Article By Cam Wakefield
The UK’s Investigatory Powers Commissioner Sir Brian Leveson has revealed that GCHQ has “lost” thousands of memory sticks that may contain information about people it has spied on.
The news is contained in the Commissioner’s 2025 annual report, published on Wednesday, October 29, and the “misplaced” storage devices are not the only controversy involving the agency, or other UK spy and law enforcement outfits.
The Commissioner’s role is to oversee the way the government uses its surveillance powers, granted to it by the Investigatory Powers Act (IPA), which lets the state collect bulk communications data and keep a year of everyone’s internet connection records, among other things.
But it turns out that GCHQ, one of the agencies that have access to this vast amount of data, is not even capable of keeping track of its own property. The issue of the missing memory sticks first cropped up “several years ago,” the Commissioner said, but GCHQ has only now commissioned a tool to keep tabs on its storage devices – which will not be in place before 2026.
GCHQ, on the other hand, is assuring everyone that the problem is solved already. “All necessary steps to correct this issue have been taken,” a spokesperson for the spy agency told The Register.
That’s not the only disturbing revelation contained in the report. GCHQ’s “target discovery” work – which is supposed to identify people linked to terrorism – has ended up flagging five entirely innocent people as suspects. This happened because an app that is used by “a relatively small section of the public” was behaving “in an unusual way,” and the agency’s algorithms picked up on that.
The five people whose lives were disrupted as a result of this had their phones and devices downloaded, were detained at ports under Schedule 7 of the Terrorism Act, and had their biometric data collected. “But for the inaccurate intelligence, these individuals almost certainly would not have been subjected to a port stop,” the report said.
While it is acknowledged that this was a clear case of intelligence work gone wrong, the report also states that “neither GCHQ nor any other public authority, including the police, were at fault” – and that “intelligence can sometimes simply be wrong.”
As for the five people who were treated like terrorists for no reason – the report said that the case was not even recorded as an error under the law, and that “there is no mechanism to inform an affected person in these circumstances.”
Another spy agency, MI5, has also been up to some no good, the report reveals. In the so-called Agent X case, the agency gave false evidence to the High Court and the Investigatory Powers Tribunal. An MI5 officer had confirmed the identity of an informant to a BBC journalist in June 2020 – but the agency told the court and the tribunal that this had not happened.
The court found that the special advocates, the High Court, the tribunal, and the Commissioner “were all misled” – and Sir Brian Leveson said that “the case of Agent X is as serious as anything I have dealt with as Commissioner.”
More evidence of how much trust the British public should have in the work of its spy and law enforcement agencies came from a prison, where an inmate’s conversations with their solicitor were recorded because the prison had mistakenly identified the lawyer as a “social contact.”
The Commissioner found that this had “caused significant prejudice or harm” – and this incident, along with others, including those involving the National Crime Agency, the Ministry of Defence, and the Police Service of Northern Ireland, were criticized in the report.
It’s not as if these agencies have a stellar record of competence and integrity that would justify the level of trust they are demanding from the public, and from internet platforms whose encryption they are trying to break.
We recently reported that the government has been fighting in the Investigatory Powers Tribunal to keep secret its order demanding that Apple open encrypted iCloud data. The tribunal even heard that the government’s “neither confirm nor deny” stance on this was “logically unsustainable.”
And then there’s the case of a Labour MP who resigned after it emerged that he had emailed GCHQ’s National Cyber Security Centre to link two journalists investigating his thinktank to a Russian disinformation campaign.
The Investigatory Powers Act, meanwhile, is the piece of legislation that underpins the UK’s mass surveillance program, and the government’s efforts to get even more powers to collect and keep people’s data are ongoing. But the report of the Investigatory Powers Commissioner paints a picture of a system that is not even capable of handling the data it has – and is not to be trusted with more.
The “safeguards” that are in place to prevent abuse of the powers granted by the Act are also shown to be lacking, since nobody is found to be at fault even when egregious errors are made – and nobody is informed that they have been subjected to these errors.
Be the first to comment