UK public sector / The intelligence community's developers do not exist

14 August 2026 · identity security gchq mi6 hmgcc

The rest of this site is largely an argument that public sector commit metadata is a phishing list sorted by employer. Thousands of developers at UK public bodies have their real name and their real work email address sitting in a public git history, permanently, because that is what git records and nobody thought to configure it otherwise.

Three organisations in this estate are different: GCHQ, the Secret Intelligence Service, and HM Government Communications Centre. They did not get there by accident, and what they did is available to everybody else.

The top of GCHQ's commit log

Here are the twelve people who have written the most code in github.com/gchq, ranked by commits across its 71 non-forked repositories — 146,410 commits in total, into projects including CyberChef (35,581 stars), Gaffer, Stroom and Bailo.

There is not a human name in the list. Not one. The pattern holds all the way down: of the 387 distinct GitHub accounts that appear in GCHQ's non-forked history, 18 are agency-issued numbered accounts (gchqdeveloper404, gchqdeveloper42, gchq-83497) and another 65 are initials-and-digits handles of the form ac28474 or bw27492 — the shape of an internal staff reference, not a name someone picked.

What that looks like against everyone else

The clearest single measure is what proportion of committer rows carry the organisation's own email domain. That is the field that turns a commit into a phishing target: it says who someone is and where they work, in one string, verified by the domain itself. It is measured against each body's own staff domain rather than against .gov.uk, because UKAEA's people use @ukaea.uk and scoring them against .gov.uk would rank them as more careful than GCHQ rather than less.

GCHQ sits at 1%. The Home Office sits at 33% — 3,270 rows carrying a Home Office address. Dstl, which is also a defence body and might be expected to behave like GCHQ, sits at 26%; UKAEA at 28%. The National Crime Agency, whose cyber unit publishes from nccu.nationalcrimeagency.gov.uk, is the highest in this group.

The mirror image is the share using GitHub's noreply address, which reveals a username and nothing else. GCHQ is the highest in the estate at 47%:

The honest caveat

A high noreply share is not by itself proof of a policy. GitHub uses that address by default for commits made through the web interface, and any individual can switch on "keep my email addresses private" without being told to. If the only evidence were the 47%, the right conclusion would be "GCHQ's developers commit through the browser more often", which would be dull and probably wrong.

The numbered accounts are what make it a policy rather than a habit. Nobody independently chooses to be gchqdeveloper404. An account named after the organisation, with a number where the name goes, is issued — and issuing it means somebody decided, centrally, that staff would contribute under a handle that maps to a person only through a register the public cannot see. That is identity management, and it is the control the other 129 organisations in this estate do not have.

MI6 publishes a design system

github.com/mi6 is real, it has been active since September 2021, and it is not what you would guess. Its five public repositories are the Intelligence Community Design System and its component library — a Stencil-based UI kit, in the open, under the Secret Intelligence Service's own name. Not a capability, not a tool: buttons, form fields, colour tokens and accessibility guidance.

It is also genuinely cross-agency, and that is the part worth pausing on. Of 67 contributors and 5,088 contributions to those repositories, the largest single contributor is GCHQ-Developer-530 with 1,151. Seventeen GCHQ-Developer-N accounts, thirteen MI6-N accounts and an HMGCCDeveloper182633 are all working on the same component library. Someone at GCHQ appears to have registered GCHQDev01001010, which is 'J' in binary, which is the only joke anybody has left in this dataset.

95.9% of human contributions to MI6's repositories come from pseudonymous accounts. The remainder are a handful of outside open-source contributors who wandered in to fix the design system, under their own names, as people do.

HMGCC, the newest and smallest

github.com/hmgcc — HM Government Communications Centre, described on its own profile as "National Security Engineering" — appeared in August 2024 and has four public repositories. Three of them are forks: angr, the binary analysis framework, and MI6's ic-design-system and ic-ui-kit. The only original repository is the .github profile, and its sole contributor is HMGCCSoftware.

It is a small presence, but it is the same presence. HMGCC forks the Intelligence Community Design System, uses it, and contributes back to MI6's canonical copy under a numbered handle. Three separate agencies, one shared component library, and not one identifiable person across any of them.

Why this matters beyond the three agencies

The interesting finding is not that the intelligence services protect their people's identities. It would be alarming if they did not. The finding is that the control is cheap, it is entirely within GitHub's standard features, and almost nobody else uses it.

Nothing GCHQ, MI6 or HMGCC has done here requires a bespoke platform, a procurement, or a security clearance. It is a numbered account, an organisation-wide policy that staff use it, and the noreply setting switched on. Any department could adopt the same pattern this afternoon, and the public sector developers whose work addresses are currently a matter of permanent public record would stop being a targeting list.

The counter-argument is real and worth stating: attribution is a virtue in open source. Being able to see who wrote something, ask them about it, and credit them is much of the point of working in the open, and a wall of numbered handles makes a codebase harder to engage with. The agencies pay that cost deliberately — and note that they pay it while still shipping CyberChef to 35,000 stargazers and publishing a design system for anyone to fork, so it is plainly not incompatible with doing open source well.

The question this dataset raises is not whether every department should follow suit. It is whether any of them ever made the choice at all, or whether 33% of Home Office committer rows carry a real work address because nobody was ever asked.

Method: GCHQ and the comparison organisations are measured from this project's weekly harvest of public repositories, fork-excluded. "Committer rows" counts one row per person per repository, so someone active in ten repositories appears ten times — that is the unit that matters for exposure, since each row is a separate public record of the same address. MI6 and HMGCC are not in the harvest list; their figures come from GitHub's contributors endpoint, which counts the default branch only, and are stated as contributions rather than commits for that reason. Nothing here required authentication or anything but public data, which is rather the point. See Method.

← All writeups