HomeMy WebLinkAbout2014-1191.Bhattacharya.17-03-31 DecisionCrown Employees
Grievance Settlement
Board
Suite 600
180 Dundas St. West
Toronto, Ontario M5G 1Z8
Tel. (416) 326-1388
Fax (416) 326-1396
Commission de
règlement des griefs
des employés de la
Couronne
Bureau 600
180, rue Dundas Ouest
Toronto (Ontario) M5G 1Z8
Tél. : (416) 326-1388
Téléc. : (416) 326-1396
GSB#2014-1191
IN THE MATTER OF AN ARBITRATION
Under
THE CROWN EMPLOYEES COLLECTIVE BARGAINING ACT
Before
THE GRIEVANCE SETTLEMENT BOARD
BETWEEN
Association of Management, Administrative and
Professional Crown Employees of Ontario
(Bhattacharya) Association
- and -
The Crown in Right of Ontario
(Ministry of Government and Consumer Services) Employer
BEFORE Ian Anderson Vice-Chair
FOR THE
ASSOCIATION
Emma Philips
Goldblatt Partners LLP
Counsel
FOR THE EMPLOYER Jonathan Rabinovitch
Treasury Board Secretariat
Legal Services Branch
Counsel
HEARING June 24, September 20, October 19,
December 1 & 14, 2016; January 26,
February 3, 2017
- 2 -
Decision
[1] This is a discharge complaint.
[2] The Complainant was employed as an Oracle Business Analyst in the Business
Applications Systems Support (“BASS”) Branch of the Ministry of Government
Services. His employment commenced on July 13, 2009. His Branch Director
was at all times Robert Tee.
[3] On August 1, 2011, an email alleging significant unethical conduct on the part of
Mr. Tee was sent from a gmail account to various individuals within the
government. On August 29, 2011, a second such email was sent from a second
gmail account. On June 18, 2012, a third such email was sent from a third gmail
account. A fourth was sent on December 20, 2012 from a fourth gmail account.
The Employer considers all of the emails to have made serious and false
allegations against Mr. Tee. The emails purport to be from employees of or
associated with BASS, however it appears that the names of the “senders” are
not of individuals so employed or were not in fact sent by them. The emails were
sent from google accounts and the “owners” of those accounts are not traceable.
An initial investigation was unable to determine who had sent them. The
Employer, therefore, refers to the emails collectively as the anonymous emails.
[4] On or about July 26, 2012, a USB data key was found in the workplace. The
USB key was turned over to Mr. Tee. Mr. Tee testified that he inserted it into his
workstation and examined its content. He concluded that it was the property of
the Complainant and that it contained several government documents, including
a sensitive and confidential submission to Management Board. Mr. Tee also
located several documents which he considered to be related to the anonymous
emails. Mr. Tee contacted his superiors and the result was that the USB key,
and certain workplace computers, were subjected to an investigation by Jamie
Gardner of the Employer’s Forensic Information Technology team.
[5] Mr. Gardner prepared a report setting out the Information Technology (“IT”)
evidence which he had assembled in the course of his investigation. Mr.
Gardner gave evidence in the proceedings. His answers were balanced and fair
throughout. The parties, however, have a fundamental disagreement on how this
evidence, which is offered as circumstantial proof of the Complainant’s
knowledge and involvement, is to be assessed. I will discuss parts of the report
and Mr. Gardner’s evidence in greater detail below, but for the purposes of
understanding the parties’ arguments a few of the findings must be described at
a high level.
[6] Before doing so, I note that some of the evidence casts suspicion upon two
individuals who were formerly employed in BASS, each of whom left employment
with the Employer in 2012. Neither of these individuals was called as a witness.
I see no need to identify either of them by name and thus I have chosen to refer
to them as AA and BB.
- 3 -
[7] The investigation revealed the following:
• The USB key contained a draft of the June 18, 2012 anonymous email
in the form of a Word document named “Issue.docx”. It was “created”
on May 25, 2012 and last modified on June 2, 2012. The
Complainant’s work user name is listed as the “author” of that
document. It was “last saved” by “user12”. It was located in a folder
on the USB key called “New folder”.
• The USB key contained two Word documents related to emails sent by
BB complaining about her treatment by Mr. Tee: “Reply.doc.docx” and
“Tabby.doc.docx”. Reply.doc.docx was created June 5, 2012 at 10:30
PM and last modified at 10:41 PM. It was authored by user12 and last
saved by user12. It was located in New folder. Tabby.doc.docx was
created on May 8, 2012 and last saved on May 10, 2012. It was
authored under the Complainant’s work user name and saved under
AA’s work user name. These emails (which I will sometimes refer to
collectively as the BB emails) are not to be confused with the
anonymous emails, although the Employer perceives their content as
similar.
• The USB key contained two files which are copies of the August 29,
2011 anonymous email: an html file named “Tee Issue.htm” and a
Word document named “Tee Issue.doc.docx”. Tee Issue.htm was
created and last saved on May 10, 2012 (i.e. after the August 29, 2011
email was sent). Tee Issue.doc.docx was created and last saved on
May 10, 2012, seconds after Tee Issue.htm was created. It was
authored and last saved by the Complainant’s work user name.
• The USB key contained a copy of an Excel spreadsheet containing
information related to a highly confidential submission to Management
Board: “MB20 Final Figures.xls” (hereafter, “MB20”). MB20 was
located in New folder. The identity of its author is not relevant. It was
last saved under the work user name of AA at 8:47 PM on June 3,
2012.
• The USB key contained copies of three confidential documents related
to a project to consolidate government IT resources all of which were
also found in New folder: “IT-Consolidation.ppt”, the author is
irrelevant, but it was last saved under the Complainant’s work user
name on January 19, 2012; Project-Consolidation.ppt, the author of
which is again irrelevant, but it was last saved under AA’s work user
name on January 18, 2012; and Doc14.doc, the author of which is
given as the Complainant’s work user name and which was last saved
under AA’s work user name. It was created January 18, 2012 at 10:08
PM and last saved January 18, 2012 at 11:23 AM. (The reason that a
file’s creation date may be later than its last saved date is discussed
further below.)
• The USB key contains something on the order of a thousand files. The
vast majority are non-work related and personal to the Complainant.
Eighteen of those files were last saved by user12; some of the
- 4 -
eighteen were authored by user12, some of them were authored by
the Complainant’s work user name.
• The USB key did not contain any documents related to the other two
anonymous emails.
[8] I have put the terms “authored”, “last saved” by and “created” in quotes as this
information is derived from “metadata”. As discussed in greater detail below in
some circumstances metadata can be changed. The Association’s position is,
therefore, that the metadata is not reliable. It is also useful to note at the outset
that the Employer’s position is the evidence establishes the Complainant is
user12 and that the Complainant at least had knowledge of the contents of New
folder. The Association’s position is that the evidence does not establish the
Complainant is user12 or that he was aware of New folder or its contents.
[9] An allegation meeting was held on August 1, 2013 with the Complainant to
review the results of the investigation. The Complainant denied involvement or
knowledge, as described in greater detail below.
[10] The Complainant’s employment was terminated on August 15, 2013. The text of
the letter of termination states the following:
Dear Mr. Bhattacharya
A meeting was held on August 1, 2013 with yourself, your union
representative, Cedric Nazareth, Kathy Mareski, Transition Director,
Heather James, Human Resources Advisor and myself. The purpose of
the meeting was to discuss the results of the IT Security Investigation
which was initiated following discovery of a USB stick in the work unit.
This USB stick contained material related to serious and false
allegations against the Branch Director.
During the meeting of August 1, 2013, information was shared with you
respecting the following allegations:
• Your involvement with the anonymous emails sent on August 1, 2011,
August 29, 2011, June 18, 2012 and December 20, 2012 which
contained serious false allegations against the Branch Director and the
Business Applications Solutions Support Branch; and
• The contents found on a USB stick linked to you contained documents
that were highly confidential and contained prejudicial information.
I explained that this meeting was an opportunity for you to provide
additional information and/or any mitigating circumstances, in order to
assist me in making a final determination regarding the above noted
allegations.
During this meeting, you denied any knowledge of the emails and
provided no plausible response to the information contained in the IT
Security report that linked you to the creation of one of the emails.
- 5 -
After carefully reviewing all of the information available to the Employer,
including your responses to the above noted allegations, it is my
conclusion that the allegations regarding your involvement have been
substantiated.
[11] The letter was signed by Ken Kawall, the then Assistant Deputy Minister and
Chief Information Officer for the Ministry of Government Services.
[12] Mr. Kawall testified in chief that his decision was based on four factors: the
presence on the USB key of an almost identical copy of the June 18, 2012
anonymous email, with an origination date prior to June 18, 2012 (i.e.
Issue.docx); the presence of a number of other prior anonymous emails on the
USB key; the presence of highly confidential documents on the USB key; and the
fact that the USB key was unencrypted, in violation of OPS I&IT Policy. In cross
he confirmed that his decision to terminate the Complainant was based on Mr.
