UK intelligence agency GCHQ cannot locate thousands of storage devices
The UK oversight body IPCO says the intelligence agency GCHQ does not know where thousands of removable storage devices, which may hold sensitive data, are. GCHQ admits its earlier tracking system was not robust enough.
Britain's intelligence agency GCHQ, the government communications centre responsible for signals intelligence, cannot say where thousands of storage devices that could hold sensitive material are located. This follows from a report published on Thursday by the Investigatory Powers Commissioner's Office (IPCO), the independent body that oversees how British intelligence agencies use their surveillance powers. The findings matter because they raise questions about the protection of information tied to national security.
What the watchdog found
According to the report, a significant number of devices, including USB sticks, hard drives and memory cards, are unaccounted for. Brian Leveson, the Investigatory Powers Commissioner, said GCHQ still cannot tell him what happened to removable media that may hold sensitive data, even though he first raised the matter with the agency years ago.
He added that the devices may contain data related to the Investigatory Powers Act 2016 (IPA). Such data can include intercepted communications such as emails, texts and phone calls, as well as information taken from people's computers or phones.
GCHQ currently estimates the number of devices to be in the thousands and is carrying out work so that it can report how many have been confirmed as lost. The report says the watchdog remains very concerned and is disappointed by how long GCHQ's investigation has taken.
Disclosure last year
Last year IPCO disclosed that GCHQ and another intelligence agency, MI5, had been unable to locate considerable numbers of storage devices. Some of them potentially held information classified as "TOP SECRET".
GCHQ's response
A GCHQ spokesperson acknowledged that the agency's management system for removable media was previously not robust enough to track effectively the items registered for use. The spokesperson agreed with IPCO's remarks on flaws in the data the system produced and said action has been taken on all its recommendations. According to the agency, a range of measures is in place to reduce risks, and the report's findings have been comprehensively addressed.
