The investigatory powers commissioner has raised concerns following failures by some government agencies to follow safeguards in their use of surveillance and covert powers.
Sir Brian Leveson said that he was “disappointed and concerned” that a number of government bodies had failed to comply with safeguards under the Investigatory Powers Act, which governs surveillance and covert powers.
The commissioner said that overall, oversight was working well but highlighted failures by the signal’s intelligence agency, GCHQ, the National Crime Agency, the Prison Service and the Ministry of Defence in an annual report today.
MI5 lied to courts over Agent X
Leveson’s comments came after an investigation by the oversight body revealed that MI5 had lied to the courts and had misled the Investigatory Powers Commissioner’s Office over its handling Agent X, a violent neo-Nazi informer.
The former senior judge said today that the case of agent X was “as serious as anything I have dealt with as Commissioner.” MI5 had given false evidence to the High Court and the Investigatory Powers Tribunal, he said.
The failings identified in Leveson’s 2025 annual report raise wider questions about whether parts of the investigatory powers framework, particularly under the older Regulation of Investigatory Powers Act 2000, “remain clear, coherent and fit for purpose.”
“None of these are minor administrative failures,” he said. “Operational pressures are real, but they do not reduce the need for lawful consistent and well-understood safeguards,” he added.
GCHQ’s lost devices
The Investigatory Powers Commissioner criticised the signals intelligence agency GCHQ for failing to account for thousands of missing portable media devices that may contain secret data.
The agency had failed to explain what had happened to removable media years after being asked to do so by the Investigatory Powers Commissioner’s Office (IPCO).
The missing items include USB sticks, external hard drives, memory cards and other portable media storage devices used in GCHQ’s work.
GCHQ introduced a tool this year to monitor the issue, storage and location of removable media.
“We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” IPCOs report states.
IPCO said that His Majesty’s Prison and Probation Service (HMPSS) was “continuing to get the basics wrong” when intercepting prisoners communications, with inspectors finding “recurring compliance issues”.
In one case a prison wrongly intercepted calls between an inmate and their solicitor, causing significant “prejudice or harm” after misidentifying the phone number as the number of a social contact, though in that case the call was not listened to.
NCA handling of sources fell short
The National Crime Agency’s handling of covert human intelligence sources fell “well short of what the law requires and what I expect,” Leveson found.
Inspectors found “systematic weaknesses in governance and oversight” over the agency’s records of covert human intelligence sources and undercover work, held on computer systems and in manual files.
Significant volumes of records were held beyond their scheduled review dates and material could not always reliably be linked to specific failures or subjects of interest, raising questions about the lawfulness of continued retention of records.
Police Service of Northern Ireland
The commissioner’s report also identified problems in the Police Service of Northern Ireland’s handling of confidential and sensitive material.
The PSNI failed to inform IPCO inspectors of a surveillance operation against Belfast journalist, Barry McCaffrey and Trevor Birney, during an annual inspection, breaching the PSNI’s statutory duty of candour to IPCO inspectors, as previously reported by Computer Weekly.
The police force also failed to alert IPCO inspectors to a covert surveillance operation against investigative journalist Dónal MacIntyre, which sought to covertly monitor his social media posts.
Levenson disclosed that IPCO had carried out an interim inspection of the PSNI in December 2025.
Inspectors agreed with the findings of the McCullough Review that there was no evidence of the PNSI’s anti-corruption unit using a stand-alone system to bypass the authorisation process for monitoring journalists’ phone records.
“We are considering carefully whether the Review’s findings have any wider application, particularly in relation to levels of understanding, legal advice and training on confidential material across the law enforcement community,” the report states.
The report also highlighted that the Ministry of Defence had failed to properly apply safeguards to protect people detained overseas, who may be interrogated or interviewed to gather intelligence which is passed to the UK.
Schedule 7 stops
Other parts of the report reveal that GCHQ wrongly identified a number of people as suspects in terrorism-related activity, following an ‘issue’ with an undisclosed software application they were using, the report reveals.
This led to police wrongly stopping and searching five people under Schedule 7 of the Terrorism Act 2000, who were detained, had their electronic devices downloaded and their biometrics taken.
“We have concluded that, although the impact on those affected is highly unfortunate and regrettable, intelligence can sometimes simply be wrong,” IPCO found.
Serious errors
Applications by police and intelligence services for communications data, which reveal who phoned or emailed who, the time and length of the call, had grown by nearly 9% between 2024 and 2025 to reach 28,000 applications.
The report also reveals that there was a rise in the number of errors reported by the UK intelligence community and the National Crime Agency, including four “serious errors” related to communications data.
In one case a person was mistakenly arrested and released on bail based on inaccurate data obtained in an investigation into sharing indecent images of children.
In another case police wrongly searched a residence after obtaining communications data relating to the wrong person.
Errors in communications data linked to one mobile phone operator, led to 72 false positives and 88 false negatives in the identification of IP addresses. As a result two innocent people were arrested.
A timing mistake by a telecommunications operator led to the police arresting the wrong person during an investigation to identify a caller who had threatened significant harm to local people.
In another historical case it emerged that an innocent person had been arrested and detained for questioning and that three generations of the same family were mistakenly visited at separate addresses and questioned.
In both cases police officers had failed to heed warnings from the telecommunications operator over the reliability of its data.
Oversight is working
Leveson said that demands on IPCO were increasing and that he was exploring how new technologies and automation can support the organisation.
Despite raising serious concerns, Leveson said that his assessment was that independent oversight is working.
“I remain satisfied that, across a demanding and fast-changing environment, the system of checks on the use of covert powers continues to operate with rigour and independence,” he said.
IPCO provides independent oversight of the use of investigatory powers by intelligence agencies, police forces and other public authorities, under the Investigatory Powers Act. It has a remit of 600 bodies.
