英国政府通讯总部（GCHQ）数千个存放敏感数据的存储驱动器已遗失多年，这家英国信号情报机构至今仍无法解释这些设备的下落。根据调查权专员办公室（IPCO）的年度报告，官员们多年来已知晓这些存储驱动器失踪，其中可能包含与《调查权法案》（IPA）相关的数据。
Thousands of GCHQ storage drives containing sensitive data have been lost for years, and the British signals intelligence agency still cannot explain where they are. According to the Investigatory Powers Commissioner’s Office’s (IPCO) annual report, the missing storage drives have been known to officials for years, and may contain data related to the Investigatory Powers Act (IPA).
调查权专员布莱恩·利维森勋爵写道：“尽管根本问题早在数年前就被提请我注意，但我依然担忧，GCHQ 尚未建立起对可能包含 IPA 相关数据的丢失可移动介质的规模、位置及可恢复性的充分清晰认识。虽然我认识到其中涉及的技术和实际挑战，但随着时间的推移，若仍无法给出全面交代，持续的高层关注和可靠的补救措施就显得愈发重要。鉴于涉及材料的潜在敏感性，我将继续密切监督进展。”
"I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data, notwithstanding that the underlying issues were first drawn to my attention several years ago," wrote investigatory powers commissioner Lord Brian Leveson. "While I recognize the technical and practical challenges involved, the passage of time without a comprehensive account heightens the importance of sustained senior focus and assured remediation. Given the potential sensitivity of the material involved, I will continue to monitor progress closely.”
报告将失踪驱动器数量描述为“一个非常大的数字”，指出 GCHQ 已界定潜在丢失驱动器的最大数量，但不清楚问题的确切规模。该机构已启动“一项进一步工作计划”，以定位尽可能多的丢失设备，其中包括在年底前实施自动化资产追踪系统。该机构表示，该系统投入运行后，将能提供更精确的丢失驱动器数量。
Described as "a very significant number," the report notes that GCHQ has scoped the maximum number of potentially lost drives, but is unaware of the exact scale of the issue. The agency has embarked on "a program of further work" to locate as many of the lost devices as possible, which includes implementing an automated asset-tracking system by the end of the year. After this is up and running, it said it will be able to provide a more precise number of lost drives.
GCHQ 一名发言人告诉《The》：“正如 IPCO 所报告的，我们的可移动介质管理系统此前不够稳健，无法有效追踪登记使用的物品。IPCO 指出系统生成数据的缺陷是正确的，我们已针对其所有建议采取了行动。我们认识到可移动介质在我们系统中的安全性至关重要，并采取了一系列措施来减轻这些物品带来的风险。”
A GCHQ spokesperson told The: "As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use. IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations. "We recognize the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items.
报告中的调查结果已得到全面处理，为纠正这一问题所需的一切步骤均已采取。”数字取证专家、德蒙福特大学和伯明翰城市大学访问教授彼得·索默对我们表示：“考虑到英国政府通信总部（GCHQ）收集和处理的高度敏感数据类型，IPCO（调查权专员办公室）理应非常关切，更因该问题已存在数年。海量数据可存储在最廉价、成本最低的硬盘和存储卡上。作为专家证人，我深知在更为有限的层面上，妥善追踪委托给我的数据有多么重要。”
The findings in the report have been addressed comprehensively, and all necessary steps to correct this issue have been taken." Peter Sommer, digital forensics expert and visiting professor at de Montfort and Birmingham City universities, told us: "Bearing in mind the sort of highly sensitive data collected and processed by GCHQ IPCO is right to be very concerned, the more so as the issue is already several years old. Vast quantities of data can be stored on the cheapest lowest cost hard disks and cards. At a much more modest level as an expert witness I know how important it is to keep careful track of the data entrusted to me."
丢失重要设备并非GCHQ独有的“成就”。多年来，公共部门各个角落都出现过类似事件，例如英国国防部在2000年代中期遗失含有机密信息的USB驱动器、公务员例行丢失BlackBerry手机、英国警方丢失数千台设备等。这些丢失的存储驱动器只是IPCO在报告中指出的该机构多项违规行为之一。报告还对GCHQ在限制英国海外合作伙伴访问其大规模拦截收集的数据时所采用的松散保障措施表示“严重关切”。
Losing important devices is not an achievement that's exclusive to GCHQ. Myriad stories like this have emerged from all corners of the public sector over the years, such as the British Minidstry of Defence misplacing USB drives containing secret information in the mid-noughties, civil servants routinely losing their BlackBerry handsets, and UK police losing thousands of devices, too. The missing storage drives comprise just one of the agency's various transgressions highlighted by IPCO in its report. There are also "significant concerns" over the lax safeguards used to restrict the UK's overseas partners when accessing bulk-intercepted data collected by GCHQ.
