The **Government Communications Headquarters (GCHQ)**, the UK's cyber and signals intelligence agency, is under intense scrutiny following revelations that it cannot account for thousands of portable media storage devices. The **Investigatory Powers Commissioner’s Office (IPCO)**, in its annual report for 2025, expressed deep concern over **GCHQ**'s inability to track these items and the prolonged time taken to investigate the issue. ### Thousands of Devices Gone Astray **IPCO** Commissioner **Sir Brian Leveson** stated that **GCHQ** has "not yet established a sufficiently clear understanding of the scale, location and recoverability" of the lost devices. These items, including USB sticks, external hard drives, and memory cards, are described as "utilised extensively" and essential to some of the agency's operational processes. The total number of missing devices is estimated to be "in the thousands." Crucially, some of these devices may contain sensitive data obtained under the Investigatory Powers Act, which grants authorities powers to intercept communications and hack suspect devices. While there is no allegation that the devices have fallen into adversarial hands, **GCHQ** acknowledged that its "management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use." The agency maintains that the issue is primarily one of record-keeping rather than outright loss, and states that it has taken action on all of **IPCO**'s recommendations, including conducting a full audit and updating its processes. However, it remains unclear if the audit has definitively determined how many items are truly lost. ### Flawed Intelligence Leads to Wrongful Suspicions In a separate but equally concerning finding, **IPCO**'s report also revealed instances where flawed **GCHQ** intelligence led to the misidentification of selectors, such as phone numbers or online accounts. In a "small number of cases," innocent members of the public were "wrongly suspected of being involved in terrorism-related criminality." These misidentifications resulted in actions against the individuals, including five stops at ports where people were detained, had their devices downloaded, and biometrics taken. The errors were attributed to "a particular software application" that operated in an "unusual way," rendering **GCHQ**'s target discovery methodology unreliable. Target discovery is a critical process for identifying individuals of intelligence interest based on communications data. The report did not specify the application but noted it was used by a relatively small section of the public and its unique operation inadvertently frustrated the intelligence gathering process. **IPCO** concluded that **GCHQ** could not have foreseen the issue and acted to minimize the effects once aware, acknowledging that "intelligence can sometimes simply be wrong." **GCHQ** declined to comment on the target discovery issue.