TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The UK’s Investigatory Powers Commissioner’s Office says GCHQ has been unable to establish the scale, location and recoverability of removable storage media missing for years. The media may contain data related to the Investigatory Powers Act, but the number of drives and the sensitivity of their contents have not been publicly specified.
The UK’s Investigatory Powers Commissioner’s Office (IPCO) says GCHQ has yet to determine the scale, location or recoverability of a very significant number of removable storage devices missing for years. The drives may contain data related to the Investigatory Powers Act (IPA), but the number of devices and their contents have not been publicly detailed.
Investigatory powers commissioner Lord Brian Leveson raised the issue in an oversight report, saying the underlying problem had first been brought to his attention several years ago. Despite that time, he wrote, GCHQ had not established a sufficiently clear understanding of how much media was missing, where it might be, or whether it could be recovered.
Leveson described the missing media as a “very significant number”, but the report as presented does not provide a precise count. It also does not say that the devices have been stolen, accessed by an unauthorized party, or conclusively lost beyond recovery. Those are separate questions from whether GCHQ can account for them.
According to The Register, GCHQ officials have known about the missing storage media for years and remain unsure of the problem’s scope. Leveson acknowledged that locating and recovering removable media can present technical and practical challenges, while arguing that the time elapsed makes a comprehensive account and sustained senior attention more pressing.
UK intelligence oversight · Removable media
How Did an Intelligence Agency Lose Removable Drives for Years?
GCHQ has yet to establish how many removable storage devices are missing, where they are, or whether they can be recovered. The media may contain information related to the Investigatory Powers Act (IPA); the public report does not confirm a breach.
Commissioner Lord Brian Leveson’s description; no precise count was published.
GCHQ has not established a sufficiently clear account of the missing media.
UK signals intelligence agency
Investigatory Powers Commissioner’s Office
Issue known to oversight for several years
No device total or recovery figure disclosed
A long-running inventory gap
In an oversight report, Lord Brian Leveson said GCHQ had not produced a clear account of removable storage media missing for years. The devices may hold IPA-related information, but the report does not detail their contents or identify when and how they went missing.
Portable storage is unaccounted for
The finding concerns removable devices. No specific device types, teams, or systems are identified in the available account.
IPA-related data may be involved
The report raises a possible sensitivity concern without describing the data on any individual device.
Oversight calls for sustained action
Leveson emphasized a comprehensive account, senior focus, and assured remediation as the issue remains unresolved.
Missing devices are not proof of a breach
The key concern is that GCHQ cannot yet provide a clear picture of the scale, location, and recoverability of the media. That limits how overseers can assess exposure and verify whether corrective measures are working.
“I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data.”Lord Brian Leveson · Investigatory powers commissioner
A long-running inventory gap can make risk assessment and remediation harder. The reported findings do not establish theft, unauthorized access, disclosure, or permanent loss. Those questions remain unanswered in the public account.
What the public findings establish
The available information points to an unresolved accounting and recovery problem. It offers limited detail about the devices, their contents, or the circumstances surrounding the losses.
Reported in the oversight account
- ✓GCHQ has not established a sufficiently clear picture of missing media.
- ✓The issue was brought to the commissioner’s attention several years ago.
- ✓The media may contain data related to the IPA.
- ✓Leveson will continue to monitor progress closely.
Not specified publicly
- ?Exact number of missing devices and their current locations.
- ?Which devices can be recovered, or what specific data they contain.
- ?Whether anyone accessed the media or information was disclosed.
- ?A public deadline, recovery target, or date for a further update.
From an inventory gap to an oversight test
Leveson acknowledged the technical and practical challenges of locating removable media. He also argued that the time elapsed makes a comprehensive account and sustained senior attention more pressing.
Unclear scale limits assessment
Without a device count and a better recovery picture, independent overseers cannot readily define the scope of potential exposure.
Controls need to be evidenced
A fuller account would help show what corrective steps address the gap and whether procedures are working.
Uncertainty has limits
The lack of detail prevents a specific public judgment about scale. It also means the findings should not be treated as a confirmed data breach.
The response must close the information gap
Leveson said he would monitor progress closely. A comprehensive update could clarify the number of devices, attempts to locate them, recoverability, and steps to prevent similar inventory gaps.
Set out how much removable media is unaccounted for.
Explain where devices may be and what searches have been made.
