Thousands of USB Sticks Unaccounted For at GCHQ: What Businesses Should Learn

The Investigatory Powers Commissioner's annual report for 2025, laid before Parliament on 29 October 2026, says GCHQ cannot locate "a very significant number" of removable media items, currently estimated "in the thousands". The report does not say any of them reached an adversary. What it describes is an accounting failure: devices that were issued, used and then not tracked.

This piece sets out what the report says, what it does not say, and five steps that carry over to any business with USB sticks, external drives and memory cards in drawers.

What the report says

The report, written by the Investigatory Powers Commissioner, Sir Brian Leveson, defines removable media as "USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices". It adds that these items "are utilised extensively and are an essential component of some of GCHQ's operating processes".

GCHQ has now scoped the issue "in terms of the maximum number of items of removable media that it cannot immediately locate and are therefore unaccounted for". The report calls this "a very significant number", which GCHQ currently estimates to be "in the thousands". There is a programme of further work to locate and account for as many devices as possible, and once it is complete GCHQ will be able to report how many have been confirmed as lost.

The Commissioner's introduction is direct. He remains concerned that GCHQ "has not yet established a sufficiently clear understanding of the scale, location and recoverability of lost removable media that may contain IPA-related data", and that the underlying issues were "first drawn to my attention several years ago". IPA is the Investigatory Powers Act 2016. In the chapter itself he says he is "disappointed with the time it has taken GCHQ to investigate". GCHQ has commissioned a new tool for monitoring the issue, storage and location of removable media, due to come into use in 2026, and the Commissioner will require regular written progress reports throughout the year.

What the report does not say

It does not say any device was stolen or has reached anyone. "Unaccounted for" is a different state from "lost", and the report says the confirmed number of lost devices is still to come. It says some of the media "may contain" data covered by the Act, not that all do. It gives no figure beyond "thousands", and it is not about disposal.

The previous report, for 2024, adds context. It said MI5 and GCHQ had both been unable to locate a considerable number of devices, "albeit most items unaccounted for were encrypted or required a PIN to access". It put the cause down to "a previous lack of robust audit systems managing the issuing and return of removable media". The 2025 report does not repeat the encryption point, so we cannot say whether it applies to the current estimate.

Why this matters outside intelligence work

In our reading, the useful part of the story is the cause. Nobody is described as breaking in. The problem is that GCHQ cannot say where a large number of devices are. USB sticks and portable drives are small, easy to lose and easy to leave off any list. If you cannot say where a device is, you cannot show what happened to it when it left your control.

Five steps for your own removable media

These are our suggestions, drawn from the report's cause and from the mitigations it records. They are not the Commissioner's advice.

1. Keep a register. List every USB stick, external drive, memory card and disc that holds business or personal data, with an owner and a reason for it.
2. Record issue and return. The 2024 report records GCHQ's own fix: "a tracking system to ensure that all issued items are registered and returned at the end of their use". A spreadsheet does the same job for a small firm.
3. Encrypt by default. The 2024 detail that most unaccounted items were encrypted or PIN-protected is the reason to do it. A lost encrypted stick and a lost unencrypted one are very different events.
4. Run an amnesty and count. Ask staff to hand in unlabelled sticks and old drives, and compare the pile with the register. Our article on the USB sticks and small devices left in offices covers where they hide.
5. Record the end of each device. When media is retired, log each item and what was done to it. Overwriting does not suit every drive, as we explain in our article on NIST 800-88 Revision 2, and a bulk statement is weak evidence, as our piece on spotting a fake certificate of destruction shows. Old backup media needs the same treatment: see our article on backup tapes.

A second finding about records

The same report has a related finding on the National Crime Agency. Inspectors found it "was unable to demonstrate consistently" that covert-operation records, in electronic systems and hard-copy files, were being "reviewed, retained or disposed of in accordance with legislative requirements". They also found that "significant volumes of records were held beyond their scheduled review dates", and that weak management information, especially for paper holdings, meant material could not always be linked to specific operations. That is a different legal regime from the one most businesses work under, but the pattern is the same. The ICO's small-business advice puts it simply: "Don't keep data for longer than you need it".

For disclosure, we are an IT disposal company, so weigh the list above accordingly. Every quotation from the report can be checked against the published PDF.

The honest summary

The report describes a very significant number of devices that GCHQ cannot immediately locate, and the Commissioner's warning that time passing without a full account raises the stakes. It does not say the data was exposed. For any organisation, the lesson is smaller and just as practical: list your removable media, track who has it, encrypt it, and keep a record of what happened to each device at the end.