Gardner’s report and that, as stated in the letter of termination, in making his
decision he also relied upon the fact that the Complainant’s responses during the
allegation meeting were in his view inadequate.
[13] During the allegation meeting, the Complainant was asked a series of questions
about each of the anonymous emails: did he write it; did he modify it; and did he
send it. The stated premise of each series of questions was that a version of the
email had been found on the USB key. In some instances, as noted above, this
premise was incorrect. In each case the Complainant answered no.
[14] With respect to the August 1, 2011 email, Mr. Kawall testified that he found the
Complainant’s responses inadequate and that was a factor in his decision. Mr.
Gardner’s evidence established that in fact the USB key did not contain a version
of the August 1, 2011 email. When advised of this during cross examination, Mr.
Kawall agreed that the Complainant’s responses with respect to the August 1,
2011 email were in fact reasonable. He also agreed that his understanding at
the time he made the decision to terminate, that there was a version of the
August 1, 2011 email on the USB key, was incorrect.
[15] Mr. Gardner’s evidence established that the copies of the August 29, 2011 email
which were found on the USB key were made after the email was sent. In cross
Mr. Gardner agreed that there was no IT evidence that the Complainant had any
involvement in creating or sending that email. Mr. Kawall agreed that was the
case, but stated he was aware of that at the time he made the decision to
terminate.
[16] With respect to the December 20, 2012 email, Mr. Kawall testified he found the
Complainant’s responses inadequate and that was a factor in his decision. Mr.
Gardner’s evidence established that in fact the USB key did not contain a version
of the December 20, 2012 email. When advised of this during cross
examination, Mr. Kawall agreed that the Complainant’s responses with respect to
the December 20, 2012 email were in fact reasonable. He also agreed that his
- 6 -
understanding at the time he made the decision to terminate, that there was a
version of the December 20, 2012 email on the USB key, was incorrect.
[17] Mr. Gardner’s report indicated five documents were found on the USB key which
were related to the four anonymous emails. Two of those documents related to
the August 29, 2011 email. As discussed, they were created well after the
August 29, 2011 email was sent. Accordingly, they do not constitute evidence
the Complainant had any involvement in creating or sending that email. Two
were not in fact related to the anonymous emails. Rather they were related to
the emails sent non-anonymously by BB. Mr. Kawall agreed with Mr. Gardner’s
conclusion that they did not constitute IT evidence the Complainant had any role
in sending the anonymous emails. However, Mr. Kawall’s concern about the
presence of all of these emails on the Complainant’s USB key remained
unchallenged.
[18] The remaining document on the USB key consistent with one of the anonymous
emails was Issue.docx. As noted, it was a draft of the June 18, 2012 anonymous
email. During the allegation meeting the Complainant also denied any
involvement in writing, modifying or sending the June 18, 2012 email (including
any involvement in Issue.docx) and he denied any knowledge of the presence of
Issue.docx on his USB key. I will return to Issue.docx below. For present
purposes it suffices to say that Mr. Kawall testified that in his view the
Complainant was responsible for the mere presence of Issue.docx on his USB
key.
[19] Mr. Kawall also relied on the presence of highly confidential government
documents on the USB key. He was only able to recall one of these
unprompted: MB20. As with the anonymous emails, Mr. Kawall testified the
Complainant’s responses during the allegation meeting was among the factors
he considered in making the decision to terminate. During the allegation
meeting, the Complainant was asked to confirm MB20 was saved using his user
name, to which he responded he had “no idea”. In fact, the IT evidence
established that MB20 was saved to the key by someone using AA’s user name.
Mr. Kawall testified that he was not aware of this at the time of the allegation
meeting, but that it “probably would not have mattered”. Mr. Kawall was asked
about the other confidential government documents whose presence on the key
had caused him concern. He was unable to precisely recall, but agreed that they
could have been documents in relation to the consolidation of the Employer’s IT
services.
[20] Mr. Kawall testified the mere presence of MB20 and documents related to the
consolidation of IT services on the Complainant’s USB key was of concern.
Even if the Complainant had not authored it or saved it to the USB key, Mr.
Kawall testified that he found it “very difficult to believe that he would have no
knowledge of the resulting document” on the USB key. During the allegation
meeting, the Complainant was asked if he had any explanation as to how the
MB20 and documents in relation to the consolidation came to be on his USB key
and had no answer.
- 7 -
[21] Mr. Kawall also testified the fact that the USB key was unencrypted was a
concern. Mr. Kawall testified this was contrary to the GO IT Standards. The GO
IT Standards were not available at the time Mr. Kawall gave his evidence. The
parties subsequently agreed to stipulate the GO IT Standards distinguish
between files of different levels of confidentiality, with encryption only required for
the more confidential. The parties further stipulated that the MB20 file and the
files with respect to the consolidation of IT services would require encryption.
[22] The Association asserts that there is no evidence the Complainant had any
motivation to participate in the creation or distribution of the anonymous emails.
It points to the Complainant’s evidence that his relationship with Mr. Tee was
good up until January 2013. A brief digression is necessary to describe what
happened then.
[23] On January 9, 2013 the Complainant was in attendance at a staff meeting being
addressed by Mr. Kawall. Mr. Kawall was there to discuss one of the anonymous
emails. Mr. Kawall noticed the Complainant sitting with his hand resting against
his face with the middle finger raised. Mr. Kawall reported this to Mr. Tee. Mr.
Tee held an allegation meeting with the Complainant and then issued a letter of
counsel to the Complainant. The Complainant denied that he had ever made
such a rude gesture to Mr. Kawall. He testified that he had a sore neck at the
time and perhaps he had been supporting his head with his hand and
inadvertently made the gesture. He testified making such a gesture intentionally
was beneath his dignity and he could not even imagine making it. He was
tremendously insulted that Mr. Tee could think that he could do such a thing.
[24] The Complainant testified he lost all respect for Mr. Tee following the allegation
meeting. He considered filing a complaint against Mr. Tee. To this end, he
prepared a typed chronology of complaints from December 1, 2009 to January
22, 2013. The document is 2 pages long, single spaced, references specific
times and dates and has 11 paragraphs of “comments”. The specific concerns
relate to the level of merit increases awarded by Mr. Tee to the Complainant, the
alleged failure of Mr. Tee to provide time off or payment for overtime worked and
Mr. Tee’s removal of the Complainant as the department’s representative at
certain inter ministry meetings, which was allegedly done by email from Mr. Tee
with no further explanation. The chronology concludes with the comment: “The
above mentioned chronologies of events are ample proof that I have been
discriminated, subject to unfair judgement and insulted for no reason by Mr.
Tee.”. The Complainant did not in fact file the complaint against Mr. Tee. The
Complainant testified he did nothing with the chronology of complaints until after
the allegation meeting on August 1, 2013 with respect to the contents of his USB
key. Following that meeting the Complainant sent the chronology of complaints
to Mr. Kawall.
[25] In chief and cross, each of the allegations made against Mr. Tee in the
anonymous emails was reviewed with the Complainant. He denied sharing the
views expressed, sometimes stating that his view was the opposite and
sometimes stating that he had no knowledge or had no opinion. He also noted
- 8 -
that among the recipients of the emails was a provincial cabinet minister,
Harinder Tukhar. The Complainant stated that Mr. Tukhar was his MPP and that
he was very, very close to him, as he served on the executive committee of the
riding association. The Complainant testified that if he wanted to complain to Mr.
Tukhar about something, he did not need to send him an email because he could
speak to him directly at any time.
[26] In my view, while the chronology of complaints prepared by the Complainant
constitutes some evidence of motivation on his part to send the anonymous
emails attacking Mr. Tee, the tone of those emails is much more inflammatory
and they cover a number of issues which are not addressed at all in the
chronology of complaints. Thus, there is at best weak direct evidence of
motivation.
[27] During this stage of the hearing, the Association stipulated that the USB key was
the property of the Complainant. It contained files which were primarily personal
to the Complainant, including music and photographs. The photographs included
pictures of AA’s son. The Complainant testified that AA sometimes borrowed the
USB key. According to the Complainant, AA did so in order to copy some of the
files on the USB key to AA’s home computer. The Complainant also testified that
on one occasion, AA took the USB key home to review work which the
Complainant was doing on a specific project.
[28] Government policy requires employees to keep their work password, required to
log on with their work user name, confidential. The Complainant’s testimony was
that he kept his password confidential and did not share it with anyone, including
AA. The Complainant testified, however, that on many occasions AA would be
sitting next to him while the Complainant logged on to his computer. Sometimes
the Complainant would leave AA working on the Complainant’s computer while
the Complaint went to the washroom or to get a cup of tea.
[29] While this evidence suggested opportunity on the part of AA, there was no
evidence as to why AA, acting alone, would make use of the Complainant’s USB
key and thereby put the Complainant at risk. Indeed the evidence of the
Complainant was that he and AA had been very close friends while the two of
them worked together.
