Intelligence agency misplaced 'a very significant number' of removable drives — storage media have been missing for years, but exact number of lost devices remain unknown

Intelligence agency misplaced 'a very significant number' of removable drives — storage media have been missing for years, but exact number of lost devices remain unknown

The missing drives number in the thousands.

The UK’s Investigatory Powers Commissioner’s Office (IPCO) has flagged “a very significant number” of General Communications Headquarters (GCHQ) storage drives that have been missing for years and have yet to be found. According to The Register, the lost storage media have been known to GCHQ officials for years now, but they’re still unsure about the scope of the problem.

"I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data, notwithstanding that the underlying issues were first drawn to my attention several years ago. While I recognize the technical and practical challenges involved, the passage of time without a comprehensive account heightens the importance of sustained senior focus and assured remediation. Given the potential sensitivity of the material involved, I will continue to monitor progress closely,” investigatory powers commissioner Lord Brian Leveson wrote in the report.

GCHQ acknowledged to The Register that the tracking system for its removable media had been insufficient, but it has since taken steps to prevent it happening in the future. "We recognize the importance of security of removable media in our systems and have a range of measures to mitigate the risks posed by these items. The findings in the report have been addressed comprehensively, and all necessary steps to correct this issue have been taken," a GCHQ spokesperson told the publication. It has also launched a program to help locate as many of the lost storage media as possible and will have an automated asset-tracking system up and running before 2027.

The GCHQ is the UK’s equivalent to the National Security Agency (NSA), making it the country’s primary signals intelligence and cybersecurity agency. Its primary mission is governed by the Investigatory Powers Act (IPA), which was passed in 2016 and lays out the legal framework for government surveillance, data collection, and intercepting communications. While neither agency has exactly confirmed what data the missing drives contained, it could potentially have information about GCHQ operations, administration, and other crucial data.

While the UK’s premier signals intelligence and cybersecurity agency losing thousands of removable drives may sound alarming, it’s not alone in running into blunders like this. The publication reported that Britain’s Ministry of Defence has lost 87 classified USB drives from 2003 to 2008, and that the UK police have also dealt with officers losing their assigned tech gadgets. Other governments have also made considerable tech missteps — for example, the South Korean government lost 858TB of data after a catastrophic fire destroyed a data center, and it discovered that it had no backups. Indonesia discovered the same issue when it was hit with a ransomware attack, with one government official calling the lack of backups “stupid.”

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.

Jowi Morales is a tech enthusiast with years of experience working in the industry. He’s been writing with several tech publications since 2021, where he’s been interested in tech hardware and consumer electronics.