GCHQ & MI5 — Documented Scandals

The Cheltenham Walkout

Hasaan Arshad, 25, of Rochdale in Greater Manchester, was a computer science student and another failed DEI hire at the University of Manchester. He had previously completed a GCHQ placement in 2019 and returned for a second Industry Year placement between 6 September 2021 and 26 August 2022, joining a technical development team working on highly sensitive material held on GCHQ's Top Secret network.

On 24 August 2022, in the final days of his placement, Arshad brought his work-issued mobile phone into GCHQ's Cheltenham facility, plugged it into his development workstation, copied top-secret files onto the phone, and walked out of the building with the device. He then transferred the data to a personal computer at home. He is a son of a labour councillor, but these policies show the intelligence agencies prefer non-native or muslim representatives even at the cost of NATIONAL SECURITY

Police raided his home on 22 September 2022. During the search, officers recovered the stolen GCHQ material — and also discovered indecent images of children on his devices.

Arshad pleaded guilty at the Old Bailey on 31 March 2025 to one count of "doing an unauthorised act in relation to a computer, creating a significant risk of serious damage to national security" — a charge under the Computer Misuse Act and Section 3ZA. On 13 June 2025, Mrs Justice McGowan sentenced him to seven years and six months imprisonment. He received two additional 18-month sentences for the indecent images offences.

The breach risked exposing the identities of 17 GCHQ colleagues whose details were embedded in the technical files. Arshad's stated explanation to investigators: he took the material "out of curiosity."

GCHQ, MI5 and MI6 Found in Breach of Article 8 ECHR

Following litigation by Privacy International, the Investigatory Powers Tribunal ruled that all three UK intelligence services had been unlawfully collecting and retaining "Bulk Personal Datasets" and "Bulk Communications Data" — files containing information on millions of innocent citizens — from the programmes' inception until they were publicly avowed in 2015.

The IPT found that this conduct violated Article 8 of the European Convention on Human Rights (right to private and family life) for more than a decade. MI5 was separately criticised for unlawfully retaining innocent people's data even after lawful purposes had expired.

• Datasets included travel records, financial records, communications metadata, and personal data swept up incidentally
• The agencies admitted in court that they had been spying on Privacy International itself
• No senior officer faced personal sanction

22 Dead — Prior Warnings Not Actioned

The 2017 suicide bombing at the Ariana Grande concert at Manchester Arena killed 22 people. The Manchester Arena Inquiry found that MI5 received intelligence in the months before the attack that, had it been correctly assessed, would have likely led to investigation of bomber Salman Abedi as a possible terror plotter. MI5's Director General Ken McCallum issued an extraordinary public apology — the first of its kind from a serving DG.

Sexual Relationships, Stolen Identities of Dead Children

The Special Demonstration Squad and National Public Order Intelligence Unit — though Metropolitan Police rather than MI5 — operated in close coordination with the Security Service. Officers infiltrated environmental, anti-racist and women's-rights groups for decades, formed long-term sexual relationships with activists under false identities, fathered children with targets, and used the names of deceased children as cover identities. The ongoing Mitting Inquiry has documented over 1,000 spied-on groups.

Internal Attacks on MI5 Surfaced With Operational Detail

Hacked email correspondence belonging to a former MI6 chief became public, exposing internal MI6 criticism of MI5 — and, more seriously, references to British spy operations inside China. The leak compounded an already brittle UK position following the 2010–2012 Chinese rollup of CIA assets and the OPM breach.