[30] Two further points from the evidence at this point. First, Mr. Gardner’s
investigation included an examination of Mr. Tee’s workstation. That
examination established that the documents related to the anonymous emails
had not been accessed on the USB key from Mr. Tee’s workstation. This was in
direct contradiction to Mr. Tee’s evidence that he had only accessed the USB key
on his workstation. Mr. Tee was unable to provide an explanation as to how this
could occur.
[31] Second, the Complainant made use of his USB key for work related purposes.
Specifically, he would use it to transport files from his workstation to the
workstations of colleagues. His USB key, therefore, was inserted into a variety of
- 9 -
computers and while the Complainant generally kept it in his pocket, he did not
have exclusive control of it at all times. Over the course of several years he
testified to approximately ten different individuals who may have had access to it.
Argument of The Employer
[32] The Employer states its case is simple. With respect to the Complainant’s
involvement in the anonymous emails: the USB key belongs to the Complainant;
a draft of one of the anonymous emails was found on the USB key; the metadata
points to the Complainant; and there is no plausible alternative explanation. With
respect to the confidential government document: once again, the USB key
belongs to the Complainant; the USB key was not encrypted; a copy of at least
one confidential government document was found on the USB key; the
Complainant was not authorized to have access to the confidential document and
in any event having a copy of the confidential document on an unencrypted USB
key is itself a serious violation of government policy; and there is no plausible
alternative explanation.
[33] The Employer argues that principle of Occam’s Razor applies. The Employer
describes that principle as follows: the explanation which requires the fewest
assumptions should be preferred.
[34] The Employer argues the Complainant’s evidence that he was not aware of New
folder is not plausible. It argues it is clear the Complainant is user12 from the
fact that most of the documents authored or saved by user12 were personal to
the Complainant. The Employer argues since Issue.docx and Reply.doc.docx
were saved by user12, and since user12 is the Complainant, they were saved by
the Complainant. The Employer notes the termination letter states the
Complainant was involved in one of the anonymous emails. It argues since
Issue.docx is a draft of the June 18, 2012 email, the allegation is made out.
Further, the Employer argues the evidence as a whole establishes the
Complainant was involved in all of the anonymous emails. The Employer argues
the BB emails, although not sent anonymously, are similar in content to the
anonymous emails. The fact the Complainant saved or authored those emails is
further evidence of his involvement in the anonymous emails. The Complainant’s
explanation as to how he came to have copies of the August 29, 2011 email on
his USB key, in the Employer’s view, makes no sense. The fact metadata can be
manipulated does not change the result. It still requires someone to do so
intentionally. Given the number of changes which would have needed to have
been made to eighteen separate documents to list user12 as the person who had
saved them, this is not plausible.
[35] The Employer acknowledges there is a discrepancy between Mr. Tee’s evidence
that he looked at copies of the anonymous emails on his workstation and Mr.
Gardner’s findings that he did not. The Employer argues the discrepancy does
not change anything with respect to the central issues of this case.
- 10 -
[36] The Employer then explores a series of alternative explanations as to how the
files ended up on the USB key: Mr. Tee did it; AA did it; BB did it; someone else
did it; someone using the training room computers did it; or, with respect to
Issue.doc, someone took a document “authored” by the Complainant, deleted all
of the contents and created the text which became the June 18, 2012 email. The
Employer discounts each of these theories in turn as being unable to withstand
scrutiny. Among other things with respect to AA, the Employer notes the
Complainant’s evidence was that he and AA were very good friends. Thus the
Employer argues, AA would have had no motive to implicate the Complainant in
the manner suggested. The Employer argues that ultimately one is left with the
simplest explanation: the Complainant did it.
[37] With respect to MB20, the Employer notes Mr. Kawall indicated the fact that a
sensitive, confidential government document was found on an unencrypted USB
key belonging to the Complainant was just as important to him as the anonymous
emails.
[38] The Employer then provides a review of case law. I have omitted portions of the
Employer’s review of the case law which were made in anticipation of arguments
not advanced by the Association.
[39] The Employer cites F.H. v. McDougall, [2008] 3 SCR 41 for the principle that
there is only one civil standard of proof, and that is proof on a balance of
probabilities. The Employer cites a number of cases in which an employer
sought to justify discipline of a grievor on the basis of circumstantial evidence. In
essence, the Employer argues those cases stand for the proposition that once an
employer has made out a prima facie case for discipline, a practical if not legal
onus shifts to the grievor to provide a credible alternative innocent explanation.
It refers to: OPSEU (Gyapong) v. Ontario (Ministry of Children and Youth
Services), [2013] OGSBA No. 82 (Gray); Ontario Power Generation and Society
of Energy Professionals (Verville), 2016 CarswellOnt 13503, 128 CLAS 139
(Surdykowski); Labatt Alberta Brewery and Unifor, Local 250A (Clark), 2015
CarswellAlta 2622, [2016] AWLD 2572, 127 CLAS 59 (Seveny); Canada Post
Corp. and CPAA (Topping), 2013 CarswellNat 3151, 116 CLAS 48, 235 LAC
(4th) 142 (Germaine); OPSEU (Brown) v. Ontario (Ministry of Community Safety
and Correctional Services), GSB No. 0764/84 etc., August 25, 1987 (Brandt);
and Canada Safeway Ltd. v. UFCW, Local 401 (Brandse), 2000 CarswellAlta
1735, [2000] AGAA No. 75, 63 CLAS 12, 94 LAC (4th) 86 (Smith). The Employer
refers to the oft cited passage in Faryna v. Chorny, 1951 CanLII 252 (BC CA),
[1952] 2 DLR 354 (BCCA) with respect to the assessment of credibility. Finally,
the Employer refers to De Lisa v. Canada (Treasury Board Secretariat - Solicitor
General - Correctional Service), 2002 CarswellNat 5730 as a factually similar
case in which discharge was upheld.
Argument of The Association
[40] The Association argues Occam was a fourteenth century mathematician and that
Occam’s Razor not only does not reflect arbitral jurisprudence, but it has been
- 11 -
implicitly rejected by boards of arbitration, including the Grievance Settlement
Board. Rather, the Association argues in cases where discipline is justified
solely on the basis of circumstantial evidence, not only must an employer present
reliable and cogent evidence to meet its burden of proof, but it must also show
there are no other reasonable or plausible explanations.
[41] The Association notes the evidence against the Complainant is entirely
circumstantial. The Association argues there is no evidence that the
Complainant had any motivation to participate in the creation or distribution of the
emails attacking Mr. Tee. On the contrary, the Association argues up until the
incident in January 2013, the relationship between the two was good. Following
that incident, the Complainant lost his respect for Mr. Tee and did write a
chronology of complaints, but those complaints were different than the issues
raised by the emails.
[42] With respect to the IT evidence concerning the anonymous emails the
Association makes several points. First, the investigation conducted prior to the
discovery of the USB key was unable to determine who had sent the emails.
Thus there is no direct evidence implicating the Complainant. Second, Mr.
Gardner testified the IT evidence did not conclusively prove who sent the emails.
Third, there is no IT evidence at all the Complainant was involved in creating or
sending three of four of the anonymous emails. Fourth, there are a number of
problems with respect to the IT evidence in relation to the fourth anonymous
email (the June 18, 2012 email) so that any apparent connection to the
Complainant is not in fact made out. Fifth, the IT evidence implicates AA with
respect to the June 18, 2012 email. Sixth, the fact the Complainant had a copy
of the August 29, 2011 email on his desktop which is subsequently copied to the
USB key proves nothing. The copies were made after the August 29, 2011 email
was sent and the Complainant’s explanation as to how he came to make copies
is entirely plausible. Again, if anything the IT evidence implicates AA. Seventh,
the Complainant denies any involvement in drafting the BB emails, but even if he
was involved there is no plausible basis for connecting the BB emails, which
were sent by a real employee, to the anonymous emails. In any event, the IT
evidence once again tends to implicate AA. Eighth, the evidence with respect to
user12 is suspect. It was gathered in a manner that specifically targeted the
Complainant. User12 is not a unique identifier, and could have been used by
others, including Mr. Tee, AA and BB, whose workstations were not targeted.
The last saved by name can be changed. There were hundreds of other
documents on the USB key personal to the Complainant which were not saved
by user12. Ninth, the Complainant did not have exclusive access to the USB
key: there were at least ten employees who also had access to it at one point or
another. Tenth, most notably this included AA, who worked with the Complainant
on the Complainant’s workstation and had access to it logged in under the
Complainant’s user name when the Complainant stepped away from his desk.
Eleventh, the reliability of the report is questionable for all of the foregoing
reasons, and because Mr. Gardner testified that had he been aware the BB
emails were from a real person, he would have conducted further investigations
in relation to her.
