GCHQ lost 'thousands' of removable storage drives possibly holding IPA-related intercept data, IPCO reports
The Investigatory Powers Commissioner's Office (IPCO) annual report, signed by Lord Brian Leveson, states that GCHQ has lost a "very significant number" of removable storage drives that may contain data governed by the Investigatory Powers Act (IPA), and still cannot account for their scale, location or recoverability years after the issue was first raised. GCHQ says its previous management system for removable media was not robust enough to track registered items and that it is implementing an automated asset-tracking system by the end of the year. IPCO also raised "significant concerns" about weak safeguards applied to overseas partners accessing GCHQ bulk-intercepted data, with one partner found to have inadequate restrictions on journalistic material. Separately, a software bug in a GCHQ web app used for "target discovery" misidentified individuals as terrorism suspects, leading to five port stops under the Terrorism Act and "serious prejudice" to those affected, though IPCO ruled it did not constitute an error under the IPA. The report also covers MI5's mishandling of the "Agent X" case, where false evidence was given to the High Court and Investigatory Powers Tribunal.
Detalhes técnicos
- Loss involves removable media / portable storage drives registered in a legacy asset-management system whose data IPCO found flawed.
- GCHQ has scoped only a maximum potential number of lost drives; exact figures await the new automated asset-tracking system.
- A bug in an internally developed web app used for target discovery produced false positives in terrorist identification, affecting a small number of individuals.
Remediação
- GCHQ states it has actioned all IPCO recommendations and deployed mitigating measures for removable media risk.
- Automated asset tracking for removable media due by end of year.
- GCHQ and the unnamed overseas partner committed to correcting journalistic-material access safeguards.
Linha do tempo
-
GCHQ lost 'thousands' of removable storage drives possibly holding IPA-related intercept data, IPCO reports
ler a análise desta fonte ocultar
The Investigatory Powers Commissioner's Office (IPCO) annual report, signed by Lord Brian Leveson, states that GCHQ has lost a "very significant number" of removable storage drives that may contain data governed by the Investigatory Powers Act (IPA), and still cannot account for their scale, location or recoverability years after the issue was first raised. GCHQ says its previous management system for removable media was not robust enough to track registered items and that it is implementing an automated asset-tracking system by the end of the year. IPCO also raised "significant concerns" about weak safeguards applied to overseas partners accessing GCHQ bulk-intercepted data, with one partner found to have inadequate restrictions on journalistic material. Separately, a software bug in a GCHQ web app used for "target discovery" misidentified individuals as terrorism suspects, leading to five port stops under the Terrorism Act and "serious prejudice" to those affected, though IPCO ruled it did not constitute an error under the IPA. The report also covers MI5's mishandling of the "Agent X" case, where false evidence was given to the High Court and Investigatory Powers Tribunal.
Technical Details
- Loss involves removable media / portable storage drives registered in a legacy asset-management system whose data IPCO found flawed.
- GCHQ has scoped only a maximum potential number of lost drives; exact figures await the new automated asset-tracking system.
- A bug in an internally developed web app used for target discovery produced false positives in terrorist identification, affecting a small number of individuals.
Remediation
- GCHQ states it has actioned all IPCO recommendations and deployed mitigating measures for removable media risk.
- Automated asset tracking for removable media due by end of year.
- GCHQ and the unnamed overseas partner committed to correcting journalistic-material access safeguards.