EXCLUSIVE: NCA officers 'set WhatsApp messages to autodelete after prosecution disclosures were made in Sub Zero EncroChat case' - more details from Nikki Holland misconduct case

A TOP National Crime Agency (NCA) director was dismissed for using a personal email account to send "sensitive" and "secret" material after declassifying the information.

Nikki Holland, (above) its former Director of Investigations, was sacked last month<Dec>after being found guilty of serious data breaches by an NCA disciplinary panel of gross misconduct.

It was after she used a personal email to conduct official business and actions taken to declassify secret material so it could be sent externally of a Government cyber protected network.

She still has time to appeal the decision, but the NCA has yet to receive notice of a challenge.

We can also reveal a separate probe by the Independent Office of Police Conduct (IOPC) into allegations of data protection breaches, bullying and misuse of a corporate credit card concerning Ms Holland and a junior colleague continues.

An IOPC spokesman said: "Following a referral from the National Crime Agency (NCA), we began an independent investigation into the conduct of a senior officer and another officer with the agency. This investigation is ongoing.

In light of additional information uncovered as part of our inquiries, we redetermined that four of the allegations should be subject to a managed investigation, carried out by the NCA under our direction.

We have since discontinued the managed investigation as we considered the matters involved were better addressed under NCA internal employment procedures.

"This decision was taken to allow us to make use of resources not available to the IOPC but available to the NCA.

"In November, we advised the NCA of our intention to discontinue the managed investigation as we considered the matters involved were better addressed under NCA internal employment procedures.

In December, we wrote to the NCA confirming we had discontinued the investigation."

The NCA is also currently assessing a further misconduct allegation in respect of Ms Holland amid allegations she instructed staff to set WhatsApp messages to auto delete during a defence challenge in a major organised crime prosecution.

In respect of the concluded misconduct case the agency found no malicious intent and it was not referred for criminal investigation.

However, her actions, similar to those of Hillary Clinton and former Home Secretary Suella Braverman, who both used personal email accounts for Government business, was considered so serious as the NCA is listed alongside other security services such MI5, MI6 and GCHQ.

It is due to the highly sensitive work the agency is involved in targeting top-echelon organised criminals who cross international boundaries.

Ms Holland (above) was in charge of Operation Venetic which has led to the arrest of more than 3,000 people suspected of using the encrypted EncroChat mobile phone system to carry out organised crime across England and Wales.

More than 1,800 alleged EncroChat users have been charged with around 400 already convicted.

Details of the concluded misconduct case and the ongoing assessment have been disclosed to EncroChat defence lawyers.

Lawyers are now seeking further disclosures about the completed misconduct case and the ongoing assessment in case there is anything that undermines the prosecutions.

It is understood the NCA does not believe the disclosures undermine any ongoing prosecutions.

Ms Holland was suspended from her around £130,000 post in March 2022 when allegations first surfaced.

The NCA disciplinary panel looked at 16 allegations with gross misconduct found in two instances connected to her use of the private email.

Misconduct was found in respect of two other allegations concerning use of WhatsApp to send sensitive NCA material and also using WhatsApp on personal devices for NCA business in breach of agency standards.

Ten allegations, where no misconduct was found, concerned "secure handling, storage and transmission of NCA material across a range of media, including physical copies".

The NCA also found Ms Holland deleted material from a personal device that may have aided the investigation and provided misleading information about accessing a WhatsApp group from a personal device, but it was not found as misconduct.

Since French and Dutch law enforcement intercepted the EncroChat system in April 2020 and provided the NCA with historic and real-time messaging from the platform, there have been a series of legal challenges over admissibility of such evidence in British courts.

The first major challenge came in a case known as "Sub Zero" in November 2020. A judge ruled the evidence as lawful, but the trial has yet to take place.

During a Sub Zero preparatory hearing it emerged other NCA officers had used WhatsApp and other messaging apps such as Signal, to discuss EncroChat activity and some of those messages were disclosed to the defence.

It is alleged that following these disclosures, another NCA director set a WhatsApp group to auto delete all messages and nine days later Ms Holland sent an to staff to set the function on another WhatsApp group, which was later done.

No messages sent before November 17 2020 were deleted, the NCA found.

A National Crime Agency spokesperson said: “Following a hearing that concluded on 21 December 2023, former Director of Investigations Nikki Holland was found to have committed gross misconduct.

 “The allegations upheld against her related to serious information security breaches”

“As a result of the panel’s findings she was dismissed from her position with immediate effect.

 “While the panel did not find any malign intent in the breaches, the NCA expects the highest standards of conduct from all of our officers. Where those standards are not met, appropriate action will be taken.”

 "Regarding the allegation not addressed as part of the accelerated proceedings: This is being assessed

 “The NCA has had robust information security policies, procedures and associated training since 2013, which have always prohibited the transfer of sensitive Agency material to personal accounts, personal devices and to applications that were not approved for business use. Additionally, in March 2023, the NCA published a policy providing clear guidance on the use of encrypted applications on mobile phones such as WhatsApp, for operational and non-operational purposes. All NCA officers are required to read this guidance and adhere to the agency’s requirements regarding acceptable use of social media and collaborative working applications, on both personal and corporate IT. 

 “The NCA expects the highest standards of conduct from all of our officers. Where those standards are not met, appropriate action will be taken.”