GSB#2014-1191

IN THE MATTER OF AN ARBITRATION

Under

THE CROWN EMPLOYEES COLLECTIVE BARGAINING ACT

Before

THE GRIEVANCE SETTLEMENT BOARD

BETWEEN

Association of Management, Administrative and Professional Crown Employees of Ontario (Bhattacharya)

Association

• and -

The Crown in Right of Ontario (Ministry of Government and Consumer Services)

Employer

BEFORE

Ian Anderson

Vice-Chair

FOR THE ASSOCIATION

Emma Philips Goldblatt Partners LLP Counsel

FOR THE EMPLOYER

Jonathan Rabinovitch Treasury Board Secretariat Legal Services Branch Counsel

HEARING

June 24, September 20, October 19, December 1 & 14, 2016; January 26, February 3, 2017

Decision

1This is a discharge complaint.

2The Complainant was employed as an Oracle Business Analyst in the Business Applications Systems Support (“BASS”) Branch of the Ministry of Government Services. His employment commenced on July 13, 2009. His Branch Director was at all times Robert Tee.

3On August 1, 2011, an email alleging significant unethical conduct on the part of Mr. Tee was sent from a gmail account to various individuals within the government. On August 29, 2011, a second such email was sent from a second gmail account. On June 18, 2012, a third such email was sent from a third gmail account. A fourth was sent on December 20, 2012 from a fourth gmail account. The Employer considers all of the emails to have made serious and false allegations against Mr. Tee. The emails purport to be from employees of or associated with BASS, however it appears that the names of the “senders” are not of individuals so employed or were not in fact sent by them. The emails were sent from google accounts and the “owners” of those accounts are not traceable. An initial investigation was unable to determine who had sent them. The Employer, therefore, refers to the emails collectively as the anonymous emails.

4On or about July 26, 2012, a USB data key was found in the workplace. The USB key was turned over to Mr. Tee. Mr. Tee testified that he inserted it into his workstation and examined its content. He concluded that it was the property of the Complainant and that it contained several government documents, including a sensitive and confidential submission to Management Board. Mr. Tee also located several documents which he considered to be related to the anonymous emails. Mr. Tee contacted his superiors and the result was that the USB key, and certain workplace computers, were subjected to an investigation by Jamie Gardner of the Employer’s Forensic Information Technology team.

5Mr. Gardner prepared a report setting out the Information Technology (“IT”) evidence which he had assembled in the course of his investigation. Mr. Gardner gave evidence in the proceedings. His answers were balanced and fair throughout. The parties, however, have a fundamental disagreement on how this evidence, which is offered as circumstantial proof of the Complainant’s knowledge and involvement, is to be assessed. I will discuss parts of the report and Mr. Gardner’s evidence in greater detail below, but for the purposes of understanding the parties’ arguments a few of the findings must be described at a high level.

6Before doing so, I note that some of the evidence casts suspicion upon two individuals who were formerly employed in BASS, each of whom left employment with the Employer in 2012. Neither of these individuals was called as a witness. I see no need to identify either of them by name and thus I have chosen to refer to them as AA and BB.

7The investigation revealed the following:

• The USB key contained a draft of the June 18, 2012 anonymous email in the form of a Word document named “Issue.docx”. It was “created” on May 25, 2012 and last modified on June 2, 2012. The Complainant’s work user name is listed as the “author” of that document. It was “last saved” by “user12”. It was located in a folder on the USB key called “New folder”.

• The USB key contained two Word documents related to emails sent by BB complaining about her treatment by Mr. Tee: “Reply.doc.docx” and “Tabby.doc.docx”. Reply.doc.docx was created June 5, 2012 at 10:30 PM and last modified at 10:41 PM. It was authored by user12 and last saved by user12. It was located in New folder. Tabby.doc.docx was created on May 8, 2012 and last saved on May 10, 2012. It was authored under the Complainant’s work user name and saved under AA’s work user name. These emails (which I will sometimes refer to collectively as the BB emails) are not to be confused with the anonymous emails, although the Employer perceives their content as similar.

• The USB key contained two files which are copies of the August 29, 2011 anonymous email: an html file named “Tee Issue.htm” and a Word document named “Tee Issue.doc.docx”. Tee Issue.htm was created and last saved on May 10, 2012 (i.e. after the August 29, 2011 email was sent). Tee Issue.doc.docx was created and last saved on May 10, 2012, seconds after Tee Issue.htm was created. It was authored and last saved by the Complainant’s work user name.

• The USB key contained a copy of an Excel spreadsheet containing information related to a highly confidential submission to Management Board: “MB20 Final Figures.xls” (hereafter, “MB20”). MB20 was located in New folder. The identity of its author is not relevant. It was last saved under the work user name of AA at 8:47 PM on June 3, 2012.

• The USB key contained copies of three confidential documents related to a project to consolidate government IT resources all of which were also found in New folder: “IT-Consolidation.ppt”, the author is irrelevant, but it was last saved under the Complainant’s work user name on January 19, 2012; Project-Consolidation.ppt, the author of which is again irrelevant, but it was last saved under AA’s work user name on January 18, 2012; and Doc14.doc, the author of which is given as the Complainant’s work user name and which was last saved under AA’s work user name. It was created January 18, 2012 at 10:08 PM and last saved January 18, 2012 at 11:23 AM. (The reason that a file’s creation date may be later than its last saved date is discussed further below.)

• The USB key contains something on the order of a thousand files. The vast majority are non-work related and personal to the Complainant. Eighteen of those files were last saved by user12; some of the eighteen were authored by user12, some of them were authored by the Complainant’s work user name.

• The USB key did not contain any documents related to the other two anonymous emails.

8I have put the terms “authored”, “last saved” by and “created” in quotes as this information is derived from “metadata”. As discussed in greater detail below in some circumstances metadata can be changed. The Association’s position is, therefore, that the metadata is not reliable. It is also useful to note at the outset that the Employer’s position is the evidence establishes the Complainant is user12 and that the Complainant at least had knowledge of the contents of New folder. The Association’s position is that the evidence does not establish the Complainant is user12 or that he was aware of New folder or its contents.

9An allegation meeting was held on August 1, 2013 with the Complainant to review the results of the investigation. The Complainant denied involvement or knowledge, as described in greater detail below.

10The Complainant’s employment was terminated on August 15, 2013. The text of the letter of termination states the following:

Dear Mr. Bhattacharya

A meeting was held on August 1, 2013 with yourself, your union representative, Cedric Nazareth, Kathy Mareski, Transition Director, Heather James, Human Resources Advisor and myself. The purpose of the meeting was to discuss the results of the IT Security Investigation which was initiated following discovery of a USB stick in the work unit. This USB stick contained material related to serious and false allegations against the Branch Director.

During the meeting of August 1, 2013, information was shared with you respecting the following allegations:

• Your involvement with the anonymous emails sent on August 1, 2011, August 29, 2011, June 18, 2012 and December 20, 2012 which contained serious false allegations against the Branch Director and the Business Applications Solutions Support Branch; and

• The contents found on a USB stick linked to you contained documents that were highly confidential and contained prejudicial information.

I explained that this meeting was an opportunity for you to provide additional information and/or any mitigating circumstances, in order to assist me in making a final determination regarding the above noted allegations.

During this meeting, you denied any knowledge of the emails and provided no plausible response to the information contained in the IT Security report that linked you to the creation of one of the emails.

After carefully reviewing all of the information available to the Employer, including your responses to the above noted allegations, it is my conclusion that the allegations regarding your involvement have been substantiated.

11The letter was signed by Ken Kawall, the then Assistant Deputy Minister and Chief Information Officer for the Ministry of Government Services.

12Mr. Kawall testified in chief that his decision was based on four factors: the presence on the USB key of an almost identical copy of the June 18, 2012 anonymous email, with an origination date prior to June 18, 2012 (i.e. Issue.docx); the presence of a number of other prior anonymous emails on the USB key; the presence of highly confidential documents on the USB key; and the fact that the USB key was unencrypted, in violation of OPS I&IT Policy. In cross he confirmed that his decision to terminate the Complainant was based on Mr. Gardner’s report and that, as stated in the letter of termination, in making his decision he also relied upon the fact that the Complainant’s responses during the allegation meeting were in his view inadequate.

13During the allegation meeting, the Complainant was asked a series of questions about each of the anonymous emails: did he write it; did he modify it; and did he send it. The stated premise of each series of questions was that a version of the email had been found on the USB key. In some instances, as noted above, this premise was incorrect. In each case the Complainant answered no.

