GCHQ admits loss of thousands of sensitive data drives

GCHQ has confirmed the loss of thousands of storage drives containing sensitive data, a situation that has persisted for years. The agency stated it is unaware of the exact scale of the issue and cannot currently explain where the missing devices are located. These drives may contain data related to the Investigatory Powers Act. GCHQ admitted that its previous management system for removable media was not sufficiently robust.

Investigatory powers commissioner Lord Brian Leveson expressed concern that GCHQ has not established a clear understanding of the lost removable media. Digital forensics expert Peter Sommer noted that vast quantities of sensitive data can be stored on cheap hard disks and cards. GCHQ has embarked on a program to locate lost devices, including implementing an automated asset-tracking system by the end of the year. The agency stated it has taken action against all recommendations from IPCO.

The missing drives are one of several transgressions highlighted by IPCO in its report. The body raised concerns over lax safeguards used to restrict UK overseas partners when accessing bulk-intercepted data. An internal probe found inadequate arrangements regarding one partner's access to journalistic material. Additionally, GCHQ was questioned after a software bug misidentified individuals thought to be participating in terrorist activities, leading to five port stops made under the Terrorism Act. IPCO ruled there was ultimately no error made as defined by the IPA regarding the software bug. MI5 also mishandled the Agent X case despite knowing the informant was a violent misogynist, a matter Lord Leveson described as serious.