- 12 -
[43] The discrepancy between Mr. Tee’s evidence that he looked at copies of the
anonymous emails on his workstation and Mr. Gardner’s findings that he did not
means either that the report is unreliable or that Mr. Tee was lying. If the report
is unreliable, then the entire basis for the Employer’s case collapses. If Mr. Tee
was lying then perhaps it was because he was involved in framing the
Complainant: the Employer has offered no other explanation as to why he did so.
[44] With respect to the confidential documents, the Association argues, first, it has
never been clear which confidential documents were of concern to the Employer.
Second, the Complainant testified he had no authority to access MB20 and had
not seen it. Third, the IT evidence implicates AA, not the Complainant: AA’s user
name is the one which saved MB20 to the USB key. Fourth, whether the IT
Policy required a USB key containing a copy of the MB20 to be encrypted is
irrelevant. There is no mention of this in the termination letter as a ground and in
any event the Complainant cannot be found to be in breach of such a policy if he
was not aware that the MB20 was on his USB key. Fifth, no evidence was led
with respect to any other confidential documents being on the USB key.
[45] The Association concedes a plausible interpretation of the evidence is that the
Complainant was involved in the anonymous emails and in accessing the MB20.
However, the Association argues the evidence does not establish this
conclusively nor is the evidence reliable and cogent. Further, the Association
argues it is equally plausible AA was involved in the anonymous emails and in
accessing the MB20 with no involvement on the part of the Complainant. It is
also plausible BB was involved in creating and sending the emails with AA, but
without the involvement of the Complainant. It is also possible Mr. Tee was
involved, although the Association concedes this is less likely. Further, the
Association argues it is entirely plausible that the Complainant had not noticed
New folder on his USB key, as he testified.
[46] The Association notes the letter of termination refers to “involvement” in the
anonymous emails and that the Employer in argument had asserted “any
involvement” would suffice to establish grounds for termination. The Association
argues such a broad standard is inconsistent with the concept of progressive
discipline. A case in which the Complainant created and sent the anonymous
emails calls for a different disciplinary response to one in which he knew AA had
planned to send anonymous emails but loaned AA his USB key not knowing that
AA would use it for that purpose.
[47] The Association agrees there is only one civil standard of proof, and notes that it
requires clear and cogent evidence, as confirmed by F.H. v. McDougall. With
respect to the burden of proof in cases involving circumstantial evidence, the
Association argues not only must an employer present reliable and cogent
evidence to meet its burden of proof, but it must also show that there are no
other reasonable or plausible explanations. It refers to: Brown & Beatty, “3:5130
- Circumstantial evidence in discipline cases”; Ontario (Attorney General) v.
OPSEU (Khan), [1989] OGSBA. No. 1, 18 LAC (4th) 260 (Swan); Calgary Co-
Operative Association v. UCCE (Komicha), (2015) 253 LAC (4th) 403
- 13 -
(McFetridge); MGEU v. Sandy Bay Ojibway First Nation, (2012) 222 LAC (4th)
435 (Deeley); Toronto (City) v. CUPE, Local 79 (Kemp), [2005] OLAA No. 177
(Johnston); Fording Coal Co and USWA, Local 7884 (Lagunas), 1997
CarswellBC 3647, [1997] BCCAAA No. 674, 50 CLAS 63 (Germaine); and Telus
Communications Inc. and TWU (Madsen), (2005) 143 LAC (4th) 300 (Sims).
[48] In the alternative, the Association argues lesser discipline should be substituted.
It argues Mr. Kawall significantly misunderstood the evidence against the
Complainant at the time of his decision. Reference was made to Brown &
Beatty, “7:4410 - Employer Conduct”; La-Z-Boy Canada Ltd. and IUE, Local
400W (Grogan), (2002) 110 LAC (4th) 323 (Knopf); Camco Inc. v. United
Electrical, Radio & Machine Workers of Canada, Local 550, [1988] OLAA No. 4
(Barton); OPSEU v. Ontario (Ministry of Natural Resources), 2005 CanLII 55137
(Petryshen).
Analysis and Decision
The Law
[49] In F.H. v. McDougall, the Supreme Court of Canada reviewed the conflicting
jurisprudence with respect to the civil standard of proof. Some of the
jurisprudence suggested that when the allegations made against an individual
are “serious”, “criminal”, “morally blameworthy” or would have lasting implications
for the individual’s reputation, a higher standard of proof applies, the evidence
must be scrutinized with greater care or that clear and cogent evidence is
required, in apparent contradistinction to other civil cases. The Court rejected
approaches which suggested the standard of proof, the degree of scrutiny to be
applied to the evidence or the nature of the evidence required varied depending
on the nature or seriousness of the allegation at issue. Rather, the Court offered
a simple and concise reformulation:
(i) “there is only one civil standard of proof at common law and that is proof
on a balance of probabilities”: para 40.
(ii) “in all cases, evidence must be scrutinized with care by the trial judge”:
para 45.
(iii) “evidence must always be sufficiently clear and cogent to satisfy the
balance of probabilities test”: para 46.
[49] As noted the case against the Complainant is entirely circumstantial. There is no
direct evidence of the alleged facts. Circumstantial evidence seeks to prove
facts from which it is asserted other facts and ultimately the alleged facts may be
inferred. The question then becomes what standard should an arbitrator apply in
making those inferences. In my view, the process of inferential reasoning should
be subject to the same test of balance of probabilities. That is to say, I must
conclude that it is more likely than not an alleged fact can be inferred from the
proven facts as a whole. If this were not the case, then it seems to me that facts
which were inferred would be subject to a different standard of proof than facts
- 14 -
which are proven directly. This strikes me as anomalous and inconsistent with
the goal of single civil standard of proof.
[50] There is an element of common sense involved in inferential reasoning. It is not
simply a matter of following every argument which may be made with respect to
the inferences to be drawn from proven facts to its logical conclusion. As stated
by the Supreme Court of Canada in F.H. v. McDougall (at para. 48):
Some alleged events may be highly improbable. Others less so. There
can be no rule as to when and to what extent inherent improbability must
be taken into account by a trial judge. As Lord Hoffmann observed at
para. 15 of In re B:
Common sense, not law, requires that in deciding this question,
regard should be had, to whatever extent appropriate, to inherent
probabilities.
It will be for the trial judge to decide to what extent, if any, the
circumstances suggest that an allegation is inherently improbable and
where appropriate, that may be taken into account in the assessment of
whether the evidence establishes that it is more likely than not that the
event occurred. However, there can be no rule of law imposing such a
formula.
[51] Accepting the circumstantial evidence as establishing the Complainant’s
involvement or knowledge necessarily means that I do not believe his denials.
Faryna v. Chorny, 1951 CanLII 252 (BC CA), [1952] 2 DLR 354 (BCCA) contains
the following oft cited statement:
The credibility of interested witness, particularly in cases of conflict of
evidence, cannot be gauged solely by the test of whether the personal
demeanour of the particular witness carried conviction of the truth. The
test must reasonably subject his story to an examination of its
consistency with the probabilities that surround the currently existing
conditions. In short, the real test of the truth of the story of a witness in
such a case must be its harmony with the preponderance of the
probabilities which a practical and informed person would readily
recognize as reasonable in that place and in those conditions. Only thus
can a Court satisfactorily appraise the testimony of quick-minded,
experienced and confident witnesses, and of those shrewd persons adept
in the half-lie and of long and successful experience in combining skilful
exaggeration with partial suppression of the truth. Again a witness may
testify what he sincerely believes to be true, but he may be quite honestly
mistaken. For a trial Judge to say "I believe him because I judge him to be
telling the truth", is to come to a conclusion on consideration of only half
the problem. In truth it may easily be self-direction of a dangerous kind.
[52] In other words, I must determine whether the Complainant’s version of events is
consistent, or harmonious, with “the preponderance of probabilities which a
- 15 -
practical and informed person would recognize as reasonable” given the other
facts I find based on my evaluation of the circumstantial evidence.
[53] Many of the cases cited by the parties predate F.H. v. McDougall, or rely, without
comment, on cases which do. They must be evaluated with care against the civil
standard of proof set out in F.H. v. McDougall.
[54] The Association cites Ontario (Attorney General) v. OPSEU (Khan) and Calgary
Co-Operative Association v. UCCE (Komicha) for the following propositions, set
out at para. 56 of Komicha:
The weighing of circumstantial evidence is thus largely a process of
excluding alternative possibilities. In so doing, we have to take notice of
what is humanly possible in the circumstances. We cannot cast an onus
upon the grievor to prove to us that there were alternatives, although he
would certainly help his own cause with every plausible alternative
proposal. Rather, the onus is still on the employer to prove by clear and
convincing evidence that there are no such alternatives.
and
. . . In our view, it would not be correct to decide a case based on
circumstantial evidence on the basis merely that the allegation sought to
be proved is the most attractive among a number of possible
alternatives. It may be that the evidence suggests so many possibilities
that no single one of them, even the most appealing, can rise to the
standard of clear and convincing proof of the allegation. ….,
[55] While I agree with this formulation in some respects, in my view it suffers from
conflating the process of inferential reasoning with the burden of proof. Facts are
proved, inferences are not. Rather, inferences are arrived at by the arbitrator
based on proven facts. Neither party can have an obligation to “prove” an
inference, or to “prove” that there are no other inferences. Rather, the
inferences which may be drawn from proven facts, and what facts have been
proved, is a subject for argument.