14With respect to the August 1, 2011 email, Mr. Kawall testified that he found the Complainant’s responses inadequate and that was a factor in his decision. Mr. Gardner’s evidence established that in fact the USB key did not contain a version of the August 1, 2011 email. When advised of this during cross examination, Mr. Kawall agreed that the Complainant’s responses with respect to the August 1, 2011 email were in fact reasonable. He also agreed that his understanding at the time he made the decision to terminate, that there was a version of the August 1, 2011 email on the USB key, was incorrect.

15Mr. Gardner’s evidence established that the copies of the August 29, 2011 email which were found on the USB key were made after the email was sent. In cross Mr. Gardner agreed that there was no IT evidence that the Complainant had any involvement in creating or sending that email. Mr. Kawall agreed that was the case, but stated he was aware of that at the time he made the decision to terminate.

16With respect to the December 20, 2012 email, Mr. Kawall testified he found the Complainant’s responses inadequate and that was a factor in his decision. Mr. Gardner’s evidence established that in fact the USB key did not contain a version of the December 20, 2012 email. When advised of this during cross examination, Mr. Kawall agreed that the Complainant’s responses with respect to the December 20, 2012 email were in fact reasonable. He also agreed that his understanding at the time he made the decision to terminate, that there was a version of the December 20, 2012 email on the USB key, was incorrect.

17Mr. Gardner’s report indicated five documents were found on the USB key which were related to the four anonymous emails. Two of those documents related to the August 29, 2011 email. As discussed, they were created well after the August 29, 2011 email was sent. Accordingly, they do not constitute evidence the Complainant had any involvement in creating or sending that email. Two were not in fact related to the anonymous emails. Rather they were related to the emails sent non-anonymously by BB. Mr. Kawall agreed with Mr. Gardner’s conclusion that they did not constitute IT evidence the Complainant had any role in sending the anonymous emails. However, Mr. Kawall’s concern about the presence of all of these emails on the Complainant’s USB key remained unchallenged.

18The remaining document on the USB key consistent with one of the anonymous emails was Issue.docx. As noted, it was a draft of the June 18, 2012 anonymous email. During the allegation meeting the Complainant also denied any involvement in writing, modifying or sending the June 18, 2012 email (including any involvement in Issue.docx) and he denied any knowledge of the presence of Issue.docx on his USB key. I will return to Issue.docx below. For present purposes it suffices to say that Mr. Kawall testified that in his view the Complainant was responsible for the mere presence of Issue.docx on his USB key.

19Mr. Kawall also relied on the presence of highly confidential government documents on the USB key. He was only able to recall one of these unprompted: MB20. As with the anonymous emails, Mr. Kawall testified the Complainant’s responses during the allegation meeting was among the factors he considered in making the decision to terminate. During the allegation meeting, the Complainant was asked to confirm MB20 was saved using his user name, to which he responded he had “no idea”. In fact, the IT evidence established that MB20 was saved to the key by someone using AA’s user name. Mr. Kawall testified that he was not aware of this at the time of the allegation meeting, but that it “probably would not have mattered”. Mr. Kawall was asked about the other confidential government documents whose presence on the key had caused him concern. He was unable to precisely recall, but agreed that they could have been documents in relation to the consolidation of the Employer’s IT services.

20Mr. Kawall testified the mere presence of MB20 and documents related to the consolidation of IT services on the Complainant’s USB key was of concern. Even if the Complainant had not authored it or saved it to the USB key, Mr. Kawall testified that he found it “very difficult to believe that he would have no knowledge of the resulting document” on the USB key. During the allegation meeting, the Complainant was asked if he had any explanation as to how the MB20 and documents in relation to the consolidation came to be on his USB key and had no answer.

21Mr. Kawall also testified the fact that the USB key was unencrypted was a concern. Mr. Kawall testified this was contrary to the GO IT Standards. The GO IT Standards were not available at the time Mr. Kawall gave his evidence. The parties subsequently agreed to stipulate the GO IT Standards distinguish between files of different levels of confidentiality, with encryption only required for the more confidential. The parties further stipulated that the MB20 file and the files with respect to the consolidation of IT services would require encryption.

22The Association asserts that there is no evidence the Complainant had any motivation to participate in the creation or distribution of the anonymous emails. It points to the Complainant’s evidence that his relationship with Mr. Tee was good up until January 2013. A brief digression is necessary to describe what happened then.

23On January 9, 2013 the Complainant was in attendance at a staff meeting being addressed by Mr. Kawall. Mr. Kawall was there to discuss one of the anonymous emails. Mr. Kawall noticed the Complainant sitting with his hand resting against his face with the middle finger raised. Mr. Kawall reported this to Mr. Tee. Mr. Tee held an allegation meeting with the Complainant and then issued a letter of counsel to the Complainant. The Complainant denied that he had ever made such a rude gesture to Mr. Kawall. He testified that he had a sore neck at the time and perhaps he had been supporting his head with his hand and inadvertently made the gesture. He testified making such a gesture intentionally was beneath his dignity and he could not even imagine making it. He was tremendously insulted that Mr. Tee could think that he could do such a thing.

24The Complainant testified he lost all respect for Mr. Tee following the allegation meeting. He considered filing a complaint against Mr. Tee. To this end, he prepared a typed chronology of complaints from December 1, 2009 to January 22, 2013. The document is 2 pages long, single spaced, references specific times and dates and has 11 paragraphs of “comments”. The specific concerns relate to the level of merit increases awarded by Mr. Tee to the Complainant, the alleged failure of Mr. Tee to provide time off or payment for overtime worked and Mr. Tee’s removal of the Complainant as the department’s representative at certain inter ministry meetings, which was allegedly done by email from Mr. Tee with no further explanation. The chronology concludes with the comment: “The above mentioned chronologies of events are ample proof that I have been discriminated, subject to unfair judgement and insulted for no reason by Mr. Tee.”. The Complainant did not in fact file the complaint against Mr. Tee. The Complainant testified he did nothing with the chronology of complaints until after the allegation meeting on August 1, 2013 with respect to the contents of his USB key. Following that meeting the Complainant sent the chronology of complaints to Mr. Kawall.

25In chief and cross, each of the allegations made against Mr. Tee in the anonymous emails was reviewed with the Complainant. He denied sharing the views expressed, sometimes stating that his view was the opposite and sometimes stating that he had no knowledge or had no opinion. He also noted that among the recipients of the emails was a provincial cabinet minister, Harinder Tukhar. The Complainant stated that Mr. Tukhar was his MPP and that he was very, very close to him, as he served on the executive committee of the riding association. The Complainant testified that if he wanted to complain to Mr. Tukhar about something, he did not need to send him an email because he could speak to him directly at any time.

26In my view, while the chronology of complaints prepared by the Complainant constitutes some evidence of motivation on his part to send the anonymous emails attacking Mr. Tee, the tone of those emails is much more inflammatory and they cover a number of issues which are not addressed at all in the chronology of complaints. Thus, there is at best weak direct evidence of motivation.

27During this stage of the hearing, the Association stipulated that the USB key was the property of the Complainant. It contained files which were primarily personal to the Complainant, including music and photographs. The photographs included pictures of AA’s son. The Complainant testified that AA sometimes borrowed the USB key. According to the Complainant, AA did so in order to copy some of the files on the USB key to AA’s home computer. The Complainant also testified that on one occasion, AA took the USB key home to review work which the Complainant was doing on a specific project.

28Government policy requires employees to keep their work password, required to log on with their work user name, confidential. The Complainant’s testimony was that he kept his password confidential and did not share it with anyone, including AA. The Complainant testified, however, that on many occasions AA would be sitting next to him while the Complainant logged on to his computer. Sometimes the Complainant would leave AA working on the Complainant’s computer while the Complaint went to the washroom or to get a cup of tea.

29While this evidence suggested opportunity on the part of AA, there was no evidence as to why AA, acting alone, would make use of the Complainant’s USB key and thereby put the Complainant at risk. Indeed the evidence of the Complainant was that he and AA had been very close friends while the two of them worked together.

30Two further points from the evidence at this point. First, Mr. Gardner’s investigation included an examination of Mr. Tee’s workstation. That examination established that the documents related to the anonymous emails had not been accessed on the USB key from Mr. Tee’s workstation. This was in direct contradiction to Mr. Tee’s evidence that he had only accessed the USB key on his workstation. Mr. Tee was unable to provide an explanation as to how this could occur.

