A senior director at the National Crime Agency (NCA) lost her job after sending sensitive and secret information over her personal email and on WhatsApp in what was described as a “serious information security” breach.
Nikki Holland, former director of investigations at the NCA, was responsible for some of the UK’s most high-profile criminal investigations, including the NCA’s Operation Venetic investigation into the use of EncroChat encrypted phones by organised crime.
She led county lines crime investigations and liaised with Five Eyes partner countries on criminal intelligence.
Holland was sacked after an internal disciplinary hearing on 21 December 2023 found that the former senior director had sent classified and secret NCA material via a personal email account and on WhatsApp groups in breach of NCA standards.
The NCA said it did not find any malign intent in the security breaches. Holland has the right to appeal her dismissal.
The NCA is assessing another allegation that Holland instructed staff to set WhatsApp messages on NCA phones to automatically delete following a hearing during a case under Operation Venetic in late 2020.
The court heard evidence that other NCA offices had sent WhatsApp and Signal messages relating to the EncroChat investigation, some of which were disclosed in legal proceedings.
A separate independent investigation by the Independent Office for Police Conduct (IOPC) into allegations of data protection breaches, bullying and misuse of public funds in relation to Holland and another NCA officer is continuing.
WhatsApp groups
The NCA’s disciplinary panel assessed 16 allegations involving Holland, and upheld two allegations of “gross misconduct” and two allegations of “misconduct”.
It found that that Holland had committed “gross misconduct” by using a personal email address to transmit sensitive and secret NCA material and by declassifying secret material to enable it to be sent from an NCA email account to a non-NCA email account.
Nikki Holland, former director of investigations at the NCA, was sacked after she was found to have breached NCA standards by sending classified and secret NCA material via a personal email account and on WhatsApp groups
Holland was found to have committed “misconduct” by sending sensitive and secret NCA information through WhatsApp groups and by using WhatsApp on personal devices for NCA communications.
The panel found no misconduct concerning the remaining 12 allegations, including those relating to the secure handling, storage, transmission and access to NCA material.
Operation Venetic
Holland’s most high-profile role was her responsibility for the NCA’s Operation Venetic investigation into organised criminals using the EncroChat encrypted phone network, which was compromised in an international police operation in 2020.
As a result of Operation Venetic, police forces and law enforcement agencies in the UK have made more than 3,100 arrests, convicted 1,200 offenders, recovered over nine tonnes of Class A drugs, and seized 3,400 rounds of ammunition and £81m in cash.
The NCA is understood to be confident that the NCA’s disciplinary panel conclusions and the ongoing allegation, first reported in the Sunday Express, will not affect ongoing prosecutions.
IOPC investigation
The Independent Office for Police Conduct began an investigation into Holland and a junior NCA officer following a referral from the crime agency. They were suspended from their posts in March 2022.
An IOPC spokesperson said: “Following a referral from the National Crime Agency, we began an independent investigation into the conduct of a senior officer and another officer with the agency. This investigation is ongoing.
“In light of additional information uncovered as part of our inquiries, we re-determined that four of the allegations should be subject to a managed investigation, carried out by the NCA under our direction. We have since discontinued the managed investigation as we considered the matters involved were better addressed under NCA internal employment procedures.”
Robust security policies
The NCA told Computer Weekly that the agency has had robust information security policies, procedures and training in place since 2012, which prohibits the transfer of sensitive NCA material to personal accounts, personal devices and software applications that are not approved for business use.
The agency published a policy giving “clear guidelines” on the use of encrypted applications on mobile phones in March 2023, after Holland was suspended.
A spokesperson told Computer Weekly: “All NCA officers are required to read this guidance and adhere to the agency’s requirements regarding acceptable use of social media and collaborative working applications, on both personal and corporate IT.”
Holland joined Merseyside Police in 1988, and became assistant chief constable of South Wales Police in 2015, before joining the National Crime Agency as director of investigations. She was awarded the Queen’s Police Medal in 2018.