[56] As this is a case of alleged unjust dismissal, the burden of proof lies upon the
employer throughout. To discharge that burden in a case of circumstantial
evidence, the inference which an employer asserts should be drawn must be
more likely than not on the facts established by the evidence as a whole on a
balance of probabilities, and of course such evidence must be clear and cogent.
It is not sufficient that the inference asserted by an employer is plausible, the
most plausible of alternative explanations or even the only inference offered.
The issue is always whether the inference asserted by an employer is more likely
than not on the facts as found. If it is, that there are other inferences which can
be drawn is of no legal consequence.
[57] Conversely, if the inference asserted by an employer is not more likely than not
on the facts as found, that there is no other alternative explanation is also of no
- 16 -
legal consequence. While I disagree with Arbitrator Deeley in MGEU v. Sandy
Bay Ojibway First Nation, in other respects (as discussed below), I agree with his
statement that it is not the role of the arbitrator to “solve the mystery”. Indeed, in
my view, an arbitrator must be careful of the natural human inclination to attempt
to arrive at an explanation for the facts. A focus on arriving at an explanation can
direct attention away from the legal question of whether the explanation is more
likely than not on the evidence. The role of the arbitrator is not to arrive at an
explanation of the facts per se, but rather to consider what inference or
inferences, if any, are more likely than not on those facts.
[58] While the burden of proof is always upon an employer, a union may help a
grievor’s cause by adducing other evidence. Indeed, if it appears an employer
will or has led sufficient evidence to prove its case, then, not as a matter of law
but at a practical level 1, a union faces an evidentiary burden to prove other facts
(if it can) which would change the inferences which could be found to be more
likely than not. This may include evidence in support of an alternative
explanation. Additionally or alternatively, a union may argue about whether the
evidence as a whole establishes on a balance of probabilities the facts on which
the employer relies for its inferences; and whether the inferences which the
employer asserts are more likely than not given the facts which are established.
While there is no obligation upon the union to offer alternative explanations while
doing so, as a practical matter offering plausible alternative explanations may
cause an arbitrator to conclude that the inference asserted by the employer is not
more likely than not, and thus that the grievance must be allowed.
[59] Thus, I agree with Arbitrator Johnston in Toronto (City) v. CUPE, Local 79
(Kemp) that there is no legal onus or obligation upon a grievor to disprove the
employer’s allegation or to offer an alternative explanation (see para. 97-98).
This is because the burden of proof always remains with the employer.
However, as noted, depending on the evidence the employer has or will likely
lead, there may be a practical evidentiary burden upon the grievor (or more
properly the union) to disprove the employer’s allegation or to prove facts in
support of an alternative explanation.
[60] In determining whether an employer has led sufficient evidence to give rise to
such a practical evidentiary burden, in my view an arbitrator is entitled to
1 See Snell v. Farrell, [1990] 2 SCR 311, 1990 CanLII 70 (SCC), at p. 329 per Sopinka J.:
These references speak of the shifting of the secondary or evidential burden of proof or the
burden of adducing evidence. I find it preferable to explain the process without using the
term secondary or evidential burden. It is not strictly accurate to speak of the burden
shifting to the defendant when what is meant is that evidence adduced by the plaintiff may
result in an inference being drawn adverse to the defendant. Whether an inference is or is
not drawn is a matter of weighing evidence. The defendant runs the risk of an adverse
inference in the absence of evidence to the contrary. This is sometimes referred to as
imposing on the defendant a provisional or tactical burden. See Cross, op. cit., at p. 129. In
my opinion, this is not a true burden of proof, and use of an additional label to describe what
is an ordinary step in the fact-finding process is unwarranted.
- 17 -
consider “the opportunities of knowledge with respect to the facts to be proved
which may be possessed by the parties respectively”: Snell v. Farrell. Thus,
where the allegation is about something which would be peculiarly within the
grievor’s knowledge, very little evidence from the employer may suffice to give
rise to such a practical evidentiary burden.
[61] Statements in a number of the cases cited by the Employer are, in my view,
about instances in which such a practical evidentiary burden had arisen. This is
true of the statement in OPSEU (Gyapong) v. Ontario (Ministry of Children and
Youth Services) at para 25 that on the evidence it would be reasonable to infer
the grievor had acted as alleged by the employer in the absence of a “credible
alternative explanation”. So too the statement at para. 71 of Canada Safeway
Ltd. v. UFCW, Local 401 (Brandse): “I also accept that since the Employer has
proven that the Grievor was in possession of its property in circumstances
requiring an explanation, the onus lies with the Grievor to provide a satisfactory
explanation.” I also read the statement in Ontario Power Generation and Society
of Energy Professionals (Verville) at para. 172 in this way: “The evidence
presented by OPG requires an answer. The Society’s theorizing is not sufficient
for the purpose and I am not satisfied that the Society has offered any cogent
evidence that casts doubt on OPG’s case.” So too the statement in Labatt
Alberta Brewery and Unifor, Local 250A (Clark) at para. 95 that:
Considering the evidence, the arbitrator concludes that the Employer
has made out a prima facie case. As a result the burden of proof then
shifted to the grievor "to take positive steps to provide a plausible
explanation on the balance of probabilities that the event is not that to
which the circumstantial evidence is pointing”.
I would note that in my view the suggestion that the “burden of proof” has shifted
to the grievor is incorrect. As stated above, the burden of proof remains upon the
employer at all times. It is a practical, not legal, evidentiary burden which may be
thought of as “shifting” to the grievor if the employer has made out a “prima facie”
case, i.e. if the employer has or will lead evidence which would discharge its
burden of proof in the absence of any other evidence.
[62] To be clear, whether or not a union adduces evidence, it may argue for an
alternative explanation of the evidence before the arbitrator. Evidence is
adduced to prove facts; inferences are a matter of argument on the basis of the
facts. A party does not lose its legal right to make submissions if it elects not to
lead any evidence, although at a practical level its capacity to advance an
argument may be circumscribed if it does not. To have any currency an
argument must have reasonable grounding in the facts. An inference not
grounded in facts will likely be found either speculative or unreasonable and
hence rejected.
[63] Finally, the relative opportunities for knowledge of the parties is an appropriate
consideration not just in assessing whether there is a practical evidentiary burden
upon the grievor to provide an explanation, but also in assessing any explanation
- 18 -
provided. Both assessments are simply part of the weighing of all of the
evidence in the fact finding process.
[64] It follows from the above that I agree with the Association the test is not the
formulation of Occam’s Razor offered by the Employer. It is not a matter of
preferring the explanation which requires the fewest assumptions over others.
Rather, the issue is whether the explanation asserted by the employer is more
likely than not on the proven facts.
[65] The Association cites Brown & Beatty, “3:5130 - Circumstantial evidence in
discipline cases”:
In assessing evidence in discipline cases, some arbitrators have applied
a rule known in criminal law as the Rule in Hodge’s Case. This rule
provides that, if the only evidence profferred is circumstantial, such
evidence will not be proof of the fact to be established unless the
evidence points conclusively to the inferences drawn and they are not
capable of supporting any other rational inference which would exclude
culpability. So particularly, where the conduct in question would also be
a crime, in assessing such evidence arbitrators have applied the rule or
a variation thereof. …. Of course, in other contexts arbitrators do
commonly assess circumstantial evidence without any particular
presumption or rule as to its conclusiveness.
[66] In my view, application of the Rule in Hodge’s Case would impose a criminal
standard of proof in a civil case. The evidence need not conclusively point to the
asserted inference, it need only establish that inference on a balance of
probabilities. The additional requirement in the Rule in Hodge’s Case that the
evidence not be capable of supporting any other rational inference amounts to
asking whether the evidence gives rise to a reasonable doubt. This is the
criminal standard of proof beyond a reasonable doubt, not the standard of proof
on a balance of probabilities which the Supreme Court of Canada held in F.H. v.
McDougall applies to all civil cases.
[67] It follows that I disagree with the statements of Arbitrator Deeley in MGEU v.
Sandy Bay Ojibway First Nation at paragraphs 54 and 56 of that decision, and of
Arbitrator Germaine in Fording Coal Co and USWA, Local 7884 (Lagunas) at
para. 48 referenced by the Association in its argument. In my view, those
statements constitute an application of the Rule in Hodge’s Case. I note that in
Canada Post Corp. and CPAA (Topping), relied upon by the Employer, Arbitrator
Germaine, while not referencing his own earlier decision, concluded that F.H. v.
McDougall had made it clear that there is only one civil standard of proof and
also agreed that the Rule in Hodge’s Case restates the criminal burden of proof
and thus is inapplicable to arbitration cases: see paras. 5 and 71.
