NCA director sacked after WhatsApp and email security breaches

WhatsApp groups

The NCA’s disciplinary panel assessed 16 allegations involving Holland, and upheld two allegations of “gross misconduct” and two allegations of “misconduct”.  

It found that that Holland had committed “gross misconduct” by using a personal email address to transmit sensitive and secret NCA material and by declassifying secret material to enable it to be sent from an NCA email account to a non-NCA email account.

Nikki Holland, former director of investigations at the NCA, was sacked after she was found to have breached NCA standards by sending classified and secret NCA material via a personal email account and on WhatsApp groups

Holland was found to have committed “misconduct” by sending sensitive and secret NCA information through WhatsApp groups and by using WhatsApp on personal devices for NCA communications.

The panel found no misconduct concerning the remaining 12 allegations, including those relating to the secure handling, storage, transmission and access to NCA material.

Operation Venetic

Holland’s most high-profile role was her responsibility for the NCA’s Operation Venetic investigation into organised criminals using the EncroChat encrypted phone network, which was compromised in an international police operation in 2020.

As a result of Operation Venetic, police forces and law enforcement agencies in the UK have made more than 3,100 arrests, convicted 1,200 offenders, recovered over nine tonnes of Class A drugs, and seized 3,400 rounds of ammunition and £81m in cash.

The NCA is understood to be confident that the NCA’s disciplinary panel conclusions and the ongoing allegation, first reported in the Sunday Express, will not affect ongoing prosecutions.

IOPC investigation

The Independent Office for Police Conduct began an investigation into Holland and a junior NCA officer following a referral from the crime agency. They were suspended from their posts in March 2022.

An IOPC spokesperson said: “Following a referral from the National Crime Agency, we began an independent investigation into the conduct of a senior officer and another officer with the agency. This investigation is ongoing.

“In light of additional information uncovered as part of our inquiries, we re-determined that four of the allegations should be subject to a managed investigation, carried out by the NCA under our direction. We have since discontinued the managed investigation as we considered the matters involved were better addressed under NCA internal employment procedures.”

Robust security policies

The NCA told Computer Weekly that the agency has had robust information security policies, procedures and training in place since 2012, which prohibits the transfer of sensitive NCA material to personal accounts, personal devices and software applications that are not approved for business use.

The agency published a policy giving “clear guidelines” on the use of encrypted applications on mobile phones in March 2023, after Holland was suspended.

A spokesperson told Computer Weekly: “All NCA officers are required to read this guidance and adhere to the agency’s requirements regarding acceptable use of social media and collaborative working applications, on both personal and corporate IT.”

Holland joined Merseyside Police in 1988, and became assistant chief constable of South Wales Police in 2015, before joining the National Crime Agency as director of investigations. She was awarded the Queen’s Police Medal in 2018.