Britain’s spy agency doesn’t know where thousands of its memory sticks are

LONDON — Britain's intelligence agency GCHQ cannot account for the whereabouts of thousands of storage devices which could contain sensitive material, according to an official watchdog.

A report by the Investigatory Powers Commissioner (IPCO) — which polices how Britain’s intelligence agencies use their spying powers — on Thursday found that a significant number of devices including USB sticks, hard drives and memory cards are unaccounted for.

Brian Leveson, the Investigatory Powers Commissioner, said that GCHQ “still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them.”

He noted that the devices “may contain IPA-related data” — which has a high level of sensitivity.

IPA-related data refers to information collected or held under the Investigatory Powers Act 2016. That could include intercepted communications such as emails, texts and telephone calls, as well as information extracted from people’s computers or phones.

The report added that GCHQ currently estimates the number of devices “to be in the thousands” and is currently undergoing work so it can report how many of the devices have been confirmed as lost.

“We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” the report notes.

Last year IPCO disclosed that GCHQ and fellow intelligence agency MI5 had been unable to locate considerable numbers of storage devices, some of which potentially containing information classified as "TOP SECRET."

A GCHQ spokesperson said: “As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use. IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations.

"We recognise the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items. The findings in the report have been addressed comprehensively and all necessary steps to correct this issue have been taken."