31Second, the Complainant made use of his USB key for work related purposes. Specifically, he would use it to transport files from his workstation to the workstations of colleagues. His USB key, therefore, was inserted into a variety of computers and while the Complainant generally kept it in his pocket, he did not have exclusive control of it at all times. Over the course of several years he testified to approximately ten different individuals who may have had access to it.

Argument of The Employer

32The Employer states its case is simple. With respect to the Complainant’s involvement in the anonymous emails: the USB key belongs to the Complainant; a draft of one of the anonymous emails was found on the USB key; the metadata points to the Complainant; and there is no plausible alternative explanation. With respect to the confidential government document: once again, the USB key belongs to the Complainant; the USB key was not encrypted; a copy of at least one confidential government document was found on the USB key; the Complainant was not authorized to have access to the confidential document and in any event having a copy of the confidential document on an unencrypted USB key is itself a serious violation of government policy; and there is no plausible alternative explanation.

33The Employer argues that principle of Occam’s Razor applies. The Employer describes that principle as follows: the explanation which requires the fewest assumptions should be preferred.

34The Employer argues the Complainant’s evidence that he was not aware of New folder is not plausible. It argues it is clear the Complainant is user12 from the fact that most of the documents authored or saved by user12 were personal to the Complainant. The Employer argues since Issue.docx and Reply.doc.docx were saved by user12, and since user12 is the Complainant, they were saved by the Complainant. The Employer notes the termination letter states the Complainant was involved in one of the anonymous emails. It argues since Issue.docx is a draft of the June 18, 2012 email, the allegation is made out. Further, the Employer argues the evidence as a whole establishes the Complainant was involved in all of the anonymous emails. The Employer argues the BB emails, although not sent anonymously, are similar in content to the anonymous emails. The fact the Complainant saved or authored those emails is further evidence of his involvement in the anonymous emails. The Complainant’s explanation as to how he came to have copies of the August 29, 2011 email on his USB key, in the Employer’s view, makes no sense. The fact metadata can be manipulated does not change the result. It still requires someone to do so intentionally. Given the number of changes which would have needed to have been made to eighteen separate documents to list user12 as the person who had saved them, this is not plausible.

35The Employer acknowledges there is a discrepancy between Mr. Tee’s evidence that he looked at copies of the anonymous emails on his workstation and Mr. Gardner’s findings that he did not. The Employer argues the discrepancy does not change anything with respect to the central issues of this case.

36The Employer then explores a series of alternative explanations as to how the files ended up on the USB key: Mr. Tee did it; AA did it; BB did it; someone else did it; someone using the training room computers did it; or, with respect to Issue.doc, someone took a document “authored” by the Complainant, deleted all of the contents and created the text which became the June 18, 2012 email. The Employer discounts each of these theories in turn as being unable to withstand scrutiny. Among other things with respect to AA, the Employer notes the Complainant’s evidence was that he and AA were very good friends. Thus the Employer argues, AA would have had no motive to implicate the Complainant in the manner suggested. The Employer argues that ultimately one is left with the simplest explanation: the Complainant did it.

37With respect to MB20, the Employer notes Mr. Kawall indicated the fact that a sensitive, confidential government document was found on an unencrypted USB key belonging to the Complainant was just as important to him as the anonymous emails.

38The Employer then provides a review of case law. I have omitted portions of the Employer’s review of the case law which were made in anticipation of arguments not advanced by the Association.

39The Employer cites F.H. v. McDougall, 2008 SCC 53, [2008] 3 SCR 41 for the principle that there is only one civil standard of proof, and that is proof on a balance of probabilities. The Employer cites a number of cases in which an employer sought to justify discipline of a grievor on the basis of circumstantial evidence. In essence, the Employer argues those cases stand for the proposition that once an employer has made out a prima facie case for discipline, a practical if not legal onus shifts to the grievor to provide a credible alternative innocent explanation. It refers to: OPSEU (Gyapong) v. Ontario (Ministry of Children and Youth Services), [2013] OGSBA No. 82 (Gray); Ontario Power Generation and Society of Energy Professionals (Verville), 2016 CarswellOnt 13503, 128 CLAS 139 (Surdykowski); Labatt Alberta Brewery and Unifor, Local 250A (Clark), 2015 CarswellAlta 2622, [2016] AWLD 2572, 127 CLAS 59 (Seveny); Canada Post Corp. and CPAA (Topping), 2013 CarswellNat 3151, 116 CLAS 48, 235 LAC (4th) 142 (Germaine); OPSEU (Brown) v. Ontario (Ministry of Community Safety and Correctional Services), GSB No. 0764/84 etc., August 25, 1987 (Brandt); and Canada Safeway Ltd. v. UFCW, Local 401 (Brandse), 2000 CanLII 50097 (AB GAA), 2000 CarswellAlta 1735, [2000] AGAA No. 75, 63 CLAS 12, 94 LAC (4th) 86 (Smith). The Employer refers to the oft cited passage in Faryna v. Chorny, 1951 CanLII 252 (BC CA), [1952] 2 DLR 354 (BCCA) with respect to the assessment of credibility. Finally, the Employer refers to De Lisa v. Canada (Treasury Board Secretariat - Solicitor General - Correctional Service), 2002 CarswellNat 5730 as a factually similar case in which discharge was upheld.

Argument of The Association

40The Association argues Occam was a fourteenth century mathematician and that Occam’s Razor not only does not reflect arbitral jurisprudence, but it has been implicitly rejected by boards of arbitration, including the Grievance Settlement Board. Rather, the Association argues in cases where discipline is justified solely on the basis of circumstantial evidence, not only must an employer present reliable and cogent evidence to meet its burden of proof, but it must also show there are no other reasonable or plausible explanations.

41The Association notes the evidence against the Complainant is entirely circumstantial. The Association argues there is no evidence that the Complainant had any motivation to participate in the creation or distribution of the emails attacking Mr. Tee. On the contrary, the Association argues up until the incident in January 2013, the relationship between the two was good. Following that incident, the Complainant lost his respect for Mr. Tee and did write a chronology of complaints, but those complaints were different than the issues raised by the emails.

42With respect to the IT evidence concerning the anonymous emails the Association makes several points. First, the investigation conducted prior to the discovery of the USB key was unable to determine who had sent the emails. Thus there is no direct evidence implicating the Complainant. Second, Mr. Gardner testified the IT evidence did not conclusively prove who sent the emails. Third, there is no IT evidence at all the Complainant was involved in creating or sending three of four of the anonymous emails. Fourth, there are a number of problems with respect to the IT evidence in relation to the fourth anonymous email (the June 18, 2012 email) so that any apparent connection to the Complainant is not in fact made out. Fifth, the IT evidence implicates AA with respect to the June 18, 2012 email. Sixth, the fact the Complainant had a copy of the August 29, 2011 email on his desktop which is subsequently copied to the USB key proves nothing. The copies were made after the August 29, 2011 email was sent and the Complainant’s explanation as to how he came to make copies is entirely plausible. Again, if anything the IT evidence implicates AA. Seventh, the Complainant denies any involvement in drafting the BB emails, but even if he was involved there is no plausible basis for connecting the BB emails, which were sent by a real employee, to the anonymous emails. In any event, the IT evidence once again tends to implicate AA. Eighth, the evidence with respect to user12 is suspect. It was gathered in a manner that specifically targeted the Complainant. User12 is not a unique identifier, and could have been used by others, including Mr. Tee, AA and BB, whose workstations were not targeted. The last saved by name can be changed. There were hundreds of other documents on the USB key personal to the Complainant which were not saved by user12. Ninth, the Complainant did not have exclusive access to the USB key: there were at least ten employees who also had access to it at one point or another. Tenth, most notably this included AA, who worked with the Complainant on the Complainant’s workstation and had access to it logged in under the Complainant’s user name when the Complainant stepped away from his desk. Eleventh, the reliability of the report is questionable for all of the foregoing reasons, and because Mr. Gardner testified that had he been aware the BB emails were from a real person, he would have conducted further investigations in relation to her.

43The discrepancy between Mr. Tee’s evidence that he looked at copies of the anonymous emails on his workstation and Mr. Gardner’s findings that he did not means either that the report is unreliable or that Mr. Tee was lying. If the report is unreliable, then the entire basis for the Employer’s case collapses. If Mr. Tee was lying then perhaps it was because he was involved in framing the Complainant: the Employer has offered no other explanation as to why he did so.

