Britain's intelligence agency GCHQ cannot determine the location of thousands of data storage devices that may contain sensitive information, according to a report published on Thursday by the Investigatory Powers Commissioner's Office (IPCO), the body that oversees the use of powers by British intelligence services.
The report found that the whereabouts of a significant number of devices, including USB sticks, hard drives and memory cards, are unknown. Investigatory Powers Commissioner Brian Leveson said that GCHQ "still cannot tell me what has happened to portable media that may hold sensitive data, years after I first raised this issue with them".
Leveson warned that these devices could contain "data related to the Investigatory Powers Act (IPA)", which carries a high degree of sensitivity. IPA-related data refers to information collected or stored under the Investigatory Powers Act 2016. This may include intercepted communications, such as emails, text messages and phone calls, as well as data extracted from individuals' computers or mobile phones.
The report states that GCHQ currently estimates the number of devices with unknown locations to be "in the thousands". The agency is working to identify and report how many devices have been confirmed as lost. "We remain very concerned about this issue and are disappointed by the time it has taken GCHQ to investigate", the report states.
IPCO published a report last year stating that GCHQ and MI5, another British intelligence agency, had failed to locate a large number of data storage devices. Some of these devices potentially contained information marked "TOP SECRET".
A GCHQ spokesperson said that the system for managing portable media had previously not been reliable enough to effectively track registered devices. "As IPCO reported, our portable media management system was previously not robust enough to effectively track registered devices. IPCO was right to highlight the data deficiencies generated by the system, and we have taken action in line with all their recommendations", the spokesperson stated. They added: "We are aware of the importance of ensuring the security of portable media in our systems and are implementing a range of measures to mitigate the risks these devices pose. The findings of the report have been comprehensively considered and all necessary steps have been taken to address this issue".
