He noted that the devices “may contain IPA-related data” — which has a high level of sensitivity.
IPA-related data refers to information collected or held under the Investigatory Powers Act 2016. That could include intercepted communications such as emails, texts and telephone calls, as well as information extracted from people’s computers or phones.
The report added that GCHQ currently estimates the number of devices “to be in the thousands” and is currently undergoing work so it can report how many of the devices have been confirmed as lost.
“We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” the report notes.
Last year IPCO disclosed that GCHQ and fellow intelligence agency MI5 had been unable to locate considerable numbers of storage devices, some of which potentially containing information classified as “TOP SECRET.”
A GCHQ spokesperson said: “As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use. IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations.
“We recognise the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items. The findings in the report have been addressed comprehensively and all necessary steps to correct this issue have been taken.”