GCHQ Fails to Account for Thousands of Removable Media Devices, Raising Asset‑Tracking Concerns
What Happened — The UK’s Government Communications Headquarters (GCHQ) cannot locate thousands of removable‑media items—including USB sticks, external hard drives, CDs and memory cards—according to the 2025 annual report of the Investigatory Powers Commissioner’s Office (IPCO). IPCO described the agency’s “management system for removable media” as insufficiently robust to track items that were registered for use, and said GCHQ has not yet determined the full scale, location or recoverability of the lost media. Some of the devices may contain data collected under the Investigatory Powers Act, but the report does not confirm that any have been accessed by unauthorised parties. GCHQ says it has audited its processes, updated tools and is working with IPCO on remediation, though the exact number of missing items remains unclear.
Why It Matters for Trust & Control Assurance — The incident spotlights a gap in media‑handling and asset‑inventory controls, a single control objective that underpins many compliance frameworks.
Who Is Affected — Government and intelligence agencies; any organisation that relies on portable media for sensitive data.
Recommended Actions
- Conduct a comprehensive inventory of all removable media and enforce strict registration procedures.
- Apply encryption and tamper‑evident labeling to all portable storage devices.
- Implement continuous monitoring and audit‑ready evidence collection for media‑handling controls.
- Review and harden policies for media lifecycle management (use, storage, sanitisation, disposal).
Technical Notes
- Attack vector: procedural weakness / mis‑configuration of media‑tracking processes.
- No specific software vulnerability or CVE cited.
- Potential data types: intercepted communications, intelligence data collected under the Investigatory Powers Act.