The UK Investigatory Powers Commissioner's Office (IPCO) says in its 2025 annual report, ordered by the House of Commons to be printed on 29 October 2026, that GCHQ has scoped the maximum number of items of removable media (USB sticks, external hard drives, compact discs, memory cards and other portable storage) that it cannot immediately locate and are therefore unaccounted for, some of which may contain data handled under the Investigatory Powers Act. IPCO calls this a very significant number, which GCHQ currently estimates to be in the thousands, and says GCHQ has a programme of work to locate as many as possible, after which it will be able to report how many devices are confirmed lost.

The Commissioner writes that he remains concerned GCHQ has not yet established a sufficiently clear understanding of the scale, location and recoverability of the lost media, although the issues were first raised with him several years ago; IPCO says it is disappointed with the time GCHQ has taken to investigate, that a new GCHQ tool to monitor the issue, storage and location of removable media will come into use in 2026, and that it will require regular written progress reports throughout 2026. (source: IPCO)

The Record reported on 30 October that a GCHQ spokesperson said its management system for removable media was previously not sufficiently robust to track the items registered for use, that it has taken action against all of IPCO's recommendations and the findings have been addressed comprehensively; the spokesperson declined to say whether unauthorised people had accessed any of the missing media.

The Record notes the report does not allege any devices have fallen into the hands of adversaries. (source: The Record)

Correction (31 Oct 2026): removed the reference to the Australian Information Security Manual (cyber.gov.au ISM, Guidelines for media) and its control numbers as a source, because this desk could not read that page in full; the card's facts come from IPCO's annual report and The Record. (source: IPCO)