对于GCHQ如何确保其自身分析人员在获取与新闻业、新闻来源及法律特权信息相关的机密材料时遵守保障措施，IPCO表示满意。然而，对于这些相同的保障措施如何适用于其国际合作伙伴——这些伙伴可访问其所谓的大规模数据拦截“产品”——则存在担忧。报告指出，大多数合作伙伴均已被妥善限制访问此类材料，但内部调查发现，在一家合作伙伴及其访问新闻材料方面存在安排不当的情况。GCHQ和该海外机构均承诺整改。
IPCO was satisfied at how GCHQ ensured its own analysts remained compliant with safeguards around accessing confidential material related to journalism, journalistic sources, and privileged legal information. However, there were concerns around how these same safeguards were applied to its international partners, which have access to its so-called bulk data interception "product." The report notes that most partners were properly restricted from accessing such material, although an internal probe found that there were inadequate arrangements in respect to one partner and their access to journalistic material. Both GCHQ and the overseas agency committed to rectifying the situation.
英国政府通信总部也遭到质询，此前其一款被“相对较少一部分公众”使用的网络应用出现软件漏洞，错误识别了被认为参与恐怖活动的个人。该机构发现并报告了这一软件缺陷，该软件用于“目标发现工作”。虽然该漏洞仅影响少数人，但这些错误导致依据《反恐怖主义法》进行了五次口岸拦截，并对受害者造成了“严重损害”。
GCHQ was also questioned after a software bug in a web app "used by a relatively small section of the public" misidentified individuals thought to be participating in terrorist activities. The agency identified and reported the flaw in the software, which it used for "target discovery work," and although it only affected a small number of individuals, the errors led to five port stops made under the Terrorism Act and caused "serious prejudice" to the victims.
对不了解情况的人来说，口岸拦截指的是执法部门在英国港口、机场、火车站或距北爱尔兰边界一英里范围内拘留嫌疑人，且无需存在怀疑即可实施。一旦被拘留，个人有法律责任提供其电子设备的密码，这些设备可被扣押最长七天，在某些情况下还会采集其生物特征标记。不配合可导致三个月监禁。然而，调查权力专员办公室裁定，按照《调查权力法》的定义，最终并未构成错误。
A port stop, for the uninitiated, involves law enforcement detaining a suspect at a UK port, airport, train station, or within one mile of the Northern Ireland border, and can be carried out without suspicion. Once detained, individuals have a legal responsibility to provide passwords to their electronic devices, which can be seized for up to seven days, and in some cases have their biometric markers taken. Failure to comply can lead to a three-month prison term. IPCO ruled, however, that there was ultimately no error made as defined by the IPA.
报告称：“这是因为相关活动是根据拦截令获得合法授权的，采用一种无意且不可预见的不完善目标发现方法并不构成此类错误。”尽管该机构拥有雄厚的技术专长，调查权力专员办公室表示，影响该软件的问题无法预见。英国政府通信总部并不是英国情报界中唯一违规的机构，军情五处对臭名昭著的“线人X”案的处理不当成为报告的重点。
“This is because the activity was lawfully authorised under an interception warrant and the adoption of an unintentionally and unforeseeably imperfect target discovery methodology did not constitute such an error,” the report stated. Despite the agency’s vast technical expertise, IPCO said that the issue affecting the software was not foreseeable. GCHQ was not the only offender among the UK intelligence community (UKIC), with MI5's mishandling of the infamous Agent X case taking center stage in the report.
线人X是军情五处的一名匿名线人，其真实身份从未公开。调查权力专员办公室进行的一项秘密调查以及该报告显示，军情五处明知线人X是一名沉迷于极端暴力的暴力厌女者，却仍对他进行管理。
Agent X was an anonymous MI5 informant whose real identity has never been publicly released. A secret inquiry by IPCO as well as the report revealed that MI5 managed Agent X despite knowing he was a violent misogynist obsessed with extreme violence.
莱韦森勋爵表示：“X特工一案与我担任专员期间处理过的任何案件一样严重。”此前，军情五处向高等法院和调查权力法庭提供了虚假证据，以保护一名外国新纳粹线人，该线人因虐待其伴侣而正受到警方调查，其伴侣在公开场合被称为“贝丝”。®
Lord Leveson said "the case of Agent X is as serious as anything I have dealt with as Commissioner," after MI5 gave false evidence to the High Court and Investigatory Powers Tribunal to protect a foreign neo-Nazi informant who was under police investigation for abusing his partner, referred to publicly as "Beth." ®