GCHQ intern took top secret spy tool home, now faces prison

A student at Britain's top eavesdropping government agency has pleaded guilty to taking sensitive information home on the first day of his trial.

Hasaan Arshad, 25, speaking at the Old Bailey in London, admitted that on August 24, 2022, he took his phone into a highly secure area of GCHQ, the UK's intelligence and security branch, and downloaded top secret information – including some staff names – then returned home and transferred it to a hard drive connected to his PC.

He pleaded guilty to breaking Section 3ZA of the Computer Misuse Act 1990, by "unauthorized acts causing, or creating risk of, serious damage."

Prosecutors said Arshad downloaded a "top secret" tool that they estimated was worth millions of pounds and had been developed using a "significant amount" of taxpayer money. Arshad stole the software two days before his year-long placement at GCHQ was due to end.

Arshad, a student at the University of Manchester, was arrested and his home was searched on September 22, 2022, according to reports. After his computer equipment was searched, investigators found he had illegally created two indecent images of a child that month; he already pleaded guilty to two charges relating to those crimes in 2023.

Investigators found discussions on his phone relating to "bug bounties" and mention of "10k for simple info leaks," but in a prepared statement to police, he denied any financial motive.

"I removed the data simply out of curiosity to further develop some of the changes I was unable to complete during the course of my placement. I had intended to use my developments when I hopefully returned to my previous team," he said.

"I'm sorry for my actions and I understand the stupidity of what I have done. I understand the potential damage and risk when obtaining the data. I have accepted that I removed the data and the stupidity of doing so. I did take steps to ensure that the data was not compromised," he added.

The crime was one of "recklessness," Arshad's lawyer, Nina Grahame KC, told the court. He is currently out on bail and banned from using the dark web as part of the terms of his release. Sentencing is due on June 13 and Mrs Justice McGowan warned him that he may face a custodial sentence.

GCHQ runs a regular summer internship program and says it is seeking applicants from Black, Asian, mixed heritage, or other ethnic minorities, as well as those from socially or economically disadvantaged backgrounds, since these demographics are underrepresented at GCHQ.

The program involves shadowing intelligence staff and studying math, cryptography, and language skills. Students get free accommodation and £300 ($388) per week for the ten-week internship. Arshad attended the program in 2019 and was spending a year on placement at GCHQ with full security clearance, and stole the data two days before his placement ended.

Attempts to exfiltrate top secret data are flagged by security systems. Had Arshad read Edward Snowden's autobiography, he'd have known this. ®