TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The UK’s Investigatory Powers Commissioner says GCHQ still lacks a clear account of the scale, location and recoverability of missing removable storage media that may contain data covered by the Investigatory Powers Act. The drives have reportedly been missing for years, but the exact number and the data they may hold remain unknown.
A report by the UK’s Investigatory Powers Commissioner’s Office says GCHQ has yet to establish how many removable storage drives are missing, where they are, or whether they can be recovered. The media may contain data related to the Investigatory Powers Act (IPA), and the issue has remained unresolved for years.
Investigatory powers commissioner Lord Brian Leveson described the number of missing drives as “a very significant number.” His report says GCHQ has not developed a sufficiently clear understanding of the scale, location and recoverability of removable media that may contain IPA-related information. It does not provide a specific count.
Leveson wrote that the underlying issues were first brought to his attention several years ago. He acknowledged that tracking down the media may involve technical and practical challenges, but said the time elapsed without a comprehensive account makes continued senior attention and remediation more important. The report says the commissioner will keep monitoring progress.
The Register reported that GCHQ officials have known about the missing storage media for years but remain unsure of the scope. The available information does not establish that the drives have been accessed by an unauthorized party, nor does it confirm what specific information is stored on them. The concern is that the media may contain sensitive material associated with the agency’s work under the IPA.
UK oversight report · GCHQ · Removable media
Missing Drives.
The Unknown Count.
GCHQ has not established how many removable drives are missing, where they are, or whether they can be recovered. The media may contain information related to the Investigatory Powers Act (IPA); the report does not confirm a breach or identify the contents.
01 / At a glance
What the report establishes
The commissioner’s findings describe an unresolved accounting problem involving removable storage media that may hold IPA-related data.
Scale is not established
Leveson called the number “very significant,” but the report does not give a numerical inventory.
Whereabouts remain unclear
GCHQ lacks a sufficiently clear account of the drives’ locations and whether they can be recovered.
No breach is confirmed
The available information does not establish access by an unauthorized party or confirm exposure of data.
02 / The oversight timeline
A long-running concern
The underlying issue reached the commissioner several years ago. A detailed chronology of losses and remediation is not provided in the report details.
Issue comes to light
Underlying concerns were drawn to Leveson’s attention several years ago.
Account remains incomplete
The scale, location and recoverability of the media are still unclear.
Senior attention urged
The elapsed time makes sustained attention and remediation more important.
Progress monitored
The commissioner says he will continue to track GCHQ’s progress.
“I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability…”
Lord Brian Leveson · Report statement
03 / Why it matters
Uncertainty limits risk assessment
A missing device is not proof of a data breach. But without a reliable count, locations or contents, the agency and its overseer cannot give a complete account of potential exposure.
Potentially sensitive material
The drives may contain data connected to GCHQ’s work under the Investigatory Powers Act. The contents of individual devices are unspecified.
Accountability gap
Without a complete inventory, officials cannot show that all affected media have been located, recovered or securely addressed.
Public details are limited
The report does not set out a full loss chronology, completed recovery steps, or a deadline for a complete accounting.
04 / The information gap
What remains unknown
The commissioner’s characterization signals scale, but it does not substitute for an inventory or establish what happened to the data.
Until GCHQ establishes a fuller account, the scope of possible exposure cannot be determined.
- The exact number of missing drives
- Last known locations or loss dates
- Whether any drives have been recovered
- Whether remaining media can be recovered
- The specific data stored on each device
- Whether unauthorized access occurred
- Which remediation steps are complete
- When a fuller public update may arrive
05 / Key questions
What we can—and cannot—say
QHow many drives are missing?
The exact number is not known publicly. Leveson described it as “a very significant number,” but no count is provided.
QWhat might they contain?
They may hold data related to the IPA. The report does not identify specific contents or confirm that data was exposed.
QHave any drives been recovered?
The available report details do not say. The commissioner says GCHQ lacks a sufficiently clear understanding of location and recoverability.
QHas GCHQ confirmed a breach?
