News: 1750070488

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Spy school dropout: GCHQ intern jailed for swiping classified data

(2025/06/16)


A former GCHQ intern was jailed for seven-and-a-half years for stealing top-secret files during a year-long placement at the British intelligence agency.

Hasaan Arshad, now 25, completed a work placement at GCHQ in 2019 while studying computer science at the University of Manchester, and another placement from 2021 to 2022.

It was during this second placement that his offences took place. He joined a technical development team working on what the Crown Prosecution Service (CPS) [1]described as "highly sensitive matters" stored on a top-secret network.

[2]

Hasaan Arshad - image courtesy of Metropolitan Police

On August 24, 2022, two days before his year-long placement ended, Arshad copied an unspecified amount of data from the network to a mobile phone supplied to him by GCHQ, which he then copied again to devices at his home.

Police raided his home in Rochdale, Greater Manchester, on September 22, 2022, and found the data copied onto external [3]hard drives connected to his home PC.

[4]

At an Old Bailey hearing on March 31, Arshad pleaded guilty to the offence of performing an unauthorized act in relation to a computer, one that created a significant risk of serious damage to national security.

[5]

[6]

It was during this hearing that prosecutors alleged the stolen data related to a top-secret piece of software worth millions of pounds, which was developed using taxpayer money.

"I removed the data simply out of curiosity to further develop some of the changes I was unable to complete during the course of my placement," [7]said Arshad. "I had intended to use my developments when I hopefully returned to my previous team."

[8]

"I'm sorry for my actions and I understand the stupidity of what I have done. I understand the potential damage and risk when obtaining the data. I have accepted that I removed the data and the stupidity of doing so. I did take steps to ensure that the data was not compromised," he added.

He was sentenced at the Old Bailey on Friday, June 13, 2025.

Handing down the judgment, Mrs Justice McGowan acknowledged that there is no evidence to suggest Arshad tried to sell, ransom, or otherwise financially benefit from the copied files.

[9]

However, she said: "The risk was obvious and the actual damage that might have followed is incalculable.

"I have carefully read the reports provided and the letters written by the defendant and his family. I accept that there is some evidence of neurodiversity. I recognize that such a condition may make the sentence to be served more difficult for him than others.

"However, I do not accept that it diminished his appreciation of risk. Those risks were taken because of the defendant's intellectual arrogance, he believed he knew better than others, he believed he could finish the project alone and therefore that the rules did not apply to him."

[10]The UK wants you to sign up for £1B cyber defense force

[11]Millions at risk after attackers steal UK legal aid data dating back 15 years

[12]Britain's cyber agents and industry clash over how to tackle shoddy software

[13]GCHQ intern took top secret spy tool home, now faces prison

Bethan David, head of the counter terrorism division at the CPS, said: "Hasaan Arshad knew his actions were prohibited after he signed the Official Secrets Act and received his induction training.

"His conduct was deliberate and intentional, and represented a flagrant breach of the obvious and necessary rules in place.

"By transferring the top-secret material to his home computer and therefore exposing it to the risks of an unsecure system, Arshad created a significant risk of damage to national security.

"The Crown Prosecution Service will always seek to prosecute anyone that knowingly jeopardizes and endangers the safety of our country."

Arshad was also handed two separate 18-month sentences for offences related to possession of indecent images of children, which police discovered on his devices during the 2022 house raid.

Possessing such images was not part of his work at GCHQ. In total, he had 40 videos of category A indecent material – the most serious in the grading system – and four graded as category B, all concerning children aged between seven and 13.

Arshad separately pleaded guilty to making these images in January 2023 at Manchester City Magistrates' Court.

His 18-month sentence for the possession of category A images will be served consecutively from his computer misuse sentence, while the 18-month sentence for the category B images will be served concurrently. ®

Get our [14]Tech Resources



[1] https://www.cps.gov.uk/cps/news/former-gchq-intern-jailed-taking-top-secret-files-home

[2] https://regmedia.co.uk/2025/06/16/hasaanarshadcps.jpg

[3] https://www.theregister.com/2025/06/13/hdd_features/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aFA_lWotu-XtfvA9axcGwgAAA4U&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aFA_lWotu-XtfvA9axcGwgAAA4U&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aFA_lWotu-XtfvA9axcGwgAAA4U&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2025/04/01/student_gchq_theft/

[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aFA_lWotu-XtfvA9axcGwgAAA4U&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aFA_lWotu-XtfvA9axcGwgAAA4U&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[10] https://www.theregister.com/2025/05/30/uk_cyber_defense/

[11] https://www.theregister.com/2025/05/19/legal_aid_agency_data_theft/

[12] https://www.theregister.com/2025/05/12/uks_cyber_agency_and_industry/

[13] https://www.theregister.com/2025/04/01/student_gchq_theft/

[14] https://whitepapers.theregister.com/



Imagine if he'd hoovered up millions for useless PPE, or....