[68] The Association relies upon Telus Communications Inc. and TWU (Madsen).
That was a case of discharge for unauthorized possession of confidential
documents. The case against the grievor was based entirely on circumstantial
- 19 -
evidence. The arbitrator rejected portions of the grievor’s explanation as lacking
credibility. The arbitrator continued (at pp. 334-335):
However, I do not accept that it necessarily follows from this that he
knew the confidential documents were in his desk or subsequently in the
box. His actions are equally consistent with his not knowing that, but
with being anxious to remove significant amounts of evidence as to his
travel agency business.
I find Mr. Madsen’s activities in removing his personal items suspicious,
but I cannot conclude, with the degree of certainty the law requires, that
Mr. Madsen knowingly had in his desk or that he knowingly removed the
confidential documents. ….
My task is not to explain how the documents arrived where they did, but
it is not implausible that they got there in some other way.
[69] This passage raises three points for discussion. First, as I have already stated, I
agree that it is not the task of the arbitrator to explain what happened.
[70] Second, I agree the fact that the grievor's explanation was not believed did not
constitute evidence that he knew he had the confidential information. This point
is made expressly by the Supreme Court of Canada in F.H. v. McDougall at
paras. 95 and 96: “an unfavourable credibility finding against a witness does not,
of itself, constitute evidence that can be used to prove a fact in issue”.
[71] The third point is with respect to the “degree of certainty the law requires” applied
by Arbitrator Sims. It appears from pages 321 to 322 of the decision, that
Arbitrator Sims had concluded that “in order to find the Company has met the
onus of proof by clear, cogent and convincing evidence, it is necessary to reject
the grievor’s explanation as one which could not “reasonably be true”. I do not
find this formulation helpful. An employer meets its onus of proof when the
inference or explanation it asserts should be drawn is more likely than not on the
facts as found. If the reference to “reasonably true” means the grievor’s
explanation is the one established as more likely than not, then it adds nothing.
Only one of two competing explanations can be more likely than not. If the
grievor's explanation meets that standard then it must follow the employer’s
explanation did not. On the other hand, the reference to “reasonably true” could
mean that not only must an employer make out its asserted explanation on a
balance of probabilities, but there cannot be any other reasonable explanation. If
so, it amounts to an application of the Rule in Hodge’s Case and I respectfully
disagree for the reasons stated.
[72] The observations in the preceding paragraph apply equally to the statements by
Arbitrator Germaine in Fording Coal Co and USWA, Local 7884 (Lagunas) at
para. 51, referenced by the Association. In any event, as noted above, Arbitrator
Germaine appears to have taken a different view of the law subsequent to the
Supreme Court of Canada’s decision in F.H. v. McDougall.
- 20 -
[73] Finally, OPSEU (Brown) v. Ontario (Ministry of Community Safety and
Correctional Services), cited by the Employer, relies upon Toronto East General
Hospital Inc. v. Service Employees Union, (1975) 9 LAC (2d) 311 (Beatty) for the
proposition that if stolen goods are found in the possession of an employee, the
employee has an obligation to provide an explanation and breach of that
obligation is itself grounds for discipline. It is not clear to me that proposition
continues to have currency. I note, in this respect, that Mitchnick and
Etherington in Leading Cases On Labour Arbitration at 10.3.1 reference the
proposition contained in Toronto East General Hospital and then continue:
“Subsequently, however, arbitrators have made clear that the basis for discipline
is not the employee’s silence in the face of incriminating circumstances, but the
presumption of wrongdoing created by other evidence which the employee has
not rebutted.” In other words, where an employer has made out a prima facie
case of theft, a practical evidentiary burden shifts to the griever to provide an
explanation.
The Facts
[74] On the basis of this analysis of the law, I turn now to a more detailed review of
the circumstantial evidence relevant to the Complainant’s involvement in sending
the anonymous emails and his awareness of the presence of MB20 and other
confidential files on his USB key.
The Presence of Files on the USB Key
[75] As noted, certain incriminating files were found on the Complainant’s USB key.
The Complainant denies any knowledge of their presence.
[76] The USB key was the Complainant’s personal property. It primarily contained
personal items (family photos and records, music etc.). However, the
Complainant also used it to carry work related files within the workplace. He
would carry his USB key to the desks of coworkers. Sometimes it would be
inserted into their workstations. Sometimes he would leave it with them
temporarily. He even permitted AA to take it home with him. However, the USB
key remained the Complainant’s personal property throughout.
[77] It is possible that someone else may have put files on the Complainant’s USB
key without his permission or knowledge. This begs the question of why anyone
would do so, since the USB key remained the Complainant’s personal property
and would revert to his possession. One possibility is that someone was seeking
to “frame” the Complainant. Another possibility is that someone was using the
Complainant’s USB key to transport documents (e.g. the confidential documents)
from the workplace to outside the workplace. The difficulty is that there is no
evidence to support either of these theories. (It is also not apparent why
someone would leave a copy of a file on the Complainant’s USB key after using it
to transport files outside the workplace, if that had been the objective.) Still, the
existence of such possibilities combined with the fact that the Complainant did
not retain exclusive possession of his USB key at all times means that the mere
- 21 -
presence of a file on the USB key is not, in my view, sufficient to make it more
probable than not that the Complainant had any involvement with the document
or knowledge of it. The question is whether that fact combined with the balance
of the evidence is.
[78] I begin by noting I do not find either the fact that the August 29, 2011 anonymous
email was copied to the USB key long after it was sent on May 10, 2012 or the
fact that the USB key contains drafts of the BB emails to be persuasive
circumstantial evidence of the Complainant’s involvement in sending the
anonymous emails. The Employer argues that the Complainant’s explanations
are implausible. That may be. But at most that would constitute, in the words of
the Supreme Court of Canada in F.H. v. McDougall, “an unfavourable credibility
finding against a witness [which] does not, of itself, constitute evidence that can
be used to prove a fact in issue”.
[79] The evidence against the Complainant is largely that of Mr. Gardner. As noted,
the Association argues Mr. Gardner’s report is inherently unreliable and does not
meet the standard of clarity and cogency required in part because of various
shortcomings and in part because he was not aware the BB emails were not sent
as anonymous emails and did not investigate her further. In my view, the
shortcomings to which the Association points do not make Mr. Gardner’s report
inherently unreliable. They simply establish the need to read it with care and with
the clarifications which Mr. Gardner provided in his evidence. Further, it seems
to me that IT evidence, properly understood, is quite clear and cogent.
Metadata, which I shall describe next, is similar to a business record in that it is
made as part of and in the ordinary course of the handling of data by a computer.
Further, it is made automatically and, unless tampered with, is highly accurate.
With respect to BB, it may be the case that further investigation would have
established involvement on her part. However, the issue for me is not whether
there is evidence which could have established her involvement, but rather
whether the evidence before me makes it more likely than not the Complainant
was involved or had knowledge as alleged.
Metadata
[80] It is convenient at this point to summarize Mr. Gardner’s evidence explaining the
meaning of some of the terms used in the report. The report was largely
concerned with an analysis of metadata. Metadata may be considered the
electronic footprint left behind when something, such as a Word or Excel file, is
“created”, “modified”, “saved”, copied or accessed on a computer.
[81] In order to make use of a computer, an individual must log in. In order to log in,
the individual must enter a user name and a password. Each time a file is
accessed on a drive of a computer by a user, the operating system of the
computer creates a “link file”. The file which is accessed is referred to as the
“target file”. A computer’s operating system generates link files for each “target
file” in relation to all usage by a given user name. The link file name is the target
file’s name with the additional suffix “.lnk”. A link file records information about
- 22 -
the computer’s operations in relation to the “target file”, i.e. when the target file
was created, accessed and last modified on that computer. I will call this “link
information” or “link times”. (The link information records only the last time a file
is modified on that computer: it does not retain the history of past modifications.)
[82] The link file also records information from the target file itself (I will call this
“target information”): the name of the file which was accessed; its location (both
the path name; and information identifying the device on which the file was
located); the size of the file; and the “creation time”, “last write time” and “last
access time” of the file whether or not done on that computer. I will call these
times the “target times” in order to distinguish them from the link times. The
creation time is the time content was first put into the file; the last write time is the
last time the file was changed or modified; the last access time is the time the file
was last opened, even if not changed. At least in the case of a Microsoft Word or
Excel file, this target information is a record of some of the metadata recorded by
Microsoft in the “properties” of the file itself. When a file is copied to a new drive
or directory, a new file is created, and therefore it has a new creation time. The
“last write time”, however, remains that of when the original file was changed or
modified until the new file is itself changed or modified. This means that the
“creation time” may be earlier than the “last write time”.
[83] As I understand Mr. Gardner’s evidence, the creation time recorded as target
information may be earlier than the creation time recorded as link information. I
infer that this is because the target information is recording times in relation to
the file while the link information is recording times in relation to a computer’s
operations. The mere act of copying a file to a new location gives rise to a new
creation time in the target information (which is why the creation time may be
later than the last saved time for the file), but apparently does not result in a
creation time in the link information. Rather, Mr. Gardner testified, it is not until
the file at the new location is first accessed (i.e. opened) that a creation time is
created and recorded in the link information.
[84] The path name discloses the directory or sub-directories in which the file is
located. The information about the device is the “Volume Type” (e.g. for the USB
key in question, Removable Disk); the “Volume Label” (e.g. Centon USB); and
the “Volume Serial Number”. The “Volume Serial Number”, is a unique identifier
created when a device is formatted. A hard drive is a device internal to a
computer. A USB key is an external device which may be inserted into a
computer. The link times recorded in a link file may be different than the target
times if the target file was initially created on another computer or changes were
made to it on another computer. If, for example, the target file was created,
changed or accessed on a USB key inserted in another computer, and then
inserted in the subject computer and copied to a different directory while on that
computer, the create time recorded as a link time would be later than the last
write time recorded as a target time.
[85] If a computer is part of a network, such as the workstations used by employees
of the Employer, then a person’s user name cannot be equated with their
- 23 -
computer. Someone with a user name may be able to log onto any computer
connected to the network and use it to create, write or access a document.
Thus, it cannot be assumed that a given user has only created, written or
accessed documents on their own workstation.
[86] Link files are recorded on the computer or computers used to access a file on a
USB key. In order to obtain the link file on a computer, an investigator must have
access to the computer. Mr. Gardner had access to computers located in the
workplace, and in particular the workstations of the Complainant, AA and Mr.
Tee, all of which he examined. (He also examined the workstations of the other
employees who had custody of the USB key prior to it being delivered to the
forensic investigation team, but found nothing of consequence.) He did not have
access to the home computers of anyone whose workstation he examined. The
Complainant had four home computers. An individual may assign more than one
user name to a home computer, and in doing so may choose essentially any
name they wish.
[87] As noted, Microsoft records metadata in the “properties” of the file itself. This
includes the time when the document was created and the name of the “author”
who did so. The author is the user name in use (or the name associated with
that user name) when the document was first saved after content was inputted
into it. The properties also record the time when the document was last saved
and the user name used when the document was “last saved”. The user name
or names used when the document was previously saved are not retained. The
properties record the number of times that a document has been saved, but not
the extent of the revisions. The user name listed as the author remains the same
irrespective of how many times the document has been revised, how much it has
been revised and by how many different users. This is so even if the original
content of the document is completely written over.
[88] Some metadata can be changed. In particular, the author recorded in the
properties of a Word or Excel file may be changed by opening the “properties”,
deleting the content of the “author” field and inputting a new name. The user
name recorded in the field “last saved by” is changed, as noted, whenever the
document is saved under a new user name. The date and time can be changed
as well by changing the date and time on a computer and then saving the
document with this artificial date and time. By combining these two steps it is
possible to change the user name which last saved the file while retaining the
original date and time. (The date and time cannot be changed on a government
computer unless an individual has “administrator” privileges. However, this could
be done outside the workplace on a home computer.)
[89] Further, the parties agreed to stipulate:
There is software, readily accessible and freely available on the
internet and easily used which can be used to change metadata of
Word documents (metadata includes for this purpose create time
and date, last save time and date, author, date and time modified
- 24 -
and accessed). Further Mr. Gardner was not aware of such
software [at the time he conducted his investigation and reported
his findings].
[90] I would note, however, that while metadata may be changed, it requires an
intentional action on the part of someone to do so.
The Discrepancy Between Mr. Tee’s Evidence and the Report
[91] As noted, Mr. Tee’s evidence was that he looked at copies of the documents
related to the anonymous emails on his workstation and on no other computer. If
this had occurred, it should have been captured in the link files on Mr. Tee’s
workstation. Those link files are recorded in the report. The link files do not
show any access of email related documents by Mr. Tee at his workstation. The
Association states there are only two possible conclusions: the report is
unreliable or Mr. Tee is lying. Mr. Gardner testified the chances of the metadata
being wrong are extremely remote. I accept this is the case. I do not conclude
therefore that the discrepancy renders the report unreliable. It follows I do not
accept Mr. Tee’s evidence on this point. But this adverse finding has no
significance to any other issue before me. There are no other instances in which
Mr. Tee’s evidence was challenged by other evidence with respect to another
fact in dispute. Thus, I need not consider whether the adverse finding should
cause me to question Mr. Tee’s credibility.
Issue.docx
[92] The USB key contains the Word document Issue.docx, the text of which is
essentially the same as the June 18, 2012 anonymous email. The Complainant
testified he had no role in creating or modifying the content Issue.docx and had
no knowledge of who did. The Complainant also testified he had no knowledge
of how Issue.docx came to be on his USB key. The IT evidence with respect to
Issue.docx is as follows.
[93] There is no link file in relation to Issue.docx on the Complainant’s workstation.
That is, there is no IT evidence that Issue.docx was ever accessed from the
Complainant’s workstation. There is a link file in relation to Issue.docx on AA’s
workstation. The link information shows that on May 25, 2012 at 2:39 PM the
USB key was plugged into AA’s workstation. At 2:41 PM, AA, or more precisely
someone using AA’s user name, accessed a Word document “E:\Issue.docx”.
Then, a few seconds later at 2:41 PM, the Word document “{root}\New
folder\Issue.docx” was created on the USB key. The target information in the link
file shows Issue.docx was modified the night before, at 9:49 PM. That is, it was
modified on some other computer before being created on AA’s workstation the
next day.
[94] The properties of the Word file Issue.docx show it was last modified at 9:49 PM
on May 24, 2012 (as recorded in the target information). They also show that
content, or text, was first put into Issue.docx at 7:55 PM on May 24, 2012, i.e. it
- 25 -
was created at that time. The “author” is given as the Complainant’s work user
name. While this would normally give rise to the inference the Complainant
created the document, there is a difficulty in this case. As noted above, in the
ordinary course the “author” of a document is the user name used to log into the
computer on which the document was created. Use of a computer to author a
document creates a link file on the computer. The report indicates there is no
link file in relation to Issue.docx on the Complainant’s workstation, as noted
above. In addition, in cross examination Mr. Gardner testified he was able and
did in fact conduct a search to see if anyone was logged in to any government
workstations with the Complainant’s work user name around 7:55 PM on May 24,
2012. He did not find the Complainant’s work user name logged in. Mr. Gardner
noted his search would not have captured a log in with the Complainant’s user
name to a government laptop if the laptop was not connected to the government
network around 7:55 PM on May 24, 2012. However, the evidence of the
Complainant was he never had a government laptop and there is no evidence
that he had access to one.
[95] It would appear, therefore, that there is a mystery as to how Issue.docx comes to
have the Complainant’s work user name as its author at a time when his user
name was not logged in. One explanation would be someone changed the
properties of the document. Another explanation would be, contrary to his
evidence, the Complainant did have access to a government issued laptop and
made use of it to create the document at 7:55 PM on May 24, 2012 while not
connected to the government network. There may well be other explanations
that would solve the mystery. But my role is not to solve the mystery. My role is
to determine whether because the Complainant’s work user name is the author
of Issue.docx the evidence before me establishes it is more likely than not that he
was involved in creating it. Because of the unexplained inconsistencies, I am
unable to reach that conclusion.
[96] Finally, the properties of the Word document Issue.docx also show it was last
saved on June 2, 2012 at 10:11 AM. This was done by “user12”.
user12
[97] The USB key contains 18 files (17 Word documents and one Excel spreadsheet)
which were last “saved” by user12. Three of those documents were authored by
the Complainant’s workplace user name “Bhattacharya, Sudipta (MGS)”. One,
the Complainant’s resume, was authored by “SBHATTACHARAYA”, which the
Complainant agreed was him. One, “STREET CAPITAL.doc” was authored by
“bhttacharyasu”. It contains the Complainant’s security passwords in relation to
his mortgage. Nine of the documents were authored by user12. This includes a
number of documents which are clearly personal to the Complainant or his
family. It also includes Reply.doc.docx. All but two of the 18 files last saved by
user 12 are located in folders which appear to be personal to the Complainant.
The other two files saved by user12 are located in New folder. They are
Issue.docx and Reply.doc.docx.
- 26 -
[98] At the material times, there was a computer training room in the office building
where the Complainant worked. There were 12 computers in the training room.
The Complainant testified in chief that there were 15 to 20 computers in the
computer room labelled user1, user2 etc. Presumably based on this evidence
the Association intended to argue a plausible inference was that user12 was
whoever logged into the corresponding computer in the training room. However,
in cross examination it was put to the Complainant that the computers in the
training room were labelled train1, train2 etc., and the assigned user names were
also train1, train2. The Complainant stated if that was the case he could not
disagree. The training coordinator was called as a witness and confirmed the
computers in training room were labelled train1, train 2 etc. and had assigned
user names of train1, train2 etc. Accordingly, the computers in the training room
are irrelevant.