44With respect to the confidential documents, the Association argues, first, it has never been clear which confidential documents were of concern to the Employer. Second, the Complainant testified he had no authority to access MB20 and had not seen it. Third, the IT evidence implicates AA, not the Complainant: AA’s user name is the one which saved MB20 to the USB key. Fourth, whether the IT Policy required a USB key containing a copy of the MB20 to be encrypted is irrelevant. There is no mention of this in the termination letter as a ground and in any event the Complainant cannot be found to be in breach of such a policy if he was not aware that the MB20 was on his USB key. Fifth, no evidence was led with respect to any other confidential documents being on the USB key.

45The Association concedes a plausible interpretation of the evidence is that the Complainant was involved in the anonymous emails and in accessing the MB20. However, the Association argues the evidence does not establish this conclusively nor is the evidence reliable and cogent. Further, the Association argues it is equally plausible AA was involved in the anonymous emails and in accessing the MB20 with no involvement on the part of the Complainant. It is also plausible BB was involved in creating and sending the emails with AA, but without the involvement of the Complainant. It is also possible Mr. Tee was involved, although the Association concedes this is less likely. Further, the Association argues it is entirely plausible that the Complainant had not noticed New folder on his USB key, as he testified.

46The Association notes the letter of termination refers to “involvement” in the anonymous emails and that the Employer in argument had asserted “any involvement” would suffice to establish grounds for termination. The Association argues such a broad standard is inconsistent with the concept of progressive discipline. A case in which the Complainant created and sent the anonymous emails calls for a different disciplinary response to one in which he knew AA had planned to send anonymous emails but loaned AA his USB key not knowing that AA would use it for that purpose.

47The Association agrees there is only one civil standard of proof, and notes that it requires clear and cogent evidence, as confirmed by F.H. v. McDougall. With respect to the burden of proof in cases involving circumstantial evidence, the Association argues not only must an employer present reliable and cogent evidence to meet its burden of proof, but it must also show that there are no other reasonable or plausible explanations. It refers to: Brown & Beatty, “3:5130 - Circumstantial evidence in discipline cases”; Ontario (Attorney General) v. OPSEU (Khan), 1989 CanLII 9348 (ON GSB), [1989] OGSBA. No. 1, 18 LAC (4th) 260 (Swan); Calgary Co-Operative Association v. UCCE (Komicha), (2015) 253 LAC (4th) 403 (McFetridge); MGEU v. Sandy Bay Ojibway First Nation, (2012) 222 LAC (4th) 435 (Deeley); Toronto (City) v. CUPE, Local 79 (Kemp), [2005] OLAA No. 177 (Johnston); Fording Coal Co and USWA, Local 7884 (Lagunas), 1997 CarswellBC 3647, [1997] BCCAAA No. 674, 50 CLAS 63 (Germaine); and Telus Communications Inc. and TWU (Madsen), 2005 CanLII 94222 (CA LA), 143 LAC (4th) 299 (Sims).

48In the alternative, the Association argues lesser discipline should be substituted. It argues Mr. Kawall significantly misunderstood the evidence against the Complainant at the time of his decision. Reference was made to Brown & Beatty, “7:4410 - Employer Conduct”; La-Z-Boy Canada Ltd. and IUE, Local 400W (Grogan), 2002 CanLII 79030 (ON LA), 110 LAC (4th) 323 (Knopf); Camco Inc. v. United Electrical, Radio & Machine Workers of Canada, Local 550, [1988] OLAA No. 4 (Barton); OPSEU v. Ontario (Ministry of Natural Resources), 2005 CanLII 55137 (Petryshen).

Analysis and Decision

The Law

49In F.H. v. McDougall, the Supreme Court of Canada reviewed the conflicting jurisprudence with respect to the civil standard of proof. Some of the jurisprudence suggested that when the allegations made against an individual are “serious”, “criminal”, “morally blameworthy” or would have lasting implications for the individual’s reputation, a higher standard of proof applies, the evidence must be scrutinized with greater care or that clear and cogent evidence is required, in apparent contradistinction to other civil cases. The Court rejected approaches which suggested the standard of proof, the degree of scrutiny to be applied to the evidence or the nature of the evidence required varied depending on the nature or seriousness of the allegation at issue. Rather, the Court offered a simple and concise reformulation:

(i) “there is only one civil standard of proof at common law and that is proof on a balance of probabilities”: para 40.

(ii) “in all cases, evidence must be scrutinized with care by the trial judge”: para 45.

(iii) “evidence must always be sufficiently clear and cogent to satisfy the balance of probabilities test”: para 46.

49As noted the case against the Complainant is entirely circumstantial. There is no direct evidence of the alleged facts. Circumstantial evidence seeks to prove facts from which it is asserted other facts and ultimately the alleged facts may be inferred. The question then becomes what standard should an arbitrator apply in making those inferences. In my view, the process of inferential reasoning should be subject to the same test of balance of probabilities. That is to say, I must conclude that it is more likely than not an alleged fact can be inferred from the proven facts as a whole. If this were not the case, then it seems to me that facts which were inferred would be subject to a different standard of proof than facts which are proven directly. This strikes me as anomalous and inconsistent with the goal of single civil standard of proof.

50There is an element of common sense involved in inferential reasoning. It is not simply a matter of following every argument which may be made with respect to the inferences to be drawn from proven facts to its logical conclusion. As stated by the Supreme Court of Canada in F.H. v. McDougall (at para. 48):

Some alleged events may be highly improbable. Others less so. There can be no rule as to when and to what extent inherent improbability must be taken into account by a trial judge. As Lord Hoffmann observed at para. 15 of In re B:

Common sense, not law, requires that in deciding this question, regard should be had, to whatever extent appropriate, to inherent probabilities.

It will be for the trial judge to decide to what extent, if any, the circumstances suggest that an allegation is inherently improbable and where appropriate, that may be taken into account in the assessment of whether the evidence establishes that it is more likely than not that the event occurred. However, there can be no rule of law imposing such a formula.

51Accepting the circumstantial evidence as establishing the Complainant’s involvement or knowledge necessarily means that I do not believe his denials. Faryna v. Chorny, 1951 CanLII 252 (BC CA), [1952] 2 DLR 354 (BCCA) contains the following oft cited statement:

The credibility of interested witness, particularly in cases of conflict of evidence, cannot be gauged solely by the test of whether the personal demeanour of the particular witness carried conviction of the truth. The test must reasonably subject his story to an examination of its consistency with the probabilities that surround the currently existing conditions. In short, the real test of the truth of the story of a witness in such a case must be its harmony with the preponderance of the probabilities which a practical and informed person would readily recognize as reasonable in that place and in those conditions. Only thus can a Court satisfactorily appraise the testimony of quick-minded, experienced and confident witnesses, and of those shrewd persons adept in the half-lie and of long and successful experience in combining skilful exaggeration with partial suppression of the truth. Again a witness may testify what he sincerely believes to be true, but he may be quite honestly mistaken. For a trial Judge to say "I believe him because I judge him to be telling the truth", is to come to a conclusion on consideration of only half the problem. In truth it may easily be self-direction of a dangerous kind.

52In other words, I must determine whether the Complainant’s version of events is consistent, or harmonious, with “the preponderance of probabilities which a practical and informed person would recognize as reasonable” given the other facts I find based on my evaluation of the circumstantial evidence.

53Many of the cases cited by the parties predate F.H. v. McDougall, or rely, without comment, on cases which do. They must be evaluated with care against the civil standard of proof set out in F.H. v. McDougall.

54The Association cites Ontario (Attorney General) v. OPSEU (Khan) and Calgary Co-Operative Association v. UCCE (Komicha) for the following propositions, set out at para. 56 of Komicha:

The weighing of circumstantial evidence is thus largely a process of excluding alternative possibilities. In so doing, we have to take notice of what is humanly possible in the circumstances. We cannot cast an onus upon the grievor to prove to us that there were alternatives, although he would certainly help his own cause with every plausible alternative proposal. Rather, the onus is still on the employer to prove by clear and convincing evidence that there are no such alternatives.

and

. . . In our view, it would not be correct to decide a case based on circumstantial evidence on the basis merely that the allegation sought to be proved is the most attractive among a number of possible alternatives. It may be that the evidence suggests so many possibilities that no single one of them, even the most appealing, can rise to the standard of clear and convincing proof of the allegation. ….,

55While I agree with this formulation in some respects, in my view it suffers from conflating the process of inferential reasoning with the burden of proof. Facts are proved, inferences are not. Rather, inferences are arrived at by the arbitrator based on proven facts. Neither party can have an obligation to “prove” an inference, or to “prove” that there are no other inferences. Rather, the

inferences which may be drawn from proven facts, and what facts have been proved, is a subject for argument.

