GCHQ still cannot account for missing storage drives that may hold sensitive data
GCHQ has lost a very large number of removable storage drives that may contain data covered by the Investigatory Powers Act, and it still cannot say exactly how many are missing or where they are. The issue has been known for several years, prompting the Investigatory Powers Commissioner to call for sustained senior attention because the material could be highly sensitive.
GCHQ says weaknesses in its old tracking system have been addressed and it is working to locate the devices, with an automated asset-tracking system due by the end of the year. The report also raised concerns about safeguards for overseas partners accessing bulk-intercepted data: most partners were appropriately restricted, but an internal review found inadequate controls for one partner’s access to journalistic material. It also noted an unchecked software bug that led to detentions under the Terrorism Act.
In short
- GCHQ cannot yet account for thousands of potentially sensitive storage drives.
- An automated tracking system is due by the end of the year.
- IPCO also found gaps in safeguards for one overseas partner.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The missing drives and gaps in oversight raise serious questions about whether sensitive information has been properly safeguarded, and prolonged uncertainty makes it harder to assess the risk or hold the agency accountable. Stronger tracking, senior scrutiny and clear limits on partners’ access are reasonable safeguards for privacy and the rule of law.
The case against
GCHQ handles complex, sensitive operations, and older systems can leave asset records incomplete without proving that data has been accessed or misused. The agency says it has addressed weaknesses and is introducing automated tracking; a measured response should recognise those steps while allowing security work to continue and avoiding conclusions beyond what the evidence establishes.
Explained simply
GCHQ is the UK’s signals intelligence agency, which gathers and analyses communications information to support national security. The Investigatory Powers Act sets rules for some of these powers, including the handling of large amounts of intercepted data.
Removable storage drives can hold information transferred between computer systems, so losing track of them can make it difficult to know what data may be exposed. The Investigatory Powers Commissioner oversees how intelligence agencies use their powers and checks whether legal safeguards are followed.
GCHQ also shares some intelligence with overseas partners, subject to controls on what they can access. The reported concerns touch on how sensitive information is stored, shared and checked, including material linked to journalists.
Read the full article at the source →
Originally published by The Register as “British intelligence agency misplaced ‘thousands’ of storage devices, years later still can’t say how many”.