decrypted · 1 november 2026 · vulnerabilities and patching · uk policy and law · surveillance and privacy

GCHQ cannot say how many removable drives it has lost

GCHQ cannot say how many of its USB sticks, hard drives and discs it has lost. That is the finding in the Investigatory Powers Commissioner's annual report, laid before Parliament this week, and it is less about spies than about stocktaking. Any UK organisation with a drawer of old media should read it as a mirror.

What the commissioner found

The Investigatory Powers Commissioner's Office, which oversees how UK agencies use surveillance powers, says GCHQ has now scoped the problem. The maximum number of removable devices it cannot immediately locate is, in the report's words, "a very significant number", which GCHQ currently estimates to be "in the thousands". The report lists USB sticks, external hard drives, compact discs and memory cards, and says some may hold data obtained under the Investigatory Powers Act. It also reported on the issue in 2024, and says it is "very concerned" and "disappointed with the time it has taken GCHQ to investigate".

Nothing in the report alleges that any device reached an adversary. The Record reported that a GCHQ spokesperson declined to say whether the agency knows of any unauthorised access. GCHQ says its management system for removable media "was previously not sufficiently robust to effectively track the items that were registered for use".

A catalogue nobody stamps

Think of a library whose catalogue lists every book but whose borrowers never sign anything out. You can count the shelves, yet you cannot tell a lost book from a misfiled one. The thousands are items GCHQ cannot immediately account for, not confirmed losses, and the report says how many are truly lost will only be confirmed when the tracing work finishes. You cannot judge a breach you cannot size.

It is also invisible to defenders. A lost stick writes no log, trips no alert and fills no dashboard. The only control is a record kept at the moment the device is issued, which is exactly where GCHQ admits its system was weak.

The Secure by Design lesson

Removable media is a data path, and a data path needs an owner from the day it is created. Four decisions would have changed this story:

Encrypt by default, so a lost stick is an inconvenience rather than an incident.
Issue media through a register that records who has it and when it comes back, with expiry dates.
Offer a managed transfer route, so staff are not reaching for a stick to get work done.
Use a tool that reports where media sits. GCHQ has commissioned one for use in 2026.

The cost is cultural, because the report says removable media is "an essential component" of some GCHQ processes. People will keep using what the system makes easiest.

What to do this week

Ask your IT lead three questions: how many removable devices have we issued, how many are encrypted, and how would we know if one went missing? If the answers are guesses, you have the same gap. Opinion, not advice.

Also this week

Binance. Binance says a compromised laptop belonging to a DevOps engineer gave attackers access to a service container, which they used to submit unauthorised withdrawals, and that it has found no evidence of a leaked wallet private key. The analysts at TRM Labs put the theft at about $6.36 billion across ten blockchains on 29 October and attribute it to North Korea's TraderTraitor group with high confidence. Binance has named no one, so treat attribution as the analysts' claim. The design lesson is old and dull: one engineer's laptop should not sit one hop from a path that can move billions.

Chainalysis. The blockchain analytics firm disclosed on 30 October that an external actor using what it calls "offensive agentic techniques" had accessed its internal systems and tools this month. It says the data touched was user IDs, full names, email addresses and organisation role labels, with no indication of access to investigation content, clear-text passwords, MFA secrets (MFA is a second check on top of the password) or session tokens. It has not said what was exploited or for how long, and it says the incident is unrelated to Binance. My view: if automated attackers can work through your tooling, detection and containment matter more than the perimeter.

A Linux kernel flaw. CVE-2026-98432 (CVE is the public reference number every known flaw gets) is a memory bug in the kernel's internet network code, where data is used after it has been freed. BleepingComputer reports the kernel CVE team scored it 9.8, that there is no confirmed exploitation in the wild, and that Ubuntu fixes were still in progress on 30 October. Debian's tracker lists fixes in 6.1.190-1 for bookworm and 6.12.113-1 for trixie. A flaw in code every server runs is only as manageable as your inventory of who runs which kernel.

Sources

If you want help turning a story like this into a plan for your own organisation, get in touch.