56As this is a case of alleged unjust dismissal, the burden of proof lies upon the employer throughout. To discharge that burden in a case of circumstantial evidence, the inference which an employer asserts should be drawn must be more likely than not on the facts established by the evidence as a whole on a balance of probabilities, and of course such evidence must be clear and cogent. It is not sufficient that the inference asserted by an employer is plausible, the most plausible of alternative explanations or even the only inference offered. The issue is always whether the inference asserted by an employer is more likely than not on the facts as found. If it is, that there are other inferences which can be drawn is of no legal consequence.

57Conversely, if the inference asserted by an employer is not more likely than not on the facts as found, that there is no other alternative explanation is also of no legal consequence. While I disagree with Arbitrator Deeley in MGEU v. Sandy Bay Ojibway First Nation, in other respects (as discussed below), I agree with his statement that it is not the role of the arbitrator to “solve the mystery”. Indeed, in my view, an arbitrator must be careful of the natural human inclination to attempt to arrive at an explanation for the facts. A focus on arriving at an explanation can direct attention away from the legal question of whether the explanation is more likely than not on the evidence. The role of the arbitrator is not to arrive at an explanation of the facts per se, but rather to consider what inference or inferences, if any, are more likely than not on those facts.

58While the burden of proof is always upon an employer, a union may help a grievor’s cause by adducing other evidence. Indeed, if it appears an employer will or has led sufficient evidence to prove its case, then, not as a matter of law but at a practical level¹, a union faces an evidentiary burden to prove other facts (if it can) which would change the inferences which could be found to be more likely than not. This may include evidence in support of an alternative explanation. Additionally or alternatively, a union may argue about whether the evidence as a whole establishes on a balance of probabilities the facts on which the employer relies for its inferences; and whether the inferences which the employer asserts are more likely than not given the facts which are established. While there is no obligation upon the union to offer alternative explanations while doing so, as a practical matter offering plausible alternative explanations may cause an arbitrator to conclude that the inference asserted by the employer is not more likely than not, and thus that the grievance must be allowed.

59Thus, I agree with Arbitrator Johnston in Toronto (City) v. CUPE, Local 79 (Kemp) that there is no legal onus or obligation upon a grievor to disprove the employer’s allegation or to offer an alternative explanation (see para. 97-98). This is because the burden of proof always remains with the employer. However, as noted, depending on the evidence the employer has or will likely lead, there may be a practical evidentiary burden upon the grievor (or more properly the union) to disprove the employer’s allegation or to prove facts in support of an alternative explanation.

60In determining whether an employer has led sufficient evidence to give rise to such a practical evidentiary burden, in my view an arbitrator is entitled to consider “the opportunities of knowledge with respect to the facts to be proved which may be possessed by the parties respectively”: Snell v. Farrell. Thus, where the allegation is about something which would be peculiarly within the grievor’s knowledge, very little evidence from the employer may suffice to give rise to such a practical evidentiary burden.

61Statements in a number of the cases cited by the Employer are, in my view, about instances in which such a practical evidentiary burden had arisen. This is true of the statement in OPSEU (Gyapong) v. Ontario (Ministry of Children and Youth Services) at para 25 that on the evidence it would be reasonable to infer the grievor had acted as alleged by the employer in the absence of a “credible alternative explanation”. So too the statement at para. 71 of Canada Safeway Ltd. v. UFCW, Local 401 (Brandse): “I also accept that since the Employer has proven that the Grievor was in possession of its property in circumstances requiring an explanation, the onus lies with the Grievor to provide a satisfactory explanation.” I also read the statement in Ontario Power Generation and Society of Energy Professionals (Verville) at para. 172 in this way: “The evidence presented by OPG requires an answer. The Society’s theorizing is not sufficient for the purpose and I am not satisfied that the Society has offered any cogent evidence that casts doubt on OPG’s case.” So too the statement in Labatt Alberta Brewery and Unifor, Local 250A (Clark) at para. 95 that:

Considering the evidence, the arbitrator concludes that the Employer has made out a prima facie case. As a result the burden of proof then shifted to the grievor "to take positive steps to provide a plausible explanation on the balance of probabilities that the event is not that to which the circumstantial evidence is pointing”.

I would note that in my view the suggestion that the “burden of proof” has shifted to the grievor is incorrect. As stated above, the burden of proof remains upon the employer at all times. It is a practical, not legal, evidentiary burden which may be thought of as “shifting” to the grievor if the employer has made out a “prima facie” case, i.e. if the employer has or will lead evidence which would discharge its burden of proof in the absence of any other evidence.

62To be clear, whether or not a union adduces evidence, it may argue for an alternative explanation of the evidence before the arbitrator. Evidence is adduced to prove facts; inferences are a matter of argument on the basis of the facts. A party does not lose its legal right to make submissions if it elects not to lead any evidence, although at a practical level its capacity to advance an argument may be circumscribed if it does not. To have any currency an argument must have reasonable grounding in the facts. An inference not grounded in facts will likely be found either speculative or unreasonable and hence rejected.

63Finally, the relative opportunities for knowledge of the parties is an appropriate consideration not just in assessing whether there is a practical evidentiary burden upon the grievor to provide an explanation, but also in assessing any explanation provided. Both assessments are simply part of the weighing of all of the evidence in the fact finding process.

64It follows from the above that I agree with the Association the test is not the formulation of Occam’s Razor offered by the Employer. It is not a matter of preferring the explanation which requires the fewest assumptions over others. Rather, the issue is whether the explanation asserted by the employer is more likely than not on the proven facts.

65The Association cites Brown & Beatty, “3:5130 - Circumstantial evidence in discipline cases”:

In assessing evidence in discipline cases, some arbitrators have applied a rule known in criminal law as the Rule in Hodge’s Case. This rule provides that, if the only evidence profferred is circumstantial, such evidence will not be proof of the fact to be established unless the evidence points conclusively to the inferences drawn and they are not capable of supporting any other rational inference which would exclude culpability. So particularly, where the conduct in question would also be a crime, in assessing such evidence arbitrators have applied the rule or a variation thereof. …. Of course, in other contexts arbitrators do commonly assess circumstantial evidence without any particular presumption or rule as to its conclusiveness.

66In my view, application of the Rule in Hodge’s Case would impose a criminal standard of proof in a civil case. The evidence need not conclusively point to the asserted inference, it need only establish that inference on a balance of probabilities. The additional requirement in the Rule in Hodge’s Case that the evidence not be capable of supporting any other rational inference amounts to asking whether the evidence gives rise to a reasonable doubt. This is the criminal standard of proof beyond a reasonable doubt, not the standard of proof on a balance of probabilities which the Supreme Court of Canada held in F.H. v. McDougall applies to all civil cases.

67It follows that I disagree with the statements of Arbitrator Deeley in MGEU v. Sandy Bay Ojibway First Nation at paragraphs 54 and 56 of that decision, and of Arbitrator Germaine in Fording Coal Co and USWA, Local 7884 (Lagunas) at para. 48 referenced by the Association in its argument. In my view, those statements constitute an application of the Rule in Hodge’s Case. I note that in Canada Post Corp. and CPAA (Topping), relied upon by the Employer, Arbitrator Germaine, while not referencing his own earlier decision, concluded that F.H. v. McDougall had made it clear that there is only one civil standard of proof and also agreed that the Rule in Hodge’s Case restates the criminal burden of proof and thus is inapplicable to arbitration cases: see paras. 5 and 71.

68The Association relies upon Telus Communications Inc. and TWU (Madsen). That was a case of discharge for unauthorized possession of confidential documents. The case against the grievor was based entirely on circumstantial evidence. The arbitrator rejected portions of the grievor’s explanation as lacking credibility. The arbitrator continued (at pp. 334-335):

However, I do not accept that it necessarily follows from this that he knew the confidential documents were in his desk or subsequently in the box. His actions are equally consistent with his not knowing that, but with being anxious to remove significant amounts of evidence as to his travel agency business.

I find Mr. Madsen’s activities in removing his personal items suspicious, but I cannot conclude, with the degree of certainty the law requires, that Mr. Madsen knowingly had in his desk or that he knowingly removed the confidential documents. ….

My task is not to explain how the documents arrived where they did, but it is not implausible that they got there in some other way.

69This passage raises three points for discussion. First, as I have already stated, I agree that it is not the task of the arbitrator to explain what happened.

