THE CRUNCH
GCHQ has lost track of thousands of storage drives that may hold data covered by the Investigatory Powers Act, and years after the problem first surfaced the agency still cannot say how many are missing or where they went. The Investigatory Powers Commissioner's Office (IPCO), which oversees UK surveillance agencies, flagged the issue in its annual report. Commissioner Lord Brian Leveson wrote that he remains concerned GCHQ has not established a sufficiently clear understanding of the scale, location and recoverability of the lost removable media, despite the underlying issues being drawn to his attention several years ago.
The report describes the number of missing drives as "a very significant number". GCHQ has scoped the maximum number of potentially lost devices but does not know the exact figure. It has begun further work to locate as many as possible, including an automated asset-tracking system due to be running by the end of the year, after which it says it can give a more precise count.
A GCHQ spokesperson acknowledged that its management system for removable media "was previously not sufficiently robust" and said the agency has taken action on all of IPCO's recommendations. Digital forensics expert Peter Sommer, a visiting professor at de Montfort and Birmingham City universities, told The Register that IPCO is right to be very concerned given the highly sensitive data GCHQ handles, noting that vast quantities of data fit on even the cheapest drives and cards.
The missing drives are one of several IPCO concerns about GCHQ. The report also raises "significant concerns" about safeguards restricting overseas partners' access to bulk-intercepted data: an internal probe found inadequate arrangements for one partner's access to journalistic material, though both agencies committed to fixing this. A separate software bug in a target-discovery web app misidentified people as suspected terrorists, leading to five Terrorism Act port stops that caused "serious prejudice", although IPCO ruled the activity was lawfully authorised and so no IPA-defined error occurred.