IPCO report: GCHQ puts unlocated removable media "in the thousands"; no adversary access alleged

GCHQ's own ceiling is "in the thousands", and the count of confirmed losses has not been published

Paragraph 4.67 of the Investigatory Powers Commissioner's annual report for 2025 says GCHQ has scoped "the maximum number of items of removable media that it cannot immediately locate", and calls that "a very significant number". It adds that GCHQ "currently estimate to be in the thousands". That is a ceiling on what is unaccounted for, not a count of what is lost. The same paragraph says GCHQ will report "how many devices have been confirmed as lost" only once a programme of further work is complete, and the report prints no such figure.

What the figure does not establish is most of what readers will want. The report prints no total of items registered, no minimum, no exact number, no breakdown by device type, no list of what the items hold, and no date for the estimate. Read plainly, "in the thousands" means a maximum of two thousand or more (inference, since the report prints no digits). The passage does not allege that any device reached an adversary, and no other place in the report that mentions the matter says so either. That is an absence of an allegation, not a finding that nothing happened: the report prints no finding either way.

This briefing rests on the report itself: the 128 page PDF of the Annual Report of the Investigatory Powers Commissioner 2025, whose cover page says it was ordered to be printed on 29 October 2026, read in full from 13:56 GMT on Friday 30 October 2026 from the link on the Investigatory Powers Commissioner's Office (IPCO) annual reports page. It also reads IPCO's news notice of 29 October, the earlier annual report for 2024, and The Record's report of 30 October, which is the only place GCHQ's own statements were read. The Register's report of the same day was not read: its robots.txt blocks automated agents that are not on its list, so it was skipped.

What paragraphs 4.66 to 4.68 and the Commissioner's introduction say, and do not say

The matter appears in four places: the Commissioner's introduction (page 7), the table of key issues (page 9), the summary at the start of chapter 4, and paragraphs 4.66 to 4.68 on page 43, under the heading for the UK intelligence community. The introduction says the Commissioner remains concerned that GCHQ has "not yet established a sufficiently clear understanding of the scale, location and recoverability" of lost removable media that may contain data under the Investigatory Powers Act (IPA), and that the underlying issues were "first drawn to my attention several years ago". Paragraph 4.68 says: "We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate."

What the IPCO Annual Report 2025 prints about GCHQ and removable media, against what it does not print. Page numbers are the printed ones. Read 30 October 2026.

Topic	Stated in the report	Not stated
Items covered	"USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices" (para 4.67).	How many items GCHQ has registered, or how many of each type.
Role in GCHQ	Removable media are "utilised extensively" and are "an essential component of some of GCHQ's operating processes" (para 4.67).	Which processes, or how often media leave a controlled area.
Scale	The "maximum number" GCHQ cannot immediately locate is "a very significant number", currently estimated "in the thousands" (para 4.67).	An exact figure, a minimum, a range in digits, the date of the estimate.
Scale, location, recoverability	The Commissioner says GCHQ has not yet established a sufficiently clear understanding of all three (page 7).	How many items are thought destroyed, recoverable or in an unknown place.
Data held	Some items "may contain IPA-related data" (para 4.66; the page 9 table says "potentially containing").	Which data, how much, what classification, or whether any item has been confirmed to hold any.
Time taken	IPCO is "disappointed with the time it has taken GCHQ to investigate" (para 4.68). The issues were first raised "several years ago" (page 7).	The date the issue was first raised, or when GCHQ's investigation began.
Remedy	A programme of further work to locate items; a new tool for the issue, storage and location of removable media that "will come into use in 2026"; a detailed written account from GCHQ (paras 4.66 to 4.68).	The tool's name or design, a completion date, or a deadline set by IPCO.
Oversight	IPCO will monitor through inspections and by requiring "regular written progress reports" throughout 2026 (para 4.68).	Any sanction, any printed recommendation, or whether the reports will be published.
Compromise	Nothing is alleged.	Any finding that an adversary or other unauthorised person reached a device, or that none did.

Zoom

The wording is firmer in the report's covering material than the passage that supports it. The Commissioner's introduction calls the media "lost". Paragraph 4.67 does not: it says the items cannot be immediately located and are unaccounted for, and keeps "lost" for a later confirmed count. IPCO's news notice of 29 October puts it more bluntly, quoting the Commissioner as saying "GCHQ still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them." The report does not reconcile the two wordings, so a reader should hold both: a ceiling that is still being narrowed, and an oversight body that regards the position as unresolved after years.

Unaccounted for, lost, confirmed lost: three different claims

The reports use several words for a missing device, and each supports a different claim. A reader who treats them as one gets either a scare or a comfort that the text does not support. The diagram shows where the printed figure sits in the sequence the report describes.

Zoom

The wording the sources use for a missing device, where it appears and what each wording claims. Read 30 October 2026.

Wording	Where printed	What it claims
Cannot immediately locate; unaccounted for	IPCO report para 4.67	GCHQ has no current location for an item. Says nothing about whether it was destroyed, mislaid inside a site or taken out.
Lost removable media	IPCO report page 7; IPCO news notice	The Commissioner's characterisation of the position. Used before any confirmed count exists.
Confirmed as lost	IPCO report para 4.67 (future)	A count GCHQ will report after further work. Not yet published.
Not sufficiently robust to track the items registered	GCHQ spokesperson, as relayed by The Record	A record keeping failure: items were registered but the system did not follow them. GCHQ's framing, secondary source.

The friendly name here is the record keeping label. The Record reports GCHQ's spokesperson as acknowledging that the management system "was previously not sufficiently robust to effectively track the items" that were registered for use, and as saying IPCO was right to note flaws in the data the system produced. That is a candid description of a control failure, but a label about records does not say where the devices are. A register that cannot place an item is a failed control whatever it is called. Equally, "an audit has been done" and "a tool has been commissioned" are statements about activity, not a count. According to The Record, GCHQ has since audited the items it holds and updated its processes and tools, and it is unclear whether that audit established how many are lost. IPCO's own text still expects "regular written progress reports from the organisation throughout 2026", which tells the reader that on the Commissioner's account the matter was open when the report was written.

The earlier report: MI5 too, "a considerable number", and a statement about encryption

The 2025 report says it is following up the 2024 report. Reading that earlier report adds three things the 2025 passage leaves out. Paragraph 4.77 of the 2024 report says IPCO asked MI5 and GCHQ in 2023 to review their allocation and audit of removable media, and that both agencies were "unable to locate a considerable number of devices" potentially holding material with "security classifications ranging from OFFICIAL-SENSITIVE to TOP SECRET". It then adds: "most items unaccounted for were encrypted or required a PIN to access." And it records IPCO's assessment that the losses were due to "a previous lack of robust audit systems managing the issuing and return of removable media."

The same matter in the two annual reports: IPCO Annual Report 2024 (paragraphs 4.76 to 4.78, page 35) and 2025 (paragraphs 4.66 to 4.68, page 43). Read 30 October 2026.

Point	2024 report	2025 report
Agencies named	MI5 and GCHQ	GCHQ. MI5 is not named in the passage.
Scale wording	"a considerable number of devices"	"a very significant number", GCHQ estimate "in the thousands"
Devices listed	"USB sticks, tablets or laptop computers"	USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices
Classification of material	"OFFICIAL-SENSITIVE to TOP SECRET", potentially	Not stated. Only "IPA-related data" that "may" be held.
Encryption	Most unaccounted items "encrypted or required a PIN"	Not stated
Cause	A previous lack of robust audit systems for issuing and return	Not restated in the passage
Remedy	Refreshed procedures; a record of why each item is needed; a tracking system for registration and return	A new tool, in use during 2026; a programme of further work

Zoom

The encryption statement is the fact that would bear most on risk, and it appears only in the earlier report. It concerns "most" of a "considerable number" across two agencies, in 2023 and 2024 terms. Whether it holds for the thousands of the 2025 estimate, or for any item in particular, is not stated, so it must not be carried across. The PIN wording also does not say how strong the protection was. The two reports also define removable media differently, one listing tablets and laptop computers and the other listing external drives, discs and memory cards, so the two counts are not shown to describe the same population. The 2025 report's own summary of the earlier one is narrower than the earlier text, which covered both agencies, and the 2025 passage gives no update on MI5. The paragraph that mentions mitigations in the earlier report, "a tracking system to ensure that all issued items are registered and returned at the end of their use," sits beside a 2025 statement that a tool "will come into use in 2026"; the text does not say whether these are the same system, a replacement, or an addition. A text search of the 2023 annual report found no mention of removable media, so the earliest public mention is the 2024 report, ordered to be printed on 16 December 2025 (from its cover page).

Zoom

What the devices may hold: "may" is the report's word

The report says some items "may contain IPA-related data" and the Commissioner adds that, "Given the potential sensitivity of the material involved, I will continue to monitor progress closely." The Record's reading is that this may include data obtained under the powers in the Investigatory Powers Act for intercepting communications and for equipment interference; the passage itself does not list them. From the 2024 report, the devices in question are those used "to retain, handle, transfer or analyse" IPA or RIPA data, and some may have held material up to TOP SECRET, though most of the unaccounted items in that earlier count were encrypted or needed a PIN.

That is the whole of what the record establishes. It does not establish that a given missing device holds any data, how much, or about whom. It does not say whether any item is readable without a key. Because "recoverability" is one of the three things the Commissioner says GCHQ has not yet established, it is reasonable to infer that some items may prove unrecoverable (inference). None of this alleges a compromise, and GCHQ's spokesperson, as relayed by The Record, declined to say whether the agency is aware of unauthorised people accessing any of the missing media. That is neither a denial nor a confirmation.

The UK framework this sits in, as the primaries state it

IPCO says it oversees "more than 600 public authorities", including the UK's intelligence agencies, law enforcement agencies, police, councils and prisons, and independently reviews applications for the most intrusive powers. The annual report is presented to Parliament under section 234(6) of the Investigatory Powers Act 2016, according to its cover page. IPCO is the oversight body: it inspects, reports and states its own view that independent oversight is working. GCHQ is the overseen agency: its interest here is to show the issue is being fixed.

On the safeguard the IPA requires, the 2025 report says that all public authorities must have "satisfactory arrangements in place to protect material obtained through the exercise of investigatory powers" and minimise unnecessary intrusion. The 2024 report says that for the intelligence community "These arrangements include data retention limits, handling restrictions, sharing requirements, system monitoring, security measures and training." Neither passage says which of those arrangements the missing media bear on, and neither quotes a section number for them.

Two features of the publication process matter for how much to read into the passage. The Commissioner's letter to the Prime Minister is dated 29 June 2026, and the report was ordered to be printed on 29 October 2026: 122 days later (derived). The letter also says it is for the Prime Minister to determine, in consultation with IPCO, whether the report can be published in full, and that the Commissioner has "I have written to you separately regarding certain sensitive details" which should not be published for reasons of national security. So the published account is not stated to be the full account, and the "currently" in GCHQ's estimate may date from before the letter. The same annual report also covers an unrelated target discovery matter (its paragraphs 3.28 to 3.32, which The Record also reports); it is outside this briefing.

What GCHQ says, as relayed by The Record

The report carries no statement from GCHQ beyond what IPCO attributes to it. GCHQ's own statements were read only in The Record's report of 30 October, so everything in this section rests on a secondary source. The Record says a GCHQ spokesperson acknowledged that its system for removable media was not previously robust enough to track registered items, said IPCO was right to note flaws in the data the system produced, said action had been taken against all of IPCO's recommendations, and said the findings had been addressed and all necessary steps taken. The spokesperson also declined to say whether GCHQ was aware of unauthorised persons accessing any of the missing media. The Record adds, as its own understanding, that GCHQ has since audited the items it holds, updated its processes and tools, and kept IPCO informed, and that it is unclear whether the audit established how many items are lost.

These are GCHQ's assertions, relayed by a news outlet. They do not appear in the report, and the report is the only source that prints a figure. The statement that all necessary steps have been taken sits beside IPCO's own expectation of progress reports throughout 2026. The two are not shown to conflict, but they cannot both be read as a final position.

What any organisation that issues removable media should do, in order

The report prints no checklist. This list is this site's own, drawn from the failures the two reports describe: a register that could not follow registered items, audit systems for issue and return that were not robust, and a count that took years to scope. It applies to a firm with a drawer of USB sticks as much as to an intelligence agency.

Technical details

The report prints no configuration, tool name, encryption standard, device identifier, hash, log line or count, so none is shown here and none is invented. The one passage worth reading exactly is paragraph 4.67 of the IPCO Annual Report 2025, which sets out the definition, the estimate and what is still to come. It is reproduced below in full as a quotation, copied from the report read on 30 October 2026, and appears as the page image above.

The term removable media relates to such items as USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices. These items are utilised extensively and are an essential component of some of GCHQ's operating processes. GCHQ has now scoped the extent of the issue in terms of the maximum number of items of removable media that it cannot immediately locate and are therefore unaccounted for. This is a very significant number, which GCHQ currently estimate to be in the thousands, and there is a programme of further work to locate and account for as many of these devices as possible. Once that work is complete, GCHQ will be able to report how many devices have been confirmed as lost.

What to hunt in your own estate is the same gap: any register that cannot give, on demand, the number of items issued, the number returned, the number unlocated and the encryption state of each.

What to watch, and the question the record leaves open

Three things can change the picture. The written progress reports that IPCO requires through 2026 are not stated to be public. The new tool that "will come into use in 2026" is a control that either produces a reliable register or does not. And the confirmed count GCHQ says it will report once its programme of work is complete is the number that would turn a ceiling into a fact. As of the time this briefing was read on 30 October 2026, none had been published.

If a register cannot say how many items exist, how many are missing and what each one held, on what basis can anyone say that nothing of consequence was on them?

Key facts