70Second, I agree the fact that the grievor's explanation was not believed did not constitute evidence that he knew he had the confidential information. This point is made expressly by the Supreme Court of Canada in F.H. v. McDougall at paras. 95 and 96: “an unfavourable credibility finding against a witness does not, of itself, constitute evidence that can be used to prove a fact in issue”.

71The third point is with respect to the “degree of certainty the law requires” applied by Arbitrator Sims. It appears from pages 321 to 322 of the decision, that Arbitrator Sims had concluded that “in order to find the Company has met the onus of proof by clear, cogent and convincing evidence, it is necessary to reject the grievor’s explanation as one which could not “reasonably be true”. I do not find this formulation helpful. An employer meets its onus of proof when the inference or explanation it asserts should be drawn is more likely than not on the facts as found. If the reference to “reasonably true” means the grievor’s explanation is the one established as more likely than not, then it adds nothing. Only one of two competing explanations can be more likely than not. If the grievor's explanation meets that standard then it must follow the employer’s explanation did not. On the other hand, the reference to “reasonably true” could mean that not only must an employer make out its asserted explanation on a balance of probabilities, but there cannot be any other reasonable explanation. If so, it amounts to an application of the Rule in Hodge’s Case and I respectfully disagree for the reasons stated.

72The observations in the preceding paragraph apply equally to the statements by Arbitrator Germaine in Fording Coal Co and USWA, Local 7884 (Lagunas) at para. 51, referenced by the Association. In any event, as noted above, Arbitrator Germaine appears to have taken a different view of the law subsequent to the Supreme Court of Canada’s decision in F.H. v. McDougall.

73Finally, OPSEU (Brown) v. Ontario (Ministry of Community Safety and Correctional Services), cited by the Employer, relies upon Toronto East General Hospital Inc. v. Service Employees Union, 1975 CanLII 2133 (ON LA), 9 LAC (2d) 311 (Beatty) for the proposition that if stolen goods are found in the possession of an employee, the employee has an obligation to provide an explanation and breach of that obligation is itself grounds for discipline. It is not clear to me that proposition continues to have currency. I note, in this respect, that Mitchnick and Etherington in Leading Cases On Labour Arbitration at 10.3.1 reference the proposition contained in Toronto East General Hospital and then continue: “Subsequently, however, arbitrators have made clear that the basis for discipline is not the employee’s silence in the face of incriminating circumstances, but the presumption of wrongdoing created by other evidence which the employee has not rebutted.” In other words, where an employer has made out a prima facie case of theft, a practical evidentiary burden shifts to the griever to provide an explanation.

The Facts

74On the basis of this analysis of the law, I turn now to a more detailed review of the circumstantial evidence relevant to the Complainant’s involvement in sending the anonymous emails and his awareness of the presence of MB20 and other confidential files on his USB key.

The Presence of Files on the USB Key

75As noted, certain incriminating files were found on the Complainant’s USB key. The Complainant denies any knowledge of their presence.

76The USB key was the Complainant’s personal property. It primarily contained personal items (family photos and records, music etc.). However, the Complainant also used it to carry work related files within the workplace. He would carry his USB key to the desks of coworkers. Sometimes it would be inserted into their workstations. Sometimes he would leave it with them temporarily. He even permitted AA to take it home with him. However, the USB key remained the Complainant’s personal property throughout.

77It is possible that someone else may have put files on the Complainant’s USB key without his permission or knowledge. This begs the question of why anyone would do so, since the USB key remained the Complainant’s personal property and would revert to his possession. One possibility is that someone was seeking to “frame” the Complainant. Another possibility is that someone was using the Complainant’s USB key to transport documents (e.g. the confidential documents) from the workplace to outside the workplace. The difficulty is that there is no evidence to support either of these theories. (It is also not apparent why someone would leave a copy of a file on the Complainant’s USB key after using it to transport files outside the workplace, if that had been the objective.) Still, the existence of such possibilities combined with the fact that the Complainant did not retain exclusive possession of his USB key at all times means that the mere presence of a file on the USB key is not, in my view, sufficient to make it more probable than not that the Complainant had any involvement with the document or knowledge of it. The question is whether that fact combined with the balance of the evidence is.

78I begin by noting I do not find either the fact that the August 29, 2011 anonymous email was copied to the USB key long after it was sent on May 10, 2012 or the fact that the USB key contains drafts of the BB emails to be persuasive circumstantial evidence of the Complainant’s involvement in sending the anonymous emails. The Employer argues that the Complainant’s explanations are implausible. That may be. But at most that would constitute, in the words of the Supreme Court of Canada in F.H. v. McDougall, “an unfavourable credibility finding against a witness [which] does not, of itself, constitute evidence that can be used to prove a fact in issue”.

79The evidence against the Complainant is largely that of Mr. Gardner. As noted, the Association argues Mr. Gardner’s report is inherently unreliable and does not meet the standard of clarity and cogency required in part because of various shortcomings and in part because he was not aware the BB emails were not sent as anonymous emails and did not investigate her further. In my view, the shortcomings to which the Association points do not make Mr. Gardner’s report inherently unreliable. They simply establish the need to read it with care and with the clarifications which Mr. Gardner provided in his evidence. Further, it seems to me that IT evidence, properly understood, is quite clear and cogent. Metadata, which I shall describe next, is similar to a business record in that it is made as part of and in the ordinary course of the handling of data by a computer. Further, it is made automatically and, unless tampered with, is highly accurate. With respect to BB, it may be the case that further investigation would have established involvement on her part. However, the issue for me is not whether there is evidence which could have established her involvement, but rather whether the evidence before me makes it more likely than not the Complainant was involved or had knowledge as alleged.

Metadata

80It is convenient at this point to summarize Mr. Gardner’s evidence explaining the meaning of some of the terms used in the report. The report was largely concerned with an analysis of metadata. Metadata may be considered the electronic footprint left behind when something, such as a Word or Excel file, is “created”, “modified”, “saved”, copied or accessed on a computer.

81In order to make use of a computer, an individual must log in. In order to log in, the individual must enter a user name and a password. Each time a file is accessed on a drive of a computer by a user, the operating system of the computer creates a “link file”. The file which is accessed is referred to as the “target file”. A computer’s operating system generates link files for each “target file” in relation to all usage by a given user name. The link file name is the target file’s name with the additional suffix “.lnk”. A link file records information about the computer’s operations in relation to the “target file”, i.e. when the target file was created, accessed and last modified on that computer. I will call this “link information” or “link times”. (The link information records only the last time a file is modified on that computer: it does not retain the history of past modifications.)

82The link file also records information from the target file itself (I will call this “target information”): the name of the file which was accessed; its location (both the path name; and information identifying the device on which the file was located); the size of the file; and the “creation time”, “last write time” and “last access time” of the file whether or not done on that computer. I will call these times the “target times” in order to distinguish them from the link times. The creation time is the time content was first put into the file; the last write time is the last time the file was changed or modified; the last access time is the time the file was last opened, even if not changed. At least in the case of a Microsoft Word or Excel file, this target information is a record of some of the metadata recorded by Microsoft in the “properties” of the file itself. When a file is copied to a new drive or directory, a new file is created, and therefore it has a new creation time. The “last write time”, however, remains that of when the original file was changed or modified until the new file is itself changed or modified. This means that the “creation time” may be earlier than the “last write time”.

83As I understand Mr. Gardner’s evidence, the creation time recorded as target information may be earlier than the creation time recorded as link information. I infer that this is because the target information is recording times in relation to the file while the link information is recording times in relation to a computer’s operations. The mere act of copying a file to a new location gives rise to a new creation time in the target information (which is why the creation time may be later than the last saved time for the file), but apparently does not result in a creation time in the link information. Rather, Mr. Gardner testified, it is not until the file at the new location is first accessed (i.e. opened) that a creation time is created and recorded in the link information.

84The path name discloses the directory or sub-directories in which the file is located. The information about the device is the “Volume Type” (e.g. for the USB key in question, Removable Disk); the “Volume Label” (e.g. Centon USB); and the “Volume Serial Number”. The “Volume Serial Number”, is a unique identifier created when a device is formatted. A hard drive is a device internal to a computer. A USB key is an external device which may be inserted into a computer. The link times recorded in a link file may be different than the target times if the target file was initially created on another computer or changes were made to it on another computer. If, for example, the target file was created, changed or accessed on a USB key inserted in another computer, and then inserted in the subject computer and copied to a different directory while on that computer, the create time recorded as a link time would be later than the last write time recorded as a target time.

