Spy school dropout: GCHQ intern jailed for swiping classified data – Source: go.theregister.com

A former GCHQ intern was jailed for seven-and-a-half years for stealing top-secret files during a year-long placement at the British intelligence agency.

Hasaan Arshad, now 25, completed a work placement at GCHQ in 2019 while studying computer science at the University of Manchester, and another placement from 2021 to 2022.

It was during this second placement that his offences took place. He joined a technical development team working on what the Crown Prosecution Service (CPS) described as “highly sensitive matters” stored on a top-secret network.

On August 24, 2022, two days before his year-long placement ended, Arshad copied an unspecified amount of data from the network to a mobile phone supplied to him by GCHQ, which he then copied again to devices at his home.

Police raided his home in Rochdale, Greater Manchester, on September 22, 2022, and found the data copied onto external hard drives connected to his home PC.

At an Old Bailey hearing on March 31, Arshad pleaded guilty to the offence of performing an unauthorized act in relation to a computer, one that created a significant risk of serious damage to national security.

It was during this hearing that prosecutors alleged the stolen data related to a top-secret piece of software worth millions of pounds, which was developed using taxpayer money.

“I removed the data simply out of curiosity to further develop some of the changes I was unable to complete during the course of my placement,” said Arshad. “I had intended to use my developments when I hopefully returned to my previous team.”

“I’m sorry for my actions and I understand the stupidity of what I have done. I understand the potential damage and risk when obtaining the data. I have accepted that I removed the data and the stupidity of doing so. I did take steps to ensure that the data was not compromised,” he added.

He was sentenced at the Old Bailey on Friday, June 13, 2025.

Handing down the judgment, Mrs Justice McGowan acknowledged that there is no evidence to suggest Arshad tried to sell, ransom, or otherwise financially benefit from the copied files.

However, she said: “The risk was obvious and the actual damage that might have followed is incalculable.

“I have carefully read the reports provided and the letters written by the defendant and his family. I accept that there is some evidence of neurodiversity. I recognize that such a condition may make the sentence to be served more difficult for him than others.

“However, I do not accept that it diminished his appreciation of risk. Those risks were taken because of the defendant’s intellectual arrogance, he believed he knew better than others, he believed he could finish the project alone and therefore that the rules did not apply to him.”

• The UK wants you to sign up for £1B cyber defense force
• Millions at risk after attackers steal UK legal aid data dating back 15 years
• Britain’s cyber agents and industry clash over how to tackle shoddy software
• GCHQ intern took top secret spy tool home, now faces prison

Bethan David, head of the counter terrorism division at the CPS, said: “Hasaan Arshad knew his actions were prohibited after he signed the Official Secrets Act and received his induction training.

“His conduct was deliberate and intentional, and represented a flagrant breach of the obvious and necessary rules in place.

“By transferring the top-secret material to his home computer and therefore exposing it to the risks of an unsecure system, Arshad created a significant risk of damage to national security.

“The Crown Prosecution Service will always seek to prosecute anyone that knowingly jeopardizes and endangers the safety of our country.”

Arshad was also handed two separate 18-month sentences for offences related to possession of indecent images of children, which police discovered on his devices during the 2022 house raid.

Possessing such images was not part of his work at GCHQ. In total, he had 40 videos of category A indecent material – the most serious in the grading system – and four graded as category B, all concerning children aged between seven and 13.

Arshad separately pleaded guilty to making these images in January 2023 at Manchester City Magistrates’ Court.

His 18-month sentence for the possession of category A images will be served consecutively from his computer misuse sentence, while the 18-month sentence for the category B images will be served concurrently. ®