GCHQ intern who took secret data home jailed

A GCHQ intern who endangered national security, risked exposing 17 colleagues, and “threw away” thousands of hours of work when he took top secret data home has been jailed.

Hasaan Arshad, 25, pleaded guilty to an offence under the Computer Misuse Act following an investigation led by the Metropolitan Police Counter Terrorism Command.

Justice Maura McGowan said he caused “huge economic loss” and damaged trust after he used his mobile phone to remove material from a computer system and transfer it to his private computer on 24 August 2022.

Arshad, from Rochdale, Greater Manchester, was jailed for seven-and-a-half years at the Old Bailey.

The Manchester University computer science student also admitted two charges of making an indecent photograph of a child found on his personal phone following his arrest.

Part of the hearing – including a detailed assessment of the harm caused – was outlined behind closed doors in the absence of the press and public due to national security reasons.

GCHQ is the UK’s intelligence agency focusing on communications data and areas such as cyber crime and infiltrating hidden messaging networks and works in conjunction with MI5 and MI6.

The highest levels of security are needed for GCHQ to carry out its work to gain information about threats to the UK from “hostile states or terrorists” by using lawful covert tools and techniques, the court was told.

Duncan Atkinson KC, prosecuting, said Arshad’s actions created a “significant risk” of damage to national security and “put the safety of intelligence agency personnel at risk.”

The material he had removed was “top secret” said Mr Atkinson and “there was no reason to take it home.”

It covered not just his own area but the work of other teams and referred to some of them by their names and codenames.

“The protection of the names of people who work for the intelligence services is “critical for their safety” he added.

Police also found forty “graphic” files of child pornography – the most serious kind described as Category A – on another personal mobile phone belonging to Arshad.

Arshad was coming to the end of a year placement with a team that worked on the development of “tools and techniques” to obtain information about threats to the UK, based at the secure GCHQ site near Cheltenham, Gloucestershire.

He had undergone an GCHQ induction and was required to sign the Official Secrets Act.

It was made “abundantly clear” to him that access to top secret material had to be in controlled circumstances at “an extremely secure location”, Mr Atkinson said.

Mr Atkinson said Arshad committed a “flagrant breach” by removing material from a secure location to his home, where he “risked it falling into the wrong hands or being lost”.

“This significant security breach compromised lawful intelligence related activity that was being undertaken in the national interest,” he said.

“In doing so, he threw away many thousands of hours of work, and significant sums of taxpayers’ money.”

Arshad admitted removing data without authorisation “out of curiosity”.

He said he had no intention to hand over the data to anyone else.

He told police: “I would like to apologise for my actions. I removed the data simply out of curiosity.

“I’m sorry for my actions and I understand the stupidity of what I have done.”

Asked if he had breached the level of trust by removing sensitive data without authority, he replied: “No comment.”

Arshad’s lawyer Nina Grahame KC said he had been “reckless” “thoughtless and naïve”.

His internship had involved working on a “specific project” which he had been unable to complete before the end of the placement, she explained

He took the data home because he wanted to “continue and complete the most exciting and challenging work the defendant had ever undertaken” in the hope of gaining future employment at GCHQ, Ms Grahame said.

On the day of his arrest, he was about to start the third year of his studies at Manchester University.

He had been diagnosed as being “on the autism spectrum” and was “neuro-divergent”, she told the court.

Sentencing him for both sexual offences and breaching the computer Misuse Act, Mrs Justice Maura McGowan described Arshad as “intellectually arrogant” and that he had felt “the rules did not apply to him.”