Empire of the Pussycat

...while PM, lied repeatedly to the country, taken bungs from rich friends, stripped citizens of their rights and caused billions of damage to annual GDP.

Then he'd get far lengthier sentence, oh, er

Yes, he's a dangerous twat and deserved punishment, but there's a serious imbalance in the justice system favouring those with wealth/power/connections.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Korev

Or sent it to a Signal group

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Dan 55

Or worked for Doge...

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Anonymous Coward

The fact that a middle class woman recently received a 31 month prison sentence for posting some hurty words on facebook suggests there are other, arguably more sinister, imbalances in the justice system than the usual wealth/power/connections type.

This guy was a disgusting paedophile who was probably flogging state secrets to a foreign entity. I'd say he got off fairly lightly.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Empire of the Pussycat

Skimming, I actually missed the paedo bit, yeah, throw away the key.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Ian Johnston

"Hurty words" = "calling for people to be burned to death".

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Anonymous Coward

Nope, that's not what happened.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Just Enough

Exact words on xtwatter;

"set fire to all the f*****g hotels full of the bastards for all I care... If that makes me racist, so be it."

Looks remarkably like a call for arson and murder.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Anonymous Coward

Looks remarkably like a call for arson and murder.

It really doesn't. Saying "for all I care", is equivalent to saying "I don't care if". That's not incitement.

Regardless, handing a 31 month prison sentence to someone with no previous criminal record, for a facebook post that was subsequently deleted an hour later, is Stasi-level insane .

She's effectively a political prisoner of a government who will simply brook no criticism of their open borders policies. The UK is crying out for the equivalent of 1st Amendment rights.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

TheRiddler

No she was a racist piece of shit as was agreed by the appeals court.

The FULL tweet was

“Mass deportation now, set fire to all the f***ing hotels full of the bastards for all I care… If that makes me racist, so be it.”

This is obviously and clearly inciting ratial hatred (as upheld by her original trial and the appeals court). Without the first bit you could MAYBE argue she meant it in the context you suggest but with the whole tweet it's clear. More than that, if it WASN'T meant in a racist way then why add "if that makes me racist then so be it"? SHE clearly underrstood and accepted that what she was saying was racist.

All that aside, the law is defined in Public Order Act 1986 Part 3 and she met the legal definition of Section 18 - Offence of using words, behavior or material. It doesn't matter what you think or believe, the courts found she met the legal test and was prosecuted accordingly. As she should, as she was a racist pig.

She also didn't go "The government sux, their policies on imigration are terrible and they should be brought to account." Had she been jailed for that, I would be agreeing with you, but she didn't. What she said was burn the hotels down with the immigrants inside. I don't see that as "critisizing the government", I see that as being a racist. That is absolutely something that needs a harsh scentence and considering the max scentence is 7 years I believe, I actually think she got off lightly.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

BebopWeBop

On your seond point, yes, I cna sympathise. On your fisrt - hurty words encouraging people to be burnt to death?

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Anonymous Coward

If the ONLY understanding you got from all the press regarding the 'middle class woman' was 'Hurty words' then you really do need to learn to read and understand what you read !!!

The woman was making deliberate statements to burn buildings containing immigrants down, this was at a time when such 'encouragement' was more than likely to be taken 'on board' and actioned by 'other people with similar views and less self control'.

The woman knew what was being said and the possiblity it might be actioned by other 'dingbats' ... so NO not just 'Hurty words' but incitement to commit wholesale death & destruction.

The woman was more than capable of understanding what she was doing BUT thought that the 'interWebs' would hide her views !!!

The attempt to contrive a story to cover what really happened and excuse it all convinced NOONE including the judge !!!

She got what she deserved and her 'class' makes no difference.

NO sympathy was or is possible !!!

Regarding the intern ... just another idiot who thought they would not get caught !!!

Also NO Sympathy !!!

The Official Secrets ACt is NOT a joke ... IF you don't believe you can follow it ... don't sign it !!!

Not signing it usually gets you a quick escort to the front door BUT you avoid Jail later !!!

:)

"Signing" The Official Secrets Act

jdiebdhidbsusbvwbsidnsoskebid

"The Official Secrets ACt is NOT a joke ... IF you don't believe you can follow it ... don't sign it !!!"

Pardon the pedantry, but someone in his position doesn't sign the OSA. Instead, they sign a declaration to the effect that The Act and their obligations under it have been explicitly brought to their attention. The OSA is a piece of legislation that applies to everyone in the UK. Not signing the bit of paper your employer asks you to in no way changes your requirement to follow it.