85If a computer is part of a network, such as the workstations used by employees of the Employer, then a person’s user name cannot be equated with their computer. Someone with a user name may be able to log onto any computer connected to the network and use it to create, write or access a document. Thus, it cannot be assumed that a given user has only created, written or accessed documents on their own workstation.

86Link files are recorded on the computer or computers used to access a file on a USB key. In order to obtain the link file on a computer, an investigator must have access to the computer. Mr. Gardner had access to computers located in the workplace, and in particular the workstations of the Complainant, AA and Mr. Tee, all of which he examined. (He also examined the workstations of the other employees who had custody of the USB key prior to it being delivered to the forensic investigation team, but found nothing of consequence.) He did not have access to the home computers of anyone whose workstation he examined. The Complainant had four home computers. An individual may assign more than one user name to a home computer, and in doing so may choose essentially any name they wish.

87As noted, Microsoft records metadata in the “properties” of the file itself. This includes the time when the document was created and the name of the “author” who did so. The author is the user name in use (or the name associated with that user name) when the document was first saved after content was inputted into it. The properties also record the time when the document was last saved and the user name used when the document was “last saved”. The user name or names used when the document was previously saved are not retained. The properties record the number of times that a document has been saved, but not the extent of the revisions. The user name listed as the author remains the same irrespective of how many times the document has been revised, how much it has been revised and by how many different users. This is so even if the original content of the document is completely written over.

88Some metadata can be changed. In particular, the author recorded in the properties of a Word or Excel file may be changed by opening the “properties”, deleting the content of the “author” field and inputting a new name. The user name recorded in the field “last saved by” is changed, as noted, whenever the document is saved under a new user name. The date and time can be changed as well by changing the date and time on a computer and then saving the document with this artificial date and time. By combining these two steps it is possible to change the user name which last saved the file while retaining the original date and time. (The date and time cannot be changed on a government computer unless an individual has “administrator” privileges. However, this could be done outside the workplace on a home computer.)

89Further, the parties agreed to stipulate:

There is software, readily accessible and freely available on the internet and easily used which can be used to change metadata of Word documents (metadata includes for this purpose create time and date, last save time and date, author, date and time modified and accessed). Further Mr. Gardner was not aware of such software [at the time he conducted his investigation and reported his findings].

90I would note, however, that while metadata may be changed, it requires an intentional action on the part of someone to do so.

The Discrepancy Between Mr. Tee’s Evidence and the Report

91As noted, Mr. Tee’s evidence was that he looked at copies of the documents related to the anonymous emails on his workstation and on no other computer. If this had occurred, it should have been captured in the link files on Mr. Tee’s workstation. Those link files are recorded in the report. The link files do not show any access of email related documents by Mr. Tee at his workstation. The Association states there are only two possible conclusions: the report is unreliable or Mr. Tee is lying. Mr. Gardner testified the chances of the metadata being wrong are extremely remote. I accept this is the case. I do not conclude therefore that the discrepancy renders the report unreliable. It follows I do not accept Mr. Tee’s evidence on this point. But this adverse finding has no significance to any other issue before me. There are no other instances in which Mr. Tee’s evidence was challenged by other evidence with respect to another fact in dispute. Thus, I need not consider whether the adverse finding should cause me to question Mr. Tee’s credibility.

Issue.docx

92The USB key contains the Word document Issue.docx, the text of which is essentially the same as the June 18, 2012 anonymous email. The Complainant testified he had no role in creating or modifying the content Issue.docx and had no knowledge of who did. The Complainant also testified he had no knowledge of how Issue.docx came to be on his USB key. The IT evidence with respect to Issue.docx is as follows.

93There is no link file in relation to Issue.docx on the Complainant’s workstation. That is, there is no IT evidence that Issue.docx was ever accessed from the Complainant’s workstation. There is a link file in relation to Issue.docx on AA’s workstation. The link information shows that on May 25, 2012 at 2:39 PM the USB key was plugged into AA’s workstation. At 2:41 PM, AA, or more precisely someone using AA’s user name, accessed a Word document “E:\Issue.docx”. Then, a few seconds later at 2:41 PM, the Word document “{root}\New folder\Issue.docx” was created on the USB key. The target information in the link file shows Issue.docx was modified the night before, at 9:49 PM. That is, it was modified on some other computer before being created on AA’s workstation the next day.

94The properties of the Word file Issue.docx show it was last modified at 9:49 PM on May 24, 2012 (as recorded in the target information). They also show that content, or text, was first put into Issue.docx at 7:55 PM on May 24, 2012, i.e. it was created at that time. The “author” is given as the Complainant’s work user name. While this would normally give rise to the inference the Complainant created the document, there is a difficulty in this case. As noted above, in the ordinary course the “author” of a document is the user name used to log into the computer on which the document was created. Use of a computer to author a document creates a link file on the computer. The report indicates there is no link file in relation to Issue.docx on the Complainant’s workstation, as noted above. In addition, in cross examination Mr. Gardner testified he was able and did in fact conduct a search to see if anyone was logged in to any government workstations with the Complainant’s work user name around 7:55 PM on May 24, 2012. He did not find the Complainant’s work user name logged in. Mr. Gardner noted his search would not have captured a log in with the Complainant’s user name to a government laptop if the laptop was not connected to the government network around 7:55 PM on May 24, 2012. However, the evidence of the Complainant was he never had a government laptop and there is no evidence that he had access to one.

95It would appear, therefore, that there is a mystery as to how Issue.docx comes to have the Complainant’s work user name as its author at a time when his user name was not logged in. One explanation would be someone changed the properties of the document. Another explanation would be, contrary to his evidence, the Complainant did have access to a government issued laptop and made use of it to create the document at 7:55 PM on May 24, 2012 while not connected to the government network. There may well be other explanations that would solve the mystery. But my role is not to solve the mystery. My role is to determine whether because the Complainant’s work user name is the author of Issue.docx the evidence before me establishes it is more likely than not that he was involved in creating it. Because of the unexplained inconsistencies, I am unable to reach that conclusion.

96Finally, the properties of the Word document Issue.docx also show it was last saved on June 2, 2012 at 10:11 AM. This was done by “user12”.

user12

97The USB key contains 18 files (17 Word documents and one Excel spreadsheet) which were last “saved” by user12. Three of those documents were authored by the Complainant’s workplace user name “Bhattacharya, Sudipta (MGS)”. One, the Complainant’s resume, was authored by “SBHATTACHARAYA”, which the Complainant agreed was him. One, “STREET CAPITAL.doc” was authored by “bhttacharyasu”. It contains the Complainant’s security passwords in relation to his mortgage. Nine of the documents were authored by user12. This includes a number of documents which are clearly personal to the Complainant or his family. It also includes Reply.doc.docx. All but two of the 18 files last saved by user 12 are located in folders which appear to be personal to the Complainant. The other two files saved by user12 are located in New folder. They are Issue.docx and Reply.doc.docx.

98At the material times, there was a computer training room in the office building where the Complainant worked. There were 12 computers in the training room. The Complainant testified in chief that there were 15 to 20 computers in the computer room labelled user1, user2 etc. Presumably based on this evidence the Association intended to argue a plausible inference was that user12 was whoever logged into the corresponding computer in the training room. However, in cross examination it was put to the Complainant that the computers in the training room were labelled train1, train2 etc., and the assigned user names were also train1, train2. The Complainant stated if that was the case he could not disagree. The training coordinator was called as a witness and confirmed the computers in training room were labelled train1, train 2 etc. and had assigned user names of train1, train2 etc. Accordingly, the computers in the training room are irrelevant.

99As noted, the Association argues the evidence with respect to user12 is suspect. It notes Mr. Gardner was directed to gather it after he had finalized his report. It argues in doing so the evidence was gathered in a manner that specifically targeted the Complainant. User12 is not a unique identifier, and could have been used by others, including Mr. Tee, AA and BB, whose workstations were not targeted. I disagree. Mr. Gardner did not target the Complainant’s workstation or the Complainant. Rather, he did a search of the USB key to find files saved by user12. The search revealed the 18 files described above. The fact that those files suggest a strong connection to the Complainant was a result of the search, not a parameter used in the conduct of the search. I would also note that none of Mr. Tee, AA or BB are listed as the author of any of the files saved by user12.

