UK public sector / The intelligence community's developers do not exist

14 August 2026 · identity security gchq ncsc mi6 hmgcc

The rest of this site is largely an argument that public sector commit metadata is a phishing list sorted by employer. Thousands of developers at UK public bodies have their real name and their real work email address sitting in a public git history, permanently, because that is what git records and nobody thought to configure it otherwise.

Three organisations in this estate are different: GCHQ, the Secret Intelligence Service, and HM Government Communications Centre. They did not get there by accident, and what they did is available to everybody else.

A fourth is the interesting one. The National Cyber Security Centre is part of GCHQ, writes the guidance telling everyone else how to protect a code repository, and does not use its own parent's scheme.

The top of GCHQ's commit log

Here are the twelve people who have written the most code in github.com/gchq, ranked by commits across its 71 non-forked repositories — 147,389 commits in total, into projects including CyberChef (35,688 stars), Gaffer, Stroom and Bailo.

There is not a human name in the list. Not one. The pattern holds all the way down: of the 388 distinct GitHub accounts that appear in GCHQ's non-forked history, 18 are agency-issued numbered accounts (gchqdeveloper404, gchqdeveloper42, gchq-83497) and another 65 are initials-and-digits handles of the form ac28474 or bw27492 — the shape of an internal staff reference, not a name someone picked.

What that looks like against everyone else

The clearest single measure is what proportion of committer rows carry the organisation's own email domain. That is the field that turns a commit into a phishing target: it says who someone is and where they work, in one string, verified by the domain itself. It is measured against each body's own staff domain rather than against .gov.uk, because UKAEA's people use @ukaea.uk and scoring them against .gov.uk would rank them as more careful than GCHQ rather than less.

GCHQ sits at 1%. The Home Office sits at 34% — 3,288 rows carrying a Home Office address. Dstl, which is also a defence body and might be expected to behave like GCHQ, sits at 26%; UKAEA at 28%. The National Crime Agency, whose cyber unit publishes from nccu.nationalcrimeagency.gov.uk, is the highest in this group.

The mirror image is the share using GitHub's noreply address, which reveals a username and nothing else. GCHQ is the highest in the estate at 47%:

The honest caveat

A high noreply share is not by itself proof of a policy. GitHub uses that address by default for commits made through the web interface, and any individual can switch on "keep my email addresses private" without being told to. If the only evidence were the 47%, the right conclusion would be "GCHQ's developers commit through the browser more often", which would be dull and probably wrong.

The numbered accounts are what make it a policy rather than a habit. Nobody independently chooses to be gchqdeveloper404. An account named after the organisation, with a number where the name goes, is issued — and issuing it means somebody decided, centrally, that staff would contribute under a handle that maps to a person only through a register the public cannot see. That is identity management, and it is the control the other 209 organisations in this estate do not have.

MI6 publishes a design system

github.com/mi6 is real, it has been active since September 2021, and it is not what you would guess. Its five public repositories are the Intelligence Community Design System and its component library — a Stencil-based UI kit, in the open, under the Secret Intelligence Service's own name. Not a capability, not a tool: buttons, form fields, colour tokens and accessibility guidance.

It is also genuinely cross-agency, and that is the part worth pausing on. Of 67 contributors and 5,088 contributions to those repositories, the largest single contributor is GCHQ-Developer-530 with 1,151. Seventeen GCHQ-Developer-N accounts, thirteen MI6-N accounts and an HMGCCDeveloper182633 are all working on the same component library. Someone at GCHQ appears to have registered GCHQDev01001010, which is 'J' in binary, which is the only joke anybody has left in this dataset.

95.9% of human contributions to MI6's repositories come from pseudonymous accounts. The remainder are a handful of outside open-source contributors who wandered in to fix the design system, under their own names, as people do.

HMGCC, the newest and smallest

github.com/hmgcc — HM Government Communications Centre, described on its own profile as "National Security Engineering" — appeared in August 2024 and has four public repositories. Three of them are forks: angr, the binary analysis framework, and MI6's ic-design-system and ic-ui-kit. The only original repository is the .github profile, and its sole contributor is HMGCCSoftware.

