Britain's intelligence agency GCHQ cannot locate thousands of removable storage devices that may contain highly sensitive intercepted communications, according to a report from the Investigatory Powers Commissioner (IPCO) published Thursday. Brian Leveson, the Investigatory Powers Commissioner, said GCHQ "still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them."
The report found that a significant number of devices including USB sticks, hard drives and memory cards are unaccounted for. They may contain "IPA-related data", information collected or held under the Investigatory Powers Act 2016, which could include intercepted emails, texts and telephone calls, as well as data extracted from computers or phones.
Last year, IPCO disclosed that GCHQ and fellow intelligence agency MI5 had been unable to locate considerable numbers of storage devices, some potentially containing information classified as "TOP SECRET."
The report notes that GCHQ estimates the number of devices “to be in the thousands” and is working so it can report how many have been confirmed lost. “We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” the report states.
A GCHQ spokesperson said the agency's management system for removable media was "previously not sufficiently robust to effectively track the items that were registered for use." The spokesperson said GCHQ has taken action against all IPCO recommendations and has "a range of measures to mitigate the risks posed by these items." They added that the findings have been "addressed comprehensively."
Analysis
Why This Matters
- The loss of thousands of storage devices raises concerns about the security of highly sensitive data collected under UK surveillance laws.
- The prolonged inability to account for the devices undermines public trust in the oversight of intelligence agencies.
- This could lead to stricter regulations or audits of data management practices at GCHQ.
Background
GCHQ is Britain's signals intelligence agency, responsible for intercepting communications and protecting national security. The Investigatory Powers Act 2016, also known as the "Snooper's Charter," governs the collection and handling of intercepted data. The Investigatory Powers Commissioner (IPCO) is an independent body that oversees compliance with the act. The current issue has been ongoing for several years, with IPCO first raising concerns about missing storage devices at GCHQ and MI5 last year.
Key Perspectives
Investigatory Powers Commissioner (IPCO): Expressed deep concern that GCHQ still cannot account for thousands of storage devices that may contain highly sensitive data, and is disappointed with the time taken to investigate the issue.
GCHQ: Acknowledged that its previous management system for removable media was not sufficiently robust and stated that it has taken action against all IPCO recommendations. It maintains that it has measures in place to mitigate risks and that the findings have been addressed comprehensively.
What to Watch
- GCHQ's ongoing work to confirm how many devices have been lost and what data they contained.
- Potential further scrutiny from parliamentary committees or the Information Commissioner's Office.
- Any changes to data management policies or technology at GCHQ.
Checked
11 claims in this story checked against 1 source: 10 supported.
Show each claim
- SupportedGCHQ cannot account for thousands of storage devices, according to the watchdog.Politico Europe: “Britain’s intelligence agency GCHQ cannot account for the whereabouts of thousands of storage devices which could contain sensitive material, according to an official watchdog.”
- SupportedThe Investigatory Powers Commissioner expressed concern about the time taken to investigate the devices, which may contain highly sensitive data.Politico Europe: ““We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” the report notes.”
- Partly supportedThe report was published Thursday.Politico Europe: “A report by the Investigatory Powers Commissioner (IPCO) — which polices how Britain’s intelligence agencies use their spying powers — on Thursday found that a significant number of devices including USB sticks, hard drives and memory cards are unaccounted for.”
- SupportedBrian Leveson said GCHQ “still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them.”Politico Europe: “Brian Leveson, the Investigatory Powers Commissioner, said that GCHQ “still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them.””
- SupportedThe report found that a significant number of USB sticks, hard drives and memory cards are unaccounted for.Politico Europe: “A report by the Investigatory Powers Commissioner (IPCO) — which polices how Britain’s intelligence agencies use their spying powers — on Thursday found that a significant number of devices including USB sticks, hard drives and memory cards are unaccounted for.”
- SupportedThe devices may contain highly sensitive IPA-related data, including intercepted communications and information extracted from computers or phones.Politico Europe: “He noted that the devices “may contain IPA-related data” — which has a high level of sensitivity. IPA-related data refers to information collected or held under the Investigatory Powers Act 2016. That could include intercepted communications”
- SupportedLast year, IPCO disclosed that GCHQ and MI5 could not locate considerable numbers of storage devices, some potentially containing information classified as “TOP SECRET.”Politico Europe: “Last year IPCO disclosed that GCHQ and fellow intelligence agency MI5 had been unable to locate considerable numbers of storage devices, some of which potentially containing information classified as “TOP SECRET.””
- SupportedGCHQ estimates the number of devices to be in the thousands and is working to report how many have been confirmed lost.Politico Europe: “The report added that GCHQ currently estimates the number of devices “to be in the thousands” and is currently undergoing work so it can report how many of the devices have been confirmed as lost.”
- SupportedA GCHQ spokesperson said the removable-media management system was previously not sufficiently robust to track items registered for use.Politico Europe: ““As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use.””
- SupportedThe GCHQ spokesperson said the agency had acted on all IPCO recommendations and had measures to mitigate risks from the devices.Politico Europe: “IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations. “We recognise the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items.””
- SupportedThe spokesperson said the report’s findings had been “addressed comprehensively.”Politico Europe: “The findings in the report have been addressed comprehensively and all necessary steps to correct this issue have been taken.”