tech · security
gchq has lost track of thousands of usb sticks and still cannot count them
the uk’s spy watchdog says the signals agency has spent years failing to account for portable drives that may hold sensitive data.
- 1000sdrives gchq cannot findits own upper estimate; the confirmed count is unknown
- 5wrongful port stopsafter a misread app sent gchq after the wrong people
- 366,976warrants and authorisationsissued across uk public bodies in 2025
every year the investigatory powers commissionera senior judge who oversees how uk intelligence agencies, police and others use surveillance powers, and reports to parliament each year. tells parliament how britain’s spies and police used their surveillance powers. this year’s report, published on thursday, has an awkward line about gchq: the agency still does not know where all its portable drives went, some of which may carry secrets. that means usb sticks, external hard drives, cds and memory cards. gchq’s own estimate of the most it cannot immediately find runs into the thousands, and how many are actually gone is still not known.
the problem is not new. the commissioner, lord leveson, says it was first raised several years ago, and his office is very concerned and disappointed by how long gchq has taken to investigate. gchq sent a detailed account during 2025 and says a tool to track where every drive is stored arrives this year. until then it must send written progress reports.
the drives are not the only slip. five people were stopped at uk ports under terrorism law in 2025 after gchq misidentified them, because an internet app behaved in a way nobody expected. the watchdog ruled the warrant was lawful, so it does not count as a serious error, though it accepts the people stopped were seriously harmed. it also found that one big overseas partner with access to gchq’s raw bulk intercepts did not properly protect journalists’ material.
pick one
the five people wrongly stopped at the border: did the watchdog count it as a serious error?
next: gchq’s drive tracking tool is due in 2026, and the commissioner wants regular written updates until the missing media is accounted for. the same report also covers the mi5 agent x case, which leveson calls as serious as anything he has handled.