[99] As noted, the Association argues the evidence with respect to user12 is suspect.
It notes Mr. Gardner was directed to gather it after he had finalized his report. It
argues in doing so the evidence was gathered in a manner that specifically
targeted the Complainant. User12 is not a unique identifier, and could have been
used by others, including Mr. Tee, AA and BB, whose workstations were not
targeted. I disagree. Mr. Gardner did not target the Complainant’s workstation
or the Complainant. Rather, he did a search of the USB key to find files saved by
user12. The search revealed the 18 files described above. The fact that those
files suggest a strong connection to the Complainant was a result of the search,
not a parameter used in the conduct of the search. I would also note that none of
Mr. Tee, AA or BB are listed as the author of any of the files saved by user12.
[100] The Association notes the evidence establishes the last saved by name can be
changed. I agree. But doing so requires an intentional act. It strikes me as
inherently improbable, as argued by the Employer, that someone else with
access to the USB key (including AA) would make this change to 18 unrelated
files, 16 of which were personal to the Complainant, while leaving the
Complainant as the author of some of them. Conversely the fact there are
hundreds of other personal files on the USB key not saved by user12 does not,
contrary to the argument of the Association, make it improbable the Complainant
is user12. It merely suggests the Complainant has various user names. In the
result, I conclude it is more likely than not the Complainant is user12. I also
conclude the Complainant saved Issue.docx to his USB key on June 2, 2012.
[101] The Association argues at most this establishes the Complainant was involved in
saving a draft of the June 18, 2012 email, not that he was involved in sending it.
I disagree that the Complainant’s level of involvement can be so minimized. The
Complainant had no obligation to explain the mere presence of Issue.docx on his
USB key, but the evidence goes beyond that to establish involvement on his part
in saving it to his USB key, 16 days before the email itself was sent. The draft
which he saved is virtually identical to the email which was sent. In my view, the
Employer has made out a prima facie case that the Complainant was involved in
actually sending the email. The extent of the Complainant’s involvement is a
matter within his knowledge. There was a practical evidentiary burden on him to
- 27 -
provide an explanation if he could. He failed to do so. In these circumstances, I
find it is more likely than not the Complainant was involved in sending the June
18, 2012 email.
New folder And Its Contents: Issue.docx, MB20 and documents related to consolidation
[102] In addition to Issue.docx and Reply.doc.docx, New folder contained MB20.
MB20 is the highly confidential submission to management board which the
Complainant was not authorized to have. The author of this document is not
relevant; AA is listed as having last saved it. New folder also contained three
other confidential documents with respect to a consolidation of IT Services in the
Ontario Government: a proposal document with a file name Doc14.doc, and two
power point presentations, Project-Consolidation.ppt and Consolidation.ppt. AA
is listed as the author and as having last saved Doc14.doc. The author of the
two power point presentations is not relevant, but Project-Consolidation.ppt is
last saved by AA and Consolidation.ppt is last saved by the Complainant.
[103] The Complainant’s evidence in chief was that he knew nothing about New folder
and that he had never noticed it. He testified that every time he created a file
folder, he would name it. There is no IT evidence which directly establishes the
Complainant was aware of New folder or its contents. Rather, once again, the
evidence is all circumstantial.
[104] New folder appears in the root directory or desktop when the USB key is
accessed. The desktop displays 22 folders listed in alphabetical order, followed
by 22 files listed in alphabetical order. With the exception of a few items which
appear on the desktop, all of the items relate to personal matters of the
Complainant. For example, immediately above New folder is a folder called “MY
AQUARIUM MARCH 2012”, containing photographs of the Complainant’s
aquarium; immediately below New folder is a folder called “OCI
REGISTRATION”, containing documents pertaining to the Complainant’s
application for a life time visa to India.
[105] As previously noted, there was a link file in relation to Issue.docx on AA’s
workstation. That link file indicated that AA’s user name moved Issue.docx to
New folder on May 25, 2012. This caused Mr. Gardner to conclude that the
directory New folder existed on the USB key as of at least May 25, 2012. I agree
that this is a reasonable inference.
[106] Mr. Gardner testified the IT evidence showed that on May 28, 2012 the USB key
was plugged into the Complainant’s workstation. Between May 28, 2012 and
July 25, 2012 (the day on which the USB key appears to have been lost by the
Complainant: it was found on July 26, 2012), link files related to the
Complainant’s work user name show that it accessed a total of 22 files and 6
folders on the USB key. None of the files or folders accessed were in New
folder. However, CR, which is the eighth folder above New folder was accessed
numerous times; PCC51, which is the third folder below New folder on the
desktop, was accessed numerous times; and OCI Registration which is the folder
- 28 -
immediately below New folder was accessed twice on July 25, 2012, just before
the Complainant lost his USB key.
[107] Mr. Gardner’s report also shows, based on link files, that on the first day Mr. Tee
had the USB key, July 26, 2012, he accessed three files on his workstation, the
third of which, MB20, was located in New folder. This is some significance given
I have concluded, contrary to his evidence, that Mr. Tee accessed the USB key
from a computer other than his workstation. The point here is that Mr. Tee’s link
files support the inference New folder existed and contained MB20 before he left
work on the first day on which he had the USB key.
[108] There is no IT evidence the Complainant accessed New folder. His evidence is
that he was not aware of New folder. The Employer argues this is implausible
because New folder was clearly visible to anyone using the USB key and the
Complainant accessed his USB key at least 22 times after New folder was on his
USB key, including files located in folders above and below New folder, as
described above. The Association by contrast argues that it is entirely plausible
that the Complainant did not notice New folder. The difficulty with the
Association’s argument is that New folder contained one file last saved by the
Complainant (Consolidation.ppt) and two files (Issue.docx and Reply.doc.docx)
saved by user12, whom I have concluded more likely than not is the
Complainant. The process of saving those documents to New folder of necessity
requires awareness that it exists. I am not prepared to accept the Complainant’s
evidence that he failed to notice New folder in these circumstances.
[109] This finding affects my assessment of related evidence. The Complainant’s
awareness of New folder is sufficient to give rise to the inference that the
Complainant was also aware of its contents, given that the extent of such
awareness lies peculiarly within the Complainant’s knowledge. The
Complainant’s evidence that he was not aware of the other contents of New
folder, and in particular the MB20 file, is not credible. Rather, given I have found
the Complainant saved three other files to New folder, I find, on a balance of
probabilities, he was aware of the contents of New folder. This included four
confidential documents which he was not authorized to have: MB20 and the
three documents in relation to the consolidation of IT services, Doc14.doc,
Project-Consolidation.ppt and Consolidation.ppt, the last of which the
Complainant also saved to New folder. Even if AA saved copy of MB20 to the
Complainant’s USB key, this does not absolve the Complainant from knowingly
maintaining it on his USB key thereafter. The Complainant had a practical
evidentiary burden, which he has not met, to explain why he kept MB20 and the
other confidential documents on his USB key.
[110] As noted, the Association argues it was not clear which confidential government
documents were the subject of concern for the Employer. In my view, Mr.
Kawall’s evidence made it clear he was concerned about at least MB20 and the
documents in relation to the consolidation of IT services.
- 29 -
Conclusion on the Complainant’s Involvement
[111] Accordingly, I find the Complainant was involved in sending the June 18, 2012
anonymous email. I also find the Complainant knowingly had on his USB key
copies of highly confidential and sensitive documents which he was not
authorized to have.
Conclusion on Appropriate Penalty
[112] The Association argues Mr. Kawall significantly misunderstood the level of the
Complainant’s involvement with the anonymous emails at the time he made the
decision to terminate his employment. That is correct. However, in my view the
thrust of Mr. Kawall’s evidence in cross examination was that his decision would
have been no different on the facts he was advised of during cross examination.
Ultimately, however, the question is whether I should exercise my discretion to
substitute lesser discipline at this point in time.
[113] The Association refers to several cases in which lesser discipline was substituted
where the employer had misapprehended the facts when imposing the original
discipline. I read those cases as establishing only that the appropriate level of
discipline turns on the facts of a particular case.
[114] In this case, I have found the Complainant was involved in sending the June 18,
2012 anonymous email. He also had the MB20 and other highly confidential
documents on his USB key. He was not authorized to have these documents,
and his knowing possession of them is grounds for serious discipline. The
parties agreed the USB key should have been encrypted if it had such
documents. It was not. This means the Complainant was also reckless with
respect to safeguarding the unauthorized copies of the confidential documents
which were in his possession. More significantly, the fact the Complainant has
steadfastly denied the involvement and knowledge which I have now found he
had means, in my view, reinstatement is not a viable option. The Complainant
has taken no responsibility for his actions and cannot be trusted to do so if
reinstated.
[115] For all of the foregoing reasons, the complaint is dismissed.
[116] This case has been factually and legally complex. I am indebted to both counsel
for their assistance throughout.
Dated at Toronto, Ontario this 31st day of March 2017.
Ian Anderson, Vice-Chair