GCHQ Has Lost Thousands of Storage Drives and Still Has No Idea Where They Are
GCHQ has misplaced a very large number of storage devices containing potentially sensitive data, has known about the problem for years, and still cannot tell anyone exactly how many drives are missing. Not a great look for Britain's signals intelligence agency.
The Investigatory Powers Commissioner's Office flagged the situation in its annual report, with commissioner Lord Brian Leveson making clear he is not impressed. He noted that the underlying problem was first brought to his attention several years ago and GCHQ has yet to establish a clear picture of the scale, location, or recoverability of the missing media. He said the passage of time without a proper accounting makes the need for senior-level attention more urgent, not less.
The report describes the missing drives as 'a very significant number.' GCHQ has apparently scoped an upper limit but cannot pin down the exact figure. The agency is now working through a remediation programme that includes rolling out automated asset-tracking software by the end of the year, after which it expects to give a more precise count of what it has lost.
In a statement, a GCHQ spokesperson acknowledged the tracking system was 'not sufficiently robust' and said the organisation has acted on all of IPCO's recommendations. They also insisted 'all necessary steps to correct this issue have been taken,' which raises the obvious question: if the steps are complete, why does the count remain unknown?
Digital forensics expert Peter Sommer, visiting professor at De Montfort and Birmingham City universities, told The Register the concern is well founded. He pointed out that enormous volumes of data can sit on cheap, low-cost drives and cards, and that even as an expert witness he treats careful custody of data as a basic professional obligation. For an agency handling some of the UK's most sensitive intelligence, the bar should presumably be higher.
To be fair to GCHQ, losing things is practically a tradition in the British public sector. The Ministry of Defence was losing USB drives containing classified material back in the mid-2000s. Civil servants have made a habit of mislaying BlackBerrys. UK police forces have lost thousands of devices too. It is almost reassuring in its consistency.
The missing drives are only part of the picture. IPCO's report raises several other concerns about GCHQ's conduct.
The agency's overseas partners, who have access to bulk intercepted data collected under GCHQ programmes, were found to have inadequate safeguards in at least one case. Specifically, one partner's access to journalistic material was not properly restricted. GCHQ and the partner agency have both committed to fixing the situation. IPCO was satisfied with how GCHQ's own analysts handled protections around journalism, legal privilege, and journalistic sources, so the failure appears to be in how those standards were applied externally.
There was also a software bug. A web application used for what the agency calls 'target discovery work' misidentified a small number of individuals as potentially involved in terrorist activity. The error triggered five port stops under the Terrorism Act. Port stops are no minor inconvenience. Individuals can be detained without suspicion at airports, ports, rail terminals, or within a mile of the Northern Irish border, forced to hand over device passwords, have their devices seized for up to seven days, and in some cases have biometric data taken. Refusing to cooperate is a criminal offence carrying up to three months in prison.
The five people caught up in the software error suffered what the report calls 'serious prejudice.' IPCO nonetheless concluded there was no legal error under the Investigatory Powers Act, on the basis that the warrant authorising the activity was valid and the flawed methodology was both unintentional and unforeseeable. GCHQ identified and self-reported the bug, which counts for something.
GCHQ was not the only intelligence agency called out. MI5's handling of the so-called Agent X case features prominently in the report. Agent X was an anonymous informant MI5 continued to run despite the agency being fully aware he had a history of extreme violence and a deeply troubling fixation on misogynistic behaviour. That story sits in a different category of concern entirely.