Clarify recoverability and the potential status of the data.
Show sustained senior attention and stronger tracking controls.
What we know—and what we do not
What has GCHQ reported missing?
Removable storage media that may contain data related to the Investigatory Powers Act. The public findings do not identify particular device types or give a precise count.
How many drives are missing?
No exact number has been provided. Leveson described a “very significant number” while noting that GCHQ still lacks a clear understanding of the scale.
Is this a confirmed data breach?
No. The reported findings do not confirm unauthorized access or disclosure. They describe an unresolved accounting and recovery problem involving potentially sensitive material.
What happens next?
Leveson will continue monitoring progress. A fuller account would clarify the number, whereabouts, recoverability, and remediation; no public deadline is specified.
Reporting source: Tom’s Hardware · Oversight: Investigatory Powers Commissioner’s Office
Why Missing Drives Raise Oversight Concerns
The issue is not simply that portable devices are difficult to track. The commissioner’s concern is that an intelligence agency has not been able to provide a clear account of media that may hold IPA-related information. Without knowing the number of devices, their whereabouts or the likelihood of recovery, oversight officials cannot readily establish the full scope of potential exposure or judge whether corrective steps address the problem.
That does not establish that sensitive information has been disclosed or that any person has accessed it. It does show a continuing accountability and information-management problem: a long-running inventory gap can make it harder for senior officials and independent overseers to assess risk, document remediation and confirm that procedures are working.
For the public, the distinction matters. The report identifies an unresolved control failure and a possible sensitivity concern, not a confirmed breach. The lack of a count or a clear recovery picture also limits how specifically the public can evaluate the scale of the issue.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
As an affiliate, we earn on qualifying purchases.
A Long-Running Media Inventory Problem
The Investigatory Powers Commissioner’s Office oversees the use of investigatory powers in the UK. In this case, its commissioner is calling attention to removable media held by GCHQ, the UK signals intelligence agency. The report connects the devices to information that may relate to the Investigatory Powers Act; it does not describe the media’s contents in detail.
The timeline is central to the criticism. Leveson said the underlying issues were first drawn to his attention several years ago, while a clear account of the missing media remains unavailable. That long interval is why his remarks focus not only on the practical difficulty of recovery but also on the need for sustained attention from senior officials and assured remediation.
The available reporting does not supply further details about when the drives went missing, which GCHQ systems or teams were involved, or what internal tracking procedures were in place. It also does not identify a specific incident or a single date on which the loss was discovered.
“I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data”
— Lord Brian Leveson, investigatory powers commissioner
The Number and Contents Remain Unknown
The public account does not establish how many devices are missing, where they may be, or how many can be recovered. It also does not specify what data any particular drive contains, whether any media held material classified as sensitive, or whether information was accessed by someone without authorization.
Those gaps mean the report should not be read as confirmation of a data breach or as proof that all the drives are permanently lost. The commissioner’s stated concern is that GCHQ has not yet developed a sufficiently clear picture of the scale, location and recoverability of the media. The precise causes of the losses and the full extent of any risk remain unclear in the details available.
Commissioner to Track GCHQ’s Response
Leveson said he would continue to monitor progress closely. The next meaningful development would be a more comprehensive account from GCHQ: how much removable media is unaccounted for, what efforts have been made to locate it, and what steps are being taken to prevent similar inventory gaps.
The report’s remarks call for sustained senior focus and assured remediation, but the available information does not set out a public deadline, a recovery target or a date for a further update. Until GCHQ provides a clearer account, the scale of the problem and the status of efforts to resolve it remain open questions.
Source: Tom’s Hardware
Key Questions
What has GCHQ reported missing?
The oversight report refers to removable storage media that may contain data related to the Investigatory Powers Act. The publicly available details do not identify particular device types or provide a precise count.
How many drives are missing?
No exact number has been provided in the reported findings. Leveson described a “very significant number”, while saying GCHQ still lacks a clear understanding of the scale.
Is this a confirmed data breach?
The reported findings do not confirm that anyone accessed the missing media or that information was disclosed. They identify an unresolved accounting and recovery problem involving devices that may contain potentially sensitive material.
What happens next?
Leveson said he would continue to monitor GCHQ’s progress. A fuller account of the devices’ number, whereabouts, recoverability and remediation would clarify the outstanding questions, but no public deadline for that account is specified.
Source: Tom’s Hardware
