"I removed the data simply out of curiosity"
A university student has admitted to putting national security at risk by taking top secret data home while on placement at GCHQ.
Hasaan Arshad pleaded guilty under the Computer Misuse Act 1990.
He admitted creating a significant risk of serious damage to national security by transferring sensitive data from a secure GCHQ computer to his personal device.
While on secondment to the intelligence agency, Arshad used his work phone in a top-secret area, connecting it to a workstation and transferring classified data. This included the names of GCHQ employees.
Prosecutors said the information was worth millions of pounds and included a tool that could have “put lives at risk”.
Arshad, the son of a Rochdale councillor, allegedly transferred the data to his home computer.
He was arrested in 2022 and, in a prepared statement to officers, admitted taking the data but denied any intention to share it.
He said: “I removed the data simply out of curiosity to further develop some of the changes I was unable to complete during the course of my placement.
“I had intended to use my developments when I hopefully returned to my previous team. I’m sorry for my actions, and I understand the stupidity of what I have done.”
He told police he understood “the potential damage and risk” but insisted no one else had accessed the data.
Investigators later found WhatsApp messages in which Arshad discussed “developed vetting” in the cyber sector.
On May 26, 2022, he also mentioned “bug bounty”, a term for payments made to disclose digital vulnerabilities.
In one message, he said: “You can get like 10k for simple info leaks.”
Prosecutors told an earlier hearing the data was classified as “top secret”.
The Ministry of Justice defines this as the government’s most sensitive information, where compromise could lead to loss of life or threaten national security.
The court heard the removed data contained a GCHQ tool developed over thousands of hours at significant taxpayer expense.
If compromised, prosecutors said it would “put lives at risk”.
Nina Grahame KC, defending, said Arshad had pleaded guilty on “the basis of recklessness as to the damage caused” rather than intent.
She noted he was 21 when he began his internship and 22 at the time of the offence. Psychiatric and psychological reports will be submitted before sentencing in June 2025.
Arshad was released on bail.
Mrs Justice McGowan ordered a pre-sentence report but warned him “that does not mean there will not be a custodial sentence”.
He will be sentenced at the Old Bailey on June 13. He will also be sentenced for two separate offences of making indecent images of children, which he pleaded guilty to in 2023.
As part of the investigation, officers found 40 Category A images, the most serious type, and four Category B images on his Samsung phone.
Loading ...