GCHQ Cannot Account for Thousands of Storage Devices, Watchdog Warns in 2025 Report

Britain's signals intelligence agency cannot say where thousands of its removable storage devices are. That is the blunt finding in the 2025 annual report of the Investigatory Powers Commissioner, published on 29 October 2026. The devices in question are ordinary looking items: USB sticks, external hard drives, compact discs and memory cards. Some of them may have held data gathered under the Investigatory Powers Act. The watchdog says it is very concerned, and disappointed by how long the agency has taken to get a grip on the problem.

The report does not claim that a hostile state or a criminal group has got hold of any of the devices. It does not give a confirmed number of devices that are truly lost. Those two limits matter, because headlines can easily run ahead of the evidence. What the report does say, in plain terms, is that GCHQ has not yet built a clear picture of the scale, the location or the recoverability of the media it cannot immediately find. For an agency whose work depends on handling sensitive material with care, that gap is the story.

What the watchdog actually found

The Investigatory Powers Commissioner, Sir Brian Leveson, oversees how public bodies use intrusive powers such as interception and bulk data collection. In his 2025 report, laid before Parliament on 29 October 2026, he singled out the removable media issue as one of five findings that needed attention. He wrote that GCHQ still cannot tell him what has happened to removable media that may hold sensitive data, years after he first raised it with the agency.

GCHQ itself estimates the number of items it cannot immediately locate as being in the thousands, according to the report. That figure is best understood as a ceiling, not a final count of losses. The agency has now scoped the maximum number of items it cannot immediately locate and that are therefore unaccounted for. Further work is under way to locate as many of them as possible. Only when that work is complete, the report says, will GCHQ be able to report how many devices have been confirmed as lost.

Why this took years to surface

This is not a new complaint. The watchdog raised the issue several years ago, and the 2024 report had already asked GCHQ and MI5 to review how they allocate and audit removable media. The 2025 report says the commissioner remains very concerned and disappointed with the time it has taken GCHQ to investigate. Senior level oversight has been called for, and the commissioner says progress will be tracked through inspections and regular written reports during 2026.

What about encryption and access controls

One detail that softens the risk, without removing it, is that many of these devices were reportedly protected by encryption or by a PIN. Earlier reporting on the issue noted that a large share of the missing items fell into that category. Encryption does not make a lost device harmless in every case, but it does raise the bar for anyone who finds one. A device that needs a PIN or a key is far harder to read than an open drive.

Even so, protection is not the same as certainty. The report does not say that every unaccounted device was encrypted, and it does not say that none of them has been accessed by an unauthorised person. A GCHQ spokesperson declined to answer whether the agency was aware of unauthorised access to any of the missing media, according to reporting on the report. Readers should treat that as an open question, not as proof in either direction. The honest position, based on the published report, is that the scale of any exposure is unknown because the inventory is incomplete.

A wider warning about oversight

The removable media finding sits inside a broader report about how surveillance powers are used and checked. The commissioner said that oversight was working well overall, but he also flagged failings by other bodies, including the National Crime Agency, the Prison Service and the Ministry of Defence. He raised questions about whether parts of the older legal framework remain clear and fit for purpose. That wider context helps explain why a story about USB sticks has travelled so far. It touches a simple public expectation: if the state asks for wide powers to collect data, it should be able to show that it can look after that data, device by device.

What to watch next

Three things will show whether this finding turns into a closed chapter or a running problem. The first is the new tracking tool: whether it arrives in 2026 as planned and whether it covers issue, storage and location in one place. The second is the follow up count: how many devices are found, how many are confirmed lost, and what, if anything, was on them. The third is the commissioner's 2026 inspection work, which will test whether the agency's answers have improved or whether the same concern appears again in the next annual report.

The fair summary is this: GCHQ has a large, unresolved inventory problem with media that may hold sensitive data, and the next report is its deadline to show that it has fixed it.

Frequently Asked Questions

How many GCHQ storage devices are missing?

The report does not give a confirmed number of lost devices. GCHQ estimates the items it cannot immediately locate as being in the thousands, but that is a maximum figure for unaccounted media, not a count of confirmed losses. Further work is needed to find how many are truly lost.

Did the report say that sensitive data has leaked?

No. The report does not allege that any device has reached a hostile party, and it does not say that sensitive data has been exposed. Some of the devices may have held data obtained under the Investigatory Powers Act, and many were reportedly encrypted or PIN protected, but the exact exposure is unknown while the inventory is incomplete.

What happens next?

GCHQ has commissioned a new tool to track the issue, storage and location of removable media, due into use in 2026. The commissioner will track progress through inspections and written reports during 2026, and the next annual report is the first place a confirmed lost figure could appear.