It is a small presence, but it is the same presence. HMGCC forks the Intelligence Community Design System, uses it, and contributes back to MI6's canonical copy under a numbered handle. Three separate agencies, one shared component library, and not one identifiable person across any of them.

And then there is NCSC

The National Cyber Security Centre is not a separate agency. It is part of GCHQ, staffed from it, and it publishes the guidance the rest of government is meant to follow — including Protect your code repository. If the numbered-account convention were a GCHQ-wide policy, this is the organisation you would expect to find it in.

Here is the top of github.com/ukncsc, measured exactly as GCHQ was: 16 non-forked repositories, 2,342 commits, same harvest, same fork exclusion, same week.

Full names, and in several cases a first.last work address to go with them. Agency-numbered accounts in NCSC's history: none. On the name test — the share of committer rows whose author name is two or more words, or a first.last form — GCHQ sits at 24% and NCSC at 56%.

Most of it is not NCSC's own staff

This is where the finding needs handling carefully, because the obvious reading of that table is wrong. 64% of all commits to NCSC's own repositories are in a single one, edge-mod, an adapter for a threat-intelligence platform — and it was written by a supplier. The company domains in that repository (breadnats.co.uk, purpesecure.com, purplesecure.com) account for 1,474 commits, 63% of NCSC's total. Against that, ncsc.gov.uk appears on 51 commits across 6 committer rows out of 129 — which is what puts NCSC at 5% on the chart above, low, but low for the opposite of GCHQ's reason.

So the accurate statement is not "NCSC exposes its staff". It is that NCSC's public repositories expose the named developers of the companies it buys software from, permanently, alongside which government security project they worked on and when. That is a supply-chain targeting list rather than a staff one, and it is arguably the more useful of the two to an attacker: the supplier has none of the agency's protections and a contract that says exactly what it was trusted with.

Two smaller details make the point that nobody was checking. One of those supplier addresses is at purpesecure.com — the company's own domain with a letter missing, typed into a git config and committed a couple of hundred times. Another row was authored from a machine called mbp.local, and one address ends in a stray brace, ncsc.gov.uk}, from a template that never expanded. None of that is a policy being applied imperfectly. It is the absence of a policy, in the organisation that writes the policy.

In fairness to NCSC: most of its repositories are guidance documents rather than code — zero-trust-architecture, the device security configuration packs, the SME guidance — and several of the named contributors to those are outside experts commenting in the open, which is exactly what a public consultation should look like. The identity question only really bites on the code, and NCSC has much less of it than GCHQ does.

Why this matters beyond the three agencies

The interesting finding is not that the intelligence services protect their people's identities. It would be alarming if they did not. The finding is that the control is cheap, it is entirely within GitHub's standard features, and almost nobody else uses it.

Nothing GCHQ, MI6 or HMGCC has done here requires a bespoke platform, a procurement, or a security clearance. It is a numbered account, an organisation-wide policy that staff use it, and the noreply setting switched on. Any department could adopt the same pattern this afternoon, and the public sector developers whose work addresses are currently a matter of permanent public record would stop being a targeting list.

The counter-argument is real and worth stating: attribution is a virtue in open source. Being able to see who wrote something, ask them about it, and credit them is much of the point of working in the open, and a wall of numbered handles makes a codebase harder to engage with. The agencies pay that cost deliberately — and note that they pay it while still shipping CyberChef to 35,000 stargazers and publishing a design system for anyone to fork, so it is plainly not incompatible with doing open source well.

The question this dataset raises is not whether every department should follow suit. It is whether any of them ever made the choice at all, or whether 34% of Home Office committer rows carry a real work address because nobody was ever asked.

Method: GCHQ and the comparison organisations are measured from this project's weekly harvest of public repositories, fork-excluded. "Committer rows" counts one row per person per repository, so someone active in ten repositories appears ten times — that is the unit that matters for exposure, since each row is a separate public record of the same address. MI6 and HMGCC are not in the harvest list; their figures come from GitHub's contributors endpoint, which counts the default branch only, and are stated as contributions rather than commits for that reason. Nothing here required authentication or anything but public data, which is rather the point. See Method.

← All writeups