Commissioner Sir Brian Leveson said the underlying issues were raised several years ago.
The report does not allege that any device reached an adversary. A GCHQ spokesperson would not say whether the agency knows of anyone gaining unauthorised access. The spokesperson said its removable-media tracking was previously not robust enough, and that it has taken all necessary steps to correct it. IPCO said GCHQ has not yet shown how many items are gone, where they are, or whether they can be recovered. The Record said it is unclear whether GCHQ's audit has settled how many items are lost. Some devices may hold data gathered under the Investigatory Powers Act.
This is WebPulse's own analysis, not a claim from the report. A register of what was issued does not prove what exists. Tracking fails when nobody checks that list against what people actually hold. Leaders can ask: Can we list every removable device issued? When did we last check that list against reality? What encryption protects the data if one is lost?