No breach is confirmed in the information provided. Missing media alone does not establish unauthorized access.
QWhat happens next?
Leveson will continue monitoring progress. No deadline for a complete inventory or public update is specified.
QWhy is oversight still active?
The scale and status remain unresolved, and the potential sensitivity of the media warrants continued attention.
Why the Missing Drives Matter
The lack of a reliable count leaves an unresolved information-security and oversight concern. Without knowing how many devices are missing, where they might be, or whether they can be recovered, officials and the commissioner cannot give a complete account of the exposure or show that all affected media have been addressed.
The possible presence of IPA-related data makes the uncertainty consequential, though the report does not specify the contents of individual drives or say that any data has been exposed. The distinction matters: a missing device is not proof of a breach, but uncertainty over its contents and whereabouts limits the ability to assess risk.
For the public, the report also raises questions about how a sensitive agency tracks removable media and how long corrective work can remain incomplete. Leveson’s continued monitoring signals that the issue is still being treated as an active oversight matter, rather than a resolved historical incident.
Products Worth Considering
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
EcoFlow DELTA 3 Classic Portable Power Station, 1024Wh, 1800W
Anker SOLIX C1000 Gen 2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
A Long-Running Oversight Concern
The report concerns removable storage media that may hold information connected to the UK’s Investigatory Powers Act. The commissioner’s role includes oversight of the use of investigatory powers. In this case, the report focuses on GCHQ’s ability to account for potentially sensitive media, rather than describing a confirmed loss of data to an outside party.
The timeline is notable because the commissioner says the underlying problem came to his attention several years ago, while a clear account of the scale and recoverability is still lacking. The report’s wording indicates that the passage of time has increased the need for sustained attention, but it does not set out a detailed chronology of when each drive went missing or what steps GCHQ has taken in response.
Tom’s Hardware reported the issue based on the commissioner’s findings and coverage by The Register. The public details remain limited: the commissioner characterized the number as very significant, but neither the exact count nor a detailed inventory appears in the information provided.
“I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data”
— Lord Brian Leveson, investigatory powers commissioner
The Count and Contents Remain Unknown
The report does not state the exact number of missing drives, identify their last known locations, or say when each device was lost. It also does not clarify whether the media have been found, whether any are recoverable, or what data is on them. The commissioner’s description of a “very significant number” is a characterization, not a numerical inventory.
It is also unclear what specific recovery or remediation steps GCHQ has completed, what remains outstanding, and whether any information on the devices has been accessed by someone unauthorized. The information available does not confirm a data breach. Until the agency establishes a fuller account, the possible exposure and its scope cannot be determined from the report.
Commissioner to Track GCHQ Progress
Leveson says he will continue monitoring GCHQ’s progress. The next meaningful development would be a clearer accounting of the number of devices, their locations or last known status, and whether they can be recovered or securely addressed.
The report information provided does not give a deadline for that accounting or describe a scheduled public update. It is also not clear whether further details will be disclosed, given the sensitivity of the material potentially involved. For now, the confirmed position is that the oversight concern remains open and the scale of the missing-media problem has not been established.
Source: Tom’s Hardware
Key Questions
How many GCHQ drives are missing?
The exact number is not known publicly. Commissioner Lord Brian Leveson called it “a very significant number,” but the report does not provide a count.
What might the missing drives contain?
The media may contain data related to the Investigatory Powers Act. The report does not identify the contents of particular drives or confirm that sensitive information has been exposed.
Have the drives been recovered?
The available report details do not say whether any drives have been recovered. Leveson said GCHQ lacks a sufficiently clear understanding of their location and recoverability.
Has GCHQ confirmed a data breach?
No data breach is confirmed in the information provided. Missing media and uncertainty about their contents create an oversight concern, but do not by themselves establish that anyone unauthorized accessed the data.
What happens next?
Leveson says he will keep monitoring GCHQ’s progress. No deadline for a complete inventory or public update is specified in the report details.
Source: Tom’s Hardware
