IPCO's findings: thousands of removable drives, no firm count
The Investigatory Powers Commissioner’s Office (IPCO) reported that thousands of storage drives issued by GCHQ have been mislaid for years and that the agency still cannot explain where they are. IPCO described the missing drives as "a very significant number" and said GCHQ has only been able to scope a maximum number of potentially lost devices; the exact scale remains unknown.
IPCO flagged that the drives may contain data related to the Investigatory Powers Act (IPA). The commissioner expressed concern that, despite the issue first being raised several years ago, GCHQ "has not yet established a sufficiently clear understanding" of how many drives are missing, where they are located, or whether their contents are recoverable. Lord Leveson added that "the passage of time without a comprehensive account heightens the importance of sustained senior focus and assured remediation." He said he would "continue to monitor progress closely."
What GCHQ says it will do: an automated asset-tracking system by year-end
GCHQ has told IPCO it has embarked on "a program of further work" to locate as many lost devices as possible and will implement an automated asset-tracking system "by the end of the year." The agency said that once that system is up and running it will be able to provide a more precise number of lost drives.
A GCHQ spokesperson told The Register that the agency's "management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use." GCHQ acknowledged IPCO's finding that its prior data were flawed, said it had "taken action against all their recommendations," and asserted that "the findings in the report have been addressed comprehensively, and all necessary steps to correct this issue have been taken."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildBulk-intercept safeguards and overseas partners
IPCO raised "significant concerns" about safeguards applied when the UK's overseas partners access GCHQ bulk-intercepted data. The report noted most partners were properly restricted from accessing material related to journalism, journalistic sources, and privileged legal information, but an internal probe found inadequate arrangements in respect to one partner and their access to journalistic material.
Both GCHQ and the overseas agency in question committed to rectifying the situation, according to IPCO.
Target-discovery software bug and the human cost of errors
The report also described a software bug in a web application used for "target discovery work" that misidentified individuals as participating in terrorist activities. The error, which affected "a relatively small section of the public," resulted in five port stops made under the Terrorism Act and caused "serious prejudice" to the victims.
IPCO explained that a port stop involves detention at a UK port, airport, train station, or within one mile of the Northern Ireland border, carried out without suspicion; detained individuals are legally required to provide passwords to electronic devices, which can be seized for up to seven days, and in some cases biometric markers may be taken. Failure to comply can lead to a three-month prison term.
Despite the harm caused, IPCO ruled that there was no error as defined by the IPA, because the activity was "lawfully authorised under an interception warrant and the adoption of an unintentionally and unforeseeably imperfect target discovery methodology did not constitute such an error." IPCO said the software flaw was not foreseeable given the agency's technical expertise.
MI5, Agent X, and institutional accountability
IPCO's secret inquiry into MI5's handling of "Agent X" forms another major strand of the report. Agent X is an anonymous MI5 informant whose identity has not been released publicly. The inquiry found MI5 managed Agent X despite knowing he was "a violent misogynist obsessed with extreme violence." Lord Leveson said "the case of Agent X is as serious as anything I have dealt with as Commissioner."
IPCO reported that MI5 provided false evidence to the High Court and the Investigatory Powers Tribunal to protect a foreign neo-Nazi informant who was under police investigation for abusing his partner, publicly referred to as "Beth." The report places the Agent X episode alongside the removable-media and safeguards problems as a critical oversight in the wider UK intelligence community.
What this means for technologists, policymakers, and the public
Technologists and security teams at signals-intelligence agencies will focus on the promised automated asset-tracking system and on strengthening removable-media controls: GCHQ has framed the issue as a management-system failure and says it has implemented IPCO’s recommendations. Policymakers and regulators will watch IPCO's continued monitoring — the commissioner explicitly said he will "continue to monitor progress closely." For members of the public who may have been misidentified or subject to port stops, the report documents tangible harms: five port stops and "serious prejudice" caused by misidentification, and statutory powers that can compel passwords and short-term device seizure.
One concrete deadline appears in the record: GCHQ’s automated asset-tracking system is due by the end of the year. Until that system is operating, the precise number of missing drives — and therefore the full scale of any data exposure — remains unresolved. IPCO will remain the official eye on remediation, and the report makes plain that other lines of accountability — particularly in the handling of informants and partner access to bulk data — are likely to demand sustained scrutiny.