Everyone refers to signing the declaration as "signing the official secrets act" but it's not actually correct.

Re: "Signing" The Official Secrets Act

TimMaher

If I remember correctly it was called a “Section 10”.

But that was a long time ago so I may be wrong.

Re: "Signing" The Official Secrets Act

Doctor Syntax

But you might be breaking the Act to go into such detail on a public forum.

Re: "Signing" The Official Secrets Act

Caver_Dave

I believe that someone's security clearance level is an official secret.

The number of CV's I get (for normal work not requiring any clearance) where people boast about their clearance is unbelievable.

It shows they do not understand what they have signed and their CV goes straight in the bin.

Re: "Signing" The Official Secrets Act

abcdgoldfish

That's a euphemism, right? I think you meant to say "their CV goes straight off for secure disposal"...

Re: "Signing" The Official Secrets Act

BartyFartsLast

There's a whole linkedin group full of idiots who don't deserve or understand the clearances they have (for the moment)

Or perhaps it's a trap, join the group, lose your clearance?

Re: The OSA is a piece of legislation that applies to everyone in the UK

Mr Dogshit

The Official Secrets Acts (1911, 1920, and 1939) were repealed and replaced by the National Security Act in July 2023.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Anonymous Coward

The woman was making deliberate statements to burn buildings containing immigrants down, this was at a time when such 'encouragement' was more than likely to be taken 'on board' and actioned by 'other people with similar views and less self control'.

It would be an extremely difficult to task to prove that anyone read some nobody's facebook feed and was inspired to commit an arson attack. Once again, a 31 month prison sentence was completely disproportionate to the offence.

By the way, the political winds appear to be changing in the UK. These same loony laws which you're cheering for now are very likely to be used against you and your ilk in the not too distant future.

Don't worry, I'll still be around to say told ya so as you cry no fair! ;)

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Doctor Syntax

Unless you've been in complete isolation except for this one news story you must be well aware that there were a number of determined attempts to do this just this, prevented only by substantial police operations and fanned by just such posts. So no, it is not trivial.

Perhaps you are too young to remember the several thousand deaths mostly in N Ireland but spiling over into the rest of the UK and Irish republic. They too were fanned by words - and many from what you might well describe as middle class people if you think that makes them in some manner less likely to incite hatred. And in those days words didn't have the amplifying power of alleged social media to assist them.

It is not a change of political wind to condemn such provocation, not is it loony. Incitement it violence is incitement to violence at any time and, just as the incited violence would be, it needs to be treated as the crime that it is.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

jdiebdhidbsusbvwbsidnsoskebid

"It would be an extremely difficult to task to prove that anyone read some nobody's facebook feed and was inspired to commit an arson attack. Once again, a 31 month prison sentence was completely disproportionate to the offence."

I think the offence with which she was charged just requires an action to be inflammatory enough. It doesn't require proof that anyone actually did act on her words.

Also, with regards to disproportionality, 31 months was the court's initial decision, she appealed and the court of appeal agreed with the original court decision. So several stages of judicial process have been followed.

And she wasn't "some nobody" but the wife of a serving Conservative councillor. I don't know if anyone is actually cheering these laws, but those are the laws, that's the way it is.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Doctor Syntax

"who was probably flogging state secrets to a foreign entity"

Not supported by the evidence nor, AFAICS, believed by the prosecution but no doubt you have the usual clearer vision than those who have dealt with the case at greater length.

Re: Imagine if he'd hoovered up millions for useless PPE, or....

Jedit

They'd probably have found the same amount of nonce videos, though. The wealthy and powerful get protected from all kinds of crimes.

Headley_Grange

How? I mean - how was it possible that this can be possible? If GCHQ don't lock down their systems to prevent sensitive files like this being transferred to their own mobile devices, never mind a personal device, then someone at GCHQ should be sharing a cell with this daft bugger.

re: How

Eclectic Man

How did he get through his security clearance? Access to TOP SECRET information requires some fairly serious vetting, or so I thought.

Re: re: How

UCAP

TOP SECRET requires DV clearance which typically takes 6-12 months to complete (in my experience). However, DV looks for evidence that you are working for a foreign power, or are in a position that a foreign power could compromise you via bribery, blackmail, or whatever. It does not look for evidence of stupidity or arrogance which seems to be the case here.

I would be surprised if they let an intern loose on TOP SECRET information; it seems more than likely that he has cleared to SC and hence had access to OFFICIAL or OFFICIAL SENSITIVE (aka SECRET). SC clearance is faster to do (in can be completed in less than 2 months and sometimes in just a month) and looks for the same markers as DV, but obviously does not dig as deep.

One way or the other, Mr Arshad has just ensured that he will never be trusted with classified information at any level again.

