Mr Doomits - stock.adobe.com

Police worker could have put investigation into EncroChat encrypted phone network at risk

A police intelligence analyst admitted tipping-off a criminal contact that police had infiltrated the EncroChat encrypted phone network

A police employee put an international operation, aimed at harvesting messages from the EncroChat encrypted phone network widely used by organised crime, at risk after tipping off a criminal friend.

Natalie Mottram, 24, who had been seconded as an intelligence analyst at the North West Regional Organised Crime Unit, pleaded guilty to offences including unauthorised access to computer material, in Liverpool Crown Court last week.

Detectives at the regional organised crime unit suspected there had been a leak soon after the UK’s National Crime Agency (NCA) began Operation Venetic, its response to French and Dutch police’s infiltration of the EncroChat encrypted phone network in April 2020.

They arrested Mottram of Great Sankey, Warrington, in June 2020 after placing her under surveillance and supplying her with a bogus intelligence log referring to Jonathan Kay, the partner of Leah Bennett, a close friend of Mottram’s.

John McKeon, head of the NCA’s anti-corruption unit, said that Mottram’s corrupt actions had the potential to hugely damage the overarching investigation into EncroChat by alerting offenders of the need to abandon EncroChat and to cover their tracks.

“Operation Venetic was the deepest and broadest operation against organised crime the UK has ever seen and has taken huge numbers of dangerous offenders off the streets. But Mottram clearly didn’t care about that. Her actions were disgraceful,” he said.

The National Crime Unit received messages infiltrated from the EncroChat encrypted phone network, which had 9,000 users in the UK, from 1 April 2020 until 13 June 2020, using them initially to detect threats to life and then criminal activity by organised crime groups.

More than 1,100 people have been convicted under Operation Venetic, which has led to more than 3,000 arrests across the UK, and more than 2,000 suspects being charged.

Police have seized nearly six-and-a-half tonnes of cocaine, more than three tonnes of heroin and almost fourteen-and-a-half tonnes of cannabis, along with 173 firearms, 3,500 rounds of ammunition and £80m in cash from organised crime groups.

Mottram told Kay, 38, who had convictions for driving offences and for being drunk and disorderly, about the covert operation into EncroChat and informed Kay that officers had intelligence on him.

On 24 April 2020, a friend of Kay, who cannot be named for legal reasons, messaged another EncroChat user to say that he just learned that law enforcement had infiltrated EncroChat.

The unnamed friend also messaged a second contact, advising that he had learned from a lady working for the police that the NCA now had access to EncroChat encrypted messages.

The message warned the contact to automatically delete – or “burn” – EncroChat messages after a day to avoid being intercepted by the NCA software, which the message claimed was running 48 hours behind real time.

“I no [sic] a lady who works for the police. This is not hearsay. Direct to me. They can access Encro software. And are using to intercept forearms [sic] only at the moment. There [sic] software runs 48 hours behind real time. So have ur burns one day max. And try to avoid giving postcodes over it,” said the message.

He added: “Her words was are you on Encro, I said no why, I only sell a bit of bud. She said cool just giving you heads up. Because NCA now have access. But she wouldn’t lie.”

Mottram admitted misconduct in public office, perverting the course of justice and unauthorised access to computer material at Liverpool Crown Court on 18 August.

Evidence also revealed that she took selfies with her work computer visible showing a document classified as “Official sensitive”, bought cannabis from a dealer whose number was saved in her mobile phone, and had told Bennett about a murder file she had seen on her boss’s desk.

She will be sentenced on 3 November with Kay, who admitted perverting the course of justice at an earlier hearing.

How a police intelligence officer could have put Operation Venetic at risk

May 2018: Natalie Mottram, 24 from Warrington, is seconded to the North West Regional Organised Crime Unit as an intelligence researcher.

1 April 2020: The French Gendarmerie begins live collection of data from the encrypted phone network EncroChat in a joint operation with Dutch Police.

The National Crime Agency receives copies of the intercepted material as part of Operation Venetic, the NCA response to EncroChat, using it initially to identify threats to life, and later, the activities of organised crime groups.

2020: Mottram is conducting threat assessments of organised crime groups and is briefed on Operation Venetic.

21 April 2020: Mottram and Jonathan Kay, 38, meet at Kay’s house for nearly two hours, according to forensic phone site analysis. Kay was the partner of Leah Bennett, 38, a close friend of Mottram.

PM: Kay speaks on the phone with a man who cannot be named for legal reasons.

24 April 2020: Mottram again visits the home of Kay and Bennett in Newark Drive, Great Sankey, Warrington. Computer records show that Mottram was working on Operation Venetic from Kay and Bennett’s address.

Kay speaks with a friend who cannot be named for legal reasons.

24 April 2020: The un-named friend of Kay sends messages to alert two other EncroChat users about the police compromise of EncroChat.

12 June 2020: Mottram is placed under surveillance and asked to analyse a fake intelligence log referring to Kay. Mottram leaves work and drives to Kay and Bennett’s home. She has a key to the house and lets herself in.

5:15 pm: Kay arrives home.

5:22 pm: Bennett arrives home.

Mottram allegedly informed Kay and Bennett about the police intelligence log mentioning Kay.

5:26 pm: Bennett phones the partner of a man who cannot be named for legal reasons. Detectives believe the purpose of the call was to set up a meeting between the man and Kay.

Kay and the un-named man meet at a supermarket car park and talk for 20 minutes before leaving in their vehicles.

Mottram, Kay and Bennett are arrested. Police remove £200,000 in cash from Kay and Bennett’s house.

12-13 June 2020: EncroChat users receive a message stating that EncroChat had been compromised. No link has been suggested between the warning and Mottram’s activities.

Read more on Hackers and cybercrime prevention

CIO
Security
Networking
Data Center
Data Management
Close