The Investigatory Powers Commissioner's Office (IPCO) published its annual report for 2025 on Thursday 29 October 2026. It contains two findings about GCHQ that deserve to be read together. The agency cannot account for "thousands" of removable storage devices, and flawed intelligence from its target discovery work led to five people being stopped at ports under counter-terrorism powers. One is a failure of records. The other is a failure of analysis with consequences for real people.
What the report found
According to The Record's reporting on the IPCO report, GCHQ cannot account for thousands of "USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices." Some may hold data obtained under the Investigatory Powers Act. Commissioner Sir Brian Leveson said GCHQ had "not yet established a sufficiently clear understanding of the scale, location and recoverability" of the devices, and that the underlying issues were raised several years ago. IPCO said it was "very concerned" and "disappointed with the time it has taken GCHQ to investigate."
The report does not allege that any device reached an adversary. GCHQ declined to say whether it knew of any unauthorised access. Its spokesperson accepted that its "management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use."
The second finding concerns what IPCO calls the target discovery methodology. A particular software application, which the report does not name, "operated in an unusual way." That led GCHQ to misidentify selectors in a small number of cases. The result was five stops at ports under counter-terrorism powers, in which people were detained, had their devices downloaded and had biometrics taken. IPCO noted that "intelligence can sometimes simply be wrong." The reporting does not say how the application caused the error, and GCHQ declined to comment on this point.
The case for the agency
The strongest defence of GCHQ is worth stating fairly. Removable media is, in IPCO's words as reported, "utilised extensively" and is essential to some operating processes. An agency handling vast volumes of material across air-gapped systems will generate a large inventory of media. A tracking failure in that inventory is not the same as a leak. GCHQ frames this as a record-keeping problem rather than one of lost items, and says it has acted on all of IPCO's recommendations. It is also true that the report found no evidence of compromise. Intelligence work is probabilistic, and a small number of errors from an analytical tool does not by itself show recklessness.
That defence is credible as far as it goes. It fails on the timeline. When the oversight body says the problem was raised years ago and that it is disappointed in the pace of the investigation, the issue is no longer a one-off lapse. It is a management failure in an organisation that holds some of the state's most sensitive data. The Record notes it is unclear whether GCHQ's audit has even established how many items are missing.
Why the port stops matter more
The missing media is the headline, but the five port stops show the sharper harm. Schedule 7 of the Terrorism Act 2000 allows officers to stop people at UK borders and copy their electronic devices without reasonable suspicion. Computer Weekly's 2025 roundup describes a solicitor held for nearly three hours under that power, with his phone seized. Because the power needs no suspicion, an upstream intelligence error costs the traveller nothing in evidentiary terms for the officer. The traveller bears all of the cost: detention, a downloaded phone and biometrics on file.
This is the core proportionality problem. A power that requires no suspicion at the point of use depends entirely on the quality of the intelligence that points officers to a person. If target discovery is unreliable, the lack of any suspicion threshold removes the last check. Five people were stopped, and for people with an ordinary reason to travel, a device download is a serious intrusion into private life, communications and, for some, privileged or journalistic material.
What proportionate reform looks like
A pro-innovation, pro-liberty position does not require hobbling signals intelligence. It requires that the tools be trustworthy and that errors be visible. Three steps follow from the report.
- Fix asset accounting first. GCHQ should publish, through IPCO, a reconciled inventory figure and a date by which the audit will be complete. "Thousands" is not a number oversight can track.
- Validate analytic tools before operational use. If a software application behaves unusually, its outputs should not feed stops at ports until independently tested. IPCO should be told when a tool is found unreliable, not only after harm occurs.
- Notify and remedy. Those wrongly stopped should be told, and their data deleted, to the extent that security allows. Remedy through the Investigatory Powers Tribunal is hollow if the person never learns why they were stopped.
The broader lesson is institutional. The system worked in the narrow sense that an independent commissioner found the problems and made them public. That is the oversight model the Investigatory Powers Act 2016 was designed to create, and it should be credited. But oversight that identifies a problem years after it was first raised, and publishes it only in an annual report, is slow. The IPCO annual reports page shows the 2025 report dated 29 October 2026, with its predecessor for 2024 published on 16 December 2025. Parliament and the public are reading about 2025 failures at the end of 2026.
Speeding that cycle, rather than expanding or shrinking GCHQ's powers, is the proportionate response. Surveillance that is accurate, accounted for and open to timely scrutiny is stronger, and more legitimate, than surveillance that depends on trust alone.