Re: re: How

JacobZ

Having Class A child porn on your personal computer seems like a pretty substantial risk for blackmail, no?

Re: re: How

An_Old_Dog

The background -investigators probably don't dig through an investigatee's computer devices snd personal papers unless there are one or more flags that they ought to do that.

As they found no such flags, they did not do that.

Re: re: How

BebopWeBop

DV is pretty onerous - so much so that some companies whose employees need tit get additional salary to compensate. From my limited experience (being on the receiving end for a number of years) stupidity and criminality are definitely explored.

Re: re: How

Anonymous Coward

DV would have picked up on the paedo stuff.

Re: re: How

Anonymous Coward

For some of the "bright" GCHQ interns, they fast-track DV through (Allegedly)

Re: re: How

TheRiddler

OFFICIAL SENSITVE is very very different to SECRET. Please don't confuse people into believing there's any similarity.

For O (with SENSITIVE caveat) you need no more than BPSS. For long term access to SECRET you need SC and for TS you need DV. You can work at TS with SC for short term or specific operational purposes and likewise you can, under certain situations, work at S with just a BPSS or CTC. However practically that doesn't happen very often.

Either way O=S is not, nor has it ever been known as SECRET and they are vastly different security classifications.

Re: re: How

Boothy

You can access to TOP SECRET with just SC, although it's mean to be supervised access only.

Quote from [1]gov.uk : (In relation to SC)

Who needs it [SC] and what it provides access to

Individuals who are to be employed in posts which:

require them to have long-term, frequent and uncontrolled access to SECRET assets and/or occasional, supervised access to TOP SECRET assets

[1] https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels#security-check-sc

Re: re: How

jdiebdhidbsusbvwbsidnsoskebid

Passing any vetting process does not prevent one from making a poor data management decision at some later point.

Seems the wrong way around

may_i

Surely it should be 7.5 years for the kiddie porn, plus life on the sex offenders register and a concurrent 1.5 years for stupidly copying secret files?

Re: Seems the wrong way around

Pete Sdev

That's exactly what I thought upon reading the article.

Bethan David, head of the counter terrorism division at the CPS, said

Mr Dogshit

"Hasaan Arshad knew his actions were prohibited after he signed the Official Secrets Act"

No one needed to sign the Official Secrets Act. It applied to everyone, whether they liked it or not - that was kind of the point

Re: Bethan David, head of the counter terrorism division at the CPS, said

Doctor Syntax

True, but I'm not sure that the general public know that. "Signing the Officiel Secrets Act" is just an acknowledgement that you've been told - although if you sign things without reading it first you might sign it without having been told.

Re: Bethan David, head of the counter terrorism division at the CPS, said

Mr Dogshit

But the head of the counter terrorism division at the CPS isn't the general public.

goblinski

Serves him right.

Now, please, I want to see the sentence on whoever set up the sec policies that allowed this data to be copied through two hops to end on a personal computer, by an intern.

Valeyard

"I accept that there is some evidence of neurodiversity."

I accept that the evidence says he's either a wannabe-criminal or a complete fucking idiot

"a wannabe-criminal or a complete fucking idiot"

Anonymous Coward

Usually not mutually exclusive.

Perhaps not the sharpest tool in the shed. I assume employer issued phones are scanned for any evidence of misuse when returned which in this case alerted them to this exfiltration of the code. Extra marks if the spooks "instrumented" the phones before issuing them.

Personally I am surprised anyone was permitted to take a smartphone or any device capable of recording anything into the workplace - so perhaps he only differed from his employer in being "complete." Even desktop workstations with any of WiFi, Bluetooth or USB ports seems brain dead - dumb graphical terminals connected to a secured server would be my preference. Audit everything.

If you desire to retain your sanity best to avoid anything defence related (the oxymoron Military Intelligence is a clue) and definitely keep well away from the spooks (in counter-espionage being a paranoid nutter appears to be de rigueur.)

Re: "a wannabe-criminal or a complete fucking idiot"

Anonymous Coward

I have worked in much less sensitive places where everyone used diskless terminals on an air-gapped network, with no WiFi or Bluetooth, and all ports except those for keyboard and mouse where glue filled and even the keyboard and mouse connections where held in with cages. Phones were also banned.

Which Manchester?

GBE

Based on the booking photo from the Met, I assumed they'd caught up with him somewhere in the Antarctic...

Is this really appropriate

Anonymous Coward

Yes he was stupid. Yes he failed to follow the rules, but seriously 7 and half years....As admitted there was no proof he had any intention of making a profit from it

If stupidity was a crime 90% of politicians and a lot of CEO's would be behind bars. Locking him up with a sentence which exceeds that given to those who do cause serious harm to society serves absolutely no purpose. A criminal record and community service would of been enough

Schizophrenia beats being alone.