GCHQ Lost Thousands of Storage Devices with Sensitive Data, Report Reveals
The UK's Government Communications Headquarters (GCHQ) has lost thousands of storage devices containing sensitive data, with the exact number and location remaining unknown years later, according to an official report.
Thousands of GCHQ storage drives containing sensitive data have been lost for years, and the British signals intelligence agency still cannot explain where they are. According to the Investigatory Powers Commissioner’s Office’s (IPCO) annual report, the missing storage drives have been known to officials for years, and may contain data related to the Investigatory Powers Act (IPA).
"I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data, notwithstanding that the underlying issues were first drawn to my attention several years ago," wrote investigatory powers commissioner Lord Brian Leveson. He added, "While I recognize the technical and practical challenges involved, the passage of time without a comprehensive account heightens the importance of sustained senior focus and assured remediation. Given the potential sensitivity of the material involved, I will continue to monitor progress closely.”
Described as "a very significant number," the report notes that GCHQ has scoped the maximum number of potentially lost drives, but is unaware of the exact scale of the issue. The agency has embarked on "a program of further work" to locate as many of the lost devices as possible, which includes implementing an automated asset-tracking system by the end of the year. After this is up and running, it said it will be able to provide a more precise number of lost drives.
A GCHQ spokesperson acknowledged the issue, stating, "As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use. IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations. We recognize the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items. The findings in the report have been addressed comprehensively, and all necessary steps to correct this issue have been taken."
This incident is not unique to GCHQ. Numerous similar cases have emerged from the public sector over the years, including the British Ministry of Defence misplacing USB drives containing secret information in the mid-noughties, civil servants routinely losing their BlackBerry handsets, and UK police losing thousands of devices.
The missing storage drives comprise just one of the agency's various transgressions highlighted by IPCO in its report. There are also "significant concerns" over the lax safeguards used to restrict the UK's overseas partners when accessing bulk-intercepted data collected by GCHQ. While IPCO was satisfied with GCHQ's safeguards for its own analysts regarding confidential material related to journalism, journalistic sources, and privileged legal information, concerns were raised about how these safeguards were applied to international partners.
Furthermore, GCHQ was questioned after a software bug in a web app used for "target discovery work" misidentified individuals thought to be participating in terrorist activities. Although the flaw only affected a small number of individuals, the errors led to five port stops made under the Terrorism Act and caused "serious prejudice" to the victims. A port stop involves law enforcement detaining a suspect at a UK port and can require them to provide passwords to electronic devices.
Despite the agency’s vast technical expertise, IPCO stated that the software issue was not foreseeable. The report also noted other issues within the UK intelligence community, including MI5's mishandling of the Agent X case, where the agency provided false evidence to protect a foreign neo-Nazi informant.