UK Watchdog Flags Thousands of Missing GCHQ Storage Devices

En bref

• IPCO disclosed the issue in its yearly report released Thursday.
• GCHQ has thousands of storage devices whose whereabouts are unresolved.
• The oversight body says its inquiry remains active in 2025.
• No CVE or cyberattack is tied to the finding.

The UK’s Investigatory Powers Commissioner’s Office used its latest yearly report, issued on Thursday, to disclose that GCHQ has not been able to account for thousands of storage units. The oversight body says its examination of the matter is still active in 2025. No CVE has been assigned, and the facts do not point to a confirmed intrusion or exploit.

The affected organization is GCHQ, with IPCO acting as the external reviewer. The core issue is asset accountability: storage hardware that should be tracked through procurement, use, transfer, and disposal is instead unresolved. That creates a security worry because storage media can retain sensitive information even after it is removed from active service.

The finding matters beyond one agency’s inventory records. Intelligence and government bodies rely on strict chain-of-custody controls for removable media and drives. When large numbers of units cannot be located, oversight teams cannot easily confirm whether data was protected, sanitized, or destroyed. It also complicates assurance that no sensitive material remains on misplaced hardware.

Contextually, this is an oversight and governance problem rather than a reported cyber incident. IPCO’s role is to examine how intrusive powers and related practices are handled, and its yearly report is a key window into compliance gaps. The absence of a CVE does not make the issue trivial, but it does shape the response: the priority is reconciliation, documentation, and control improvement.

What to watch is whether IPCO’s continuing inquiry produces a fuller count, a timeline, or recommendations for GCHQ. Also watch for signs that the agency is tightening inventory reconciliation, disposal verification, and media-handling procedures. For other public-sector IT teams, the case is a reminder that unaccounted storage hardware is both an asset-management failure and a potential data-protection risk.

À faire maintenant

1. Reconcile storage media inventory against procurement, deployment, transfer, and disposal records, and flag every unresolved item.
2. Enforce signed chain-of-custody handoffs for removable media and drives, including return and destruction checkpoints.
3. Require asset tagging and full-disk encryption before any storage device enters service.
4. Audit decommissioning records for sanitization or destruction certificates, and investigate missing documentation.
5. Restrict removable media use through policy and endpoint controls, and log every connection.
6. Set a recurring reconciliation cadence and escalate unresolved media to security leadership within a defined deadline.
7. Brief staff on prompt reporting of lost, misplaced, or unaccounted storage devices.

Source originale

The Record