100The Association notes the evidence establishes the last saved by name can be changed. I agree. But doing so requires an intentional act. It strikes me as inherently improbable, as argued by the Employer, that someone else with access to the USB key (including AA) would make this change to 18 unrelated files, 16 of which were personal to the Complainant, while leaving the Complainant as the author of some of them. Conversely the fact there are hundreds of other personal files on the USB key not saved by user12 does not, contrary to the argument of the Association, make it improbable the Complainant is user12. It merely suggests the Complainant has various user names. In the result, I conclude it is more likely than not the Complainant is user12. I also conclude the Complainant saved Issue.docx to his USB key on June 2, 2012.

101The Association argues at most this establishes the Complainant was involved in saving a draft of the June 18, 2012 email, not that he was involved in sending it. I disagree that the Complainant’s level of involvement can be so minimized. The Complainant had no obligation to explain the mere presence of Issue.docx on his USB key, but the evidence goes beyond that to establish involvement on his part in saving it to his USB key, 16 days before the email itself was sent. The draft which he saved is virtually identical to the email which was sent. In my view, the Employer has made out a prima facie case that the Complainant was involved in actually sending the email. The extent of the Complainant’s involvement is a matter within his knowledge. There was a practical evidentiary burden on him to provide an explanation if he could. He failed to do so. In these circumstances, I find it is more likely than not the Complainant was involved in sending the June 18, 2012 email.

New folder And Its Contents: Issue.docx, MB20 and documents related to consolidation

102In addition to Issue.docx and Reply.doc.docx, New folder contained MB20. MB20 is the highly confidential submission to management board which the Complainant was not authorized to have. The author of this document is not relevant; AA is listed as having last saved it. New folder also contained three other confidential documents with respect to a consolidation of IT Services in the Ontario Government: a proposal document with a file name Doc14.doc, and two power point presentations, Project-Consolidation.ppt and Consolidation.ppt. AA is listed as the author and as having last saved Doc14.doc. The author of the two power point presentations is not relevant, but Project-Consolidation.ppt is last saved by AA and Consolidation.ppt is last saved by the Complainant.

103The Complainant’s evidence in chief was that he knew nothing about New folder and that he had never noticed it. He testified that every time he created a file folder, he would name it. There is no IT evidence which directly establishes the Complainant was aware of New folder or its contents. Rather, once again, the evidence is all circumstantial.

104New folder appears in the root directory or desktop when the USB key is accessed. The desktop displays 22 folders listed in alphabetical order, followed by 22 files listed in alphabetical order. With the exception of a few items which appear on the desktop, all of the items relate to personal matters of the Complainant. For example, immediately above New folder is a folder called “MY AQUARIUM MARCH 2012”, containing photographs of the Complainant’s aquarium; immediately below New folder is a folder called “OCI REGISTRATION”, containing documents pertaining to the Complainant’s application for a life time visa to India.

105As previously noted, there was a link file in relation to Issue.docx on AA’s workstation. That link file indicated that AA’s user name moved Issue.docx to New folder on May 25, 2012. This caused Mr. Gardner to conclude that the directory New folder existed on the USB key as of at least May 25, 2012. I agree that this is a reasonable inference.

106Mr. Gardner testified the IT evidence showed that on May 28, 2012 the USB key was plugged into the Complainant’s workstation. Between May 28, 2012 and July 25, 2012 (the day on which the USB key appears to have been lost by the Complainant: it was found on July 26, 2012), link files related to the Complainant’s work user name show that it accessed a total of 22 files and 6 folders on the USB key. None of the files or folders accessed were in New folder. However, CR, which is the eighth folder above New folder was accessed numerous times; PCC51, which is the third folder below New folder on the desktop, was accessed numerous times; and OCI Registration which is the folder immediately below New folder was accessed twice on July 25, 2012, just before the Complainant lost his USB key.

107Mr. Gardner’s report also shows, based on link files, that on the first day Mr. Tee had the USB key, July 26, 2012, he accessed three files on his workstation, the third of which, MB20, was located in New folder. This is some significance given I have concluded, contrary to his evidence, that Mr. Tee accessed the USB key from a computer other than his workstation. The point here is that Mr. Tee’s link files support the inference New folder existed and contained MB20 before he left work on the first day on which he had the USB key.

108There is no IT evidence the Complainant accessed New folder. His evidence is that he was not aware of New folder. The Employer argues this is implausible because New folder was clearly visible to anyone using the USB key and the Complainant accessed his USB key at least 22 times after New folder was on his USB key, including files located in folders above and below New folder, as described above. The Association by contrast argues that it is entirely plausible that the Complainant did not notice New folder. The difficulty with the Association’s argument is that New folder contained one file last saved by the Complainant (Consolidation.ppt) and two files (Issue.docx and Reply.doc.docx) saved by user12, whom I have concluded more likely than not is the Complainant. The process of saving those documents to New folder of necessity requires awareness that it exists. I am not prepared to accept the Complainant’s evidence that he failed to notice New folder in these circumstances.

109This finding affects my assessment of related evidence. The Complainant’s awareness of New folder is sufficient to give rise to the inference that the Complainant was also aware of its contents, given that the extent of such awareness lies peculiarly within the Complainant’s knowledge. The Complainant’s evidence that he was not aware of the other contents of New folder, and in particular the MB20 file, is not credible. Rather, given I have found the Complainant saved three other files to New folder, I find, on a balance of probabilities, he was aware of the contents of New folder. This included four confidential documents which he was not authorized to have: MB20 and the three documents in relation to the consolidation of IT services, Doc14.doc, Project-Consolidation.ppt and Consolidation.ppt, the last of which the Complainant also saved to New folder. Even if AA saved copy of MB20 to the Complainant’s USB key, this does not absolve the Complainant from knowingly maintaining it on his USB key thereafter. The Complainant had a practical evidentiary burden, which he has not met, to explain why he kept MB20 and the other confidential documents on his USB key.

110As noted, the Association argues it was not clear which confidential government documents were the subject of concern for the Employer. In my view, Mr. Kawall’s evidence made it clear he was concerned about at least MB20 and the documents in relation to the consolidation of IT services.

Conclusion on the Complainant’s Involvement

111Accordingly, I find the Complainant was involved in sending the June 18, 2012 anonymous email. I also find the Complainant knowingly had on his USB key copies of highly confidential and sensitive documents which he was not authorized to have.

Conclusion on Appropriate Penalty

112The Association argues Mr. Kawall significantly misunderstood the level of the Complainant’s involvement with the anonymous emails at the time he made the decision to terminate his employment. That is correct. However, in my view the thrust of Mr. Kawall’s evidence in cross examination was that his decision would have been no different on the facts he was advised of during cross examination. Ultimately, however, the question is whether I should exercise my discretion to substitute lesser discipline at this point in time.

113The Association refers to several cases in which lesser discipline was substituted where the employer had misapprehended the facts when imposing the original discipline. I read those cases as establishing only that the appropriate level of discipline turns on the facts of a particular case.

114In this case, I have found the Complainant was involved in sending the June 18, 2012 anonymous email. He also had the MB20 and other highly confidential documents on his USB key. He was not authorized to have these documents, and his knowing possession of them is grounds for serious discipline. The parties agreed the USB key should have been encrypted if it had such documents. It was not. This means the Complainant was also reckless with respect to safeguarding the unauthorized copies of the confidential documents which were in his possession. More significantly, the fact the Complainant has steadfastly denied the involvement and knowledge which I have now found he had means, in my view, reinstatement is not a viable option. The Complainant has taken no responsibility for his actions and cannot be trusted to do so if reinstated.

115For all of the foregoing reasons, the complaint is dismissed.

116This case has been factually and legally complex. I am indebted to both counsel for their assistance throughout.

Dated at Toronto, Ontario this 31^st^ day of March 2017.

These references speak of the shifting of the secondary or evidential burden of proof or the burden of adducing evidence. I find it preferable to explain the process without using the term secondary or evidential burden. It is not strictly accurate to speak of the burden shifting to the defendant when what is meant is that evidence adduced by the plaintiff may result in an inference being drawn adverse to the defendant. Whether an inference is or is not drawn is a matter of weighing evidence. The defendant runs the risk of an adverse inference in the absence of evidence to the contrary. This is sometimes referred to as imposing on the defendant a provisional or tactical burden. See Cross, op. cit., at p. 129. In my opinion, this is not a true burden of proof, and use of an additional label to describe what is an ordinary step in the fact-finding process is unwarranted.

Footnotes

1. 1See Snell v. Farrell, [1990] 2 SCR 311, 1990 CanLII 70 (SCC), at p. 329 per Sopinka J.: