British intelligence misplaced 1000s of storage devices still can't say how many

GCHQ has lost a “very significant number” of removable storage devices, potentially holding data covered by the Investigatory Powers Act, and years after the problem came to light it still cannot say exactly how many are missing, where they are, or whether they can be recovered. The Investigatory Powers Commissioner, Lord Brian Leveson, says the agency’s tracking system was inadequate and urges sustained senior attention because of the possible sensitivity of the contents. GCHQ says it has acted on the oversight body’s recommendations and is introducing automated asset tracking by the end of the year to establish a more accurate count. A digital forensics expert stresses that even inexpensive drives can hold large amounts of sensitive information, making the prolonged lack of an accounting especially concerning.

The oversight report also identifies weaknesses in controls over overseas partners’ access to GCHQ bulk-intercepted data, including inadequate safeguards at one partner agency for journalistic material; both agencies have pledged corrective action. Separately, a software flaw in a GCHQ target-discovery tool wrongly identified some people as linked to terrorism. It contributed to five port stops, seriously harming those detained, though the commissioner found no legal error under the Investigatory Powers Act because the activity was authorised and the flaw was not foreseeable. The report also calls MI5’s handling of the informant known as Agent X exceptionally serious: the agency retained a violent extremist informant and gave false evidence to courts to protect him while he was under investigation for abusing his partner.