UK Spy Agency Cannot Account for Thousands of Devices That May Hold Top Secrets

Britain's intelligence agency is supposed to keep the country's most sensitive secrets safe. But it still cannot account for thousands of its own storage devices, some of which may contain top-secret information.

The UK's Government Communications Headquarters (GCHQ) has struggled for years to determine what happened to removable storage devices registered for use within the agency, according to Politico and The Register. The missing media may contain sensitive intelligence material, raising concerns about how the agency tracks and protects classified information.

Despite years of scrutiny, GCHQ still cannot provide a definitive accounting of the devices. The situation raises a troubling question for security teams everywhere: How can organizations protect sensitive information when they cannot reliably track where it is stored?

Why GCHQ's missing devices raise security concerns

According to The Register, the agency has described the number of lost drives as “very significant.” However, the actual numbers remain unknown, though the outlet notes they are in the thousands.

A GCHQ spokesperson told The Register that the problem stemmed from a previous management system that was not robust enough to track removable media registered for use. That has left the agency without a reliable account of the media devices it has issued. 

The devices reportedly contain sensitive information, according to Investigatory Powers Commissioner Brian Leveson. GCHQ “still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them,” Leveson said, according to reporting from Politico.

GCHQ says it has begun further work to locate as many devices as possible and plans to introduce an automated asset-tracking system by the end of 2026. The agency expects to have a more precise count of the missing media by then.

Why storage devices pose security risks

Removable storage devices create a security risk because they can take sensitive information outside the systems and networks designed to protect it. Unlike data held on on-prem, secured agency servers, a USB or other portable data media can be misplaced, stolen, or connected to an unauthorized computer.

Importantly, the risk isn't limited to losing the device itself. If a missing drive contains intelligence records, surveillance material, or personal information, its contents could expose sensitive sources or information about people under investigation.

Even encryption and PIN protection, while important safeguards, do not make a missing device harmless. They reduce the likelihood of unauthorized access, but do not guarantee the contents are safe, particularly when copies of data are scarce. That is why reliable tracking matters. Without it, an organization may not know whether a device is misplaced within its premises, has left its control, or has fallen into the wrong hands.

For an intelligence agency, or one that handles sensitive information for clients, data storage devices should be treated not only for what they are but also for what they contain.

What security teams can learn from GCHQ's missing devices

GCHQ's difficulties highlight a fundamental security problem: Organizations cannot reliably protect sensitive information if they cannot account for the devices storing it.

For security teams, the incident reinforces several important practices:

• Maintain a complete device inventory. Record every removable storage device, its assigned owner, its location, and the type of information it is authorized to hold.
• Track device movement. Require employees to document when portable storage devices are issued, transferred, returned, or destroyed.
• Encrypt sensitive information. Use appropriate encryption and access controls to reduce the risk of unauthorized access if a device goes missing.
• Restrict removable media. Limit USB storage access to approved devices and employees with a legitimate business need.
• Audit inventories regularly. Reconcile asset records against physical devices and investigate discrepancies before they become longstanding problems.
• Establish missing-device procedures. Define how employees report lost devices, how security teams assess potential exposure, and when an incident requires escalation.

These measures are especially important for government agencies, healthcare organizations, financial institutions, and businesses handling confidential customer information.

GCHQ's experience demonstrates that even sophisticated security organizations can face significant risks when basic asset-management controls fall short.

For more guidance on preventing sensitive information from being lost or exposed, explore eSecurity Planet's 12 data loss prevention best practices, including encryption, access controls, and regular security audits.