GCHQ criticised for failing to account for thousands of missing storage devices

Thousands of devices unaccounted for

GCHQ has been unable to locate thousands of storage devices, including USB sticks, external hard drives, and memory cards, according to claims reported by TechRadar. While the exact number remains unconfirmed, GCHQ has acknowledged the figure is "in the thousands."

The Investigatory Powers Commissioner's Office (IPCO), which oversees GCHQ’s compliance with surveillance and data security laws, has raised concerns about the agency’s handling of the issue. IPCO stated it remains "very concerned" and is disappointed by the time taken to investigate and address the problem.

Delays in investigation and action

The issue was first brought to IPCO’s attention years ago, indicating it is not a recent development. Despite this, progress in resolving the matter has been slow, prompting further scrutiny from the watchdog.

In 2023, IPCO asked GCHQ—alongside MI5, another UK intelligence agency—to review their internal processes for allocating and auditing removable media. The lack of timely action has exacerbated concerns about oversight gaps in handling sensitive data.

Security measures and risks

Many of the missing devices are reported to be protected by encryption or PIN access, mitigating but not eliminating the risk of unauthorized data exposure. The sensitive nature of GCHQ’s work heightens the potential consequences of such losses.

In response to the ongoing issue, GCHQ has commissioned a new tool to monitor and track storage devices. The tool is expected to provide clearer reporting on confirmed losses, though its effectiveness remains unproven.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This story is a stark reminder that even the most security-conscious organisations can develop blind spots in physical data management. For startups—particularly those in fintech, healthtech, or enterprise SaaS—it underscores three hard lessons:

First, encryption and access controls are only part of the solution. If you can’t track where a device is, you can’t secure it. Second, regulatory bodies are increasingly intolerant of ‘we’re working on it’ responses. IPCO’s frustration with GCHQ suggests that auditors will demand not just policies but evidence of compliance.

Finally, the reputational damage from such incidents can be outsized. For a startup, losing a single unencrypted laptop with customer data can trigger headlines; losing thousands of devices over years would be existential. The GCHQ case shows how easily internal oversight can fail—and how costly those failures can become.

Key takeaways

• Founders handling sensitive data—especially in regulated sectors like finance, health, or government contracting—should audit their own removable media policies. The delayed response at GCHQ underscores how easily oversight gaps can persist.
• Encryption and access controls are necessary but not sufficient; physical tracking of storage devices is equally critical, particularly for teams dealing with classified or proprietary information.
• Regulatory scrutiny of data security practices can escalate rapidly, as seen with IPCO’s criticism. Startups operating in high-compliance environments should preemptively document audit trails to avoid similar reputational risks.

Related on Lazyfounder

• More policy news