Complainant

Respondent

Anonymised Parties

A Sales Professional

A Cleaning Products Wholesaler

Act

Complaint/Dispute Reference No.

Date of Receipt

Complaint seeking adjudication by the Workplace Relations Commission under Section 8 of the Unfair Dismissals Act, 1977

CA-00020669-001

13/07/2018

The complainant referred his complaint on 13 July 2018. The Director General delegated it to me on 24 August 2018 for hearing and decision. I held a joint hearing with the parties on 4 October 2018.

The complainant has a long employment record with the respondent. At the time of his dismissal, he had been in the respondent’s employment for 18 years.

In its evidence, the respondent set out in detail that the complainant was dismissed for gross misconduct, why he was dismissed in this way, and what process it followed. It alleges that the complainant used an anonymous online email facility, which allows users to insert sender identities other than themselves, and send those mails to other parties. In the instant case, the offending email was sent in the name of one of the respondent pension trustees to the CEO of the respondent’s US parent company, complaining in crude form of the UK management of its Irish operations, with strong Irish nationalist undertones. A PDF file of a PowerPoint presentation, amended from a generic training presentation and pressing the same points, as well as a link to a YouTube video entitled Why Ireland split into the Republic of Ireland & Northern Ireland and subtitled “A brief overview of the history of Ireland and the events that led to the political division of the island.”.

The employee who purportedly sent the email strongly denied doing so and this was confirmed in an initial IT investigation. The respondent next conducted an analysis of event logs in their possession, which led them to the complainant, resp. his laptop, which was company property.  The complainant was suspended with pay and asked to hand over his laptop, which was sent to forensic IT experts in the UK for investigation. These outside experts acquired a forensic image of the laptop’s hard drive. They also noted in their report that the laptop’s hard drive was encrypted, and that the machine’s BIOS was password protected.

Whilst the nature of the anonymous online mail application means that it is not possible to prove conclusively that the complainant sent the email, the experts concluded that it was highly likely, based on the following facts which they were able to establish with certainty:

The PDF file of the altered PowerPoint presentation originated on the complainant’s laptop and was created half an hour before the email was sent, at 23:45 on 1 February 2018. The complainant was identified as the author within the ID system in Windows Office applications.  

The laptop’s internet search history shows searches for information in Irish-UK history, including maps, carried out on between 22:18 and 22:21 on 1 February 2018, culminating in the user accessing the YouTube video referenced above;

Next, the user searched “send anonymous email” (22:34) and “send anonymous email with attachment” (22:34), also on 1 February 2018. When the experts replicated these searches, the anonymous mailing service which was used for the mail came up as the top result. The user researched a further such website at 22:49, and finally carried out a search on the respondent’s senior leadership team at 23:14.

The email itself has a date stamp of 2 February 2018, and time stamp of 5:49 GMT+5:30, meaning that a user in Ireland would have sent it shortly after midnight.

Based on this report, the complainant was invited to an investigation meeting on 12 April 2018.   The relevant letter was sent to the complainant on 5 April 2018.   The investigation meeting was chaired by Mr A. Also present were the head of HR, the complainant and the complainant’s union representative. The complainant denied any knowledge of the issues, including, somewhat peculiarly, not sending an offensive email to the CEO. Also, according to the minutes of the meeting, stated that he did not remember certain details, such as whether he was working in the night in question. He stated that he may have been visiting his parents, who he stated were ill. When the complainant asked who made the allegations against him, he was informed by Mr A. that the respondent carried out IT searches flagging similar content, and that his laptop was the only one showing similar searches to the content of the email. The processes by which his laptop was sent to the forensic IT experts was also explained. According to the minutes, the complainant made no further comment.

Mr A. made his investigation report on 17 April 2018 and recommended a formal disciplinary hearing for the complainant, based on the fact that the complainant had not offered any alternative explanation for the events which had been put to him.

A disciplinary meeting with the complainant was held by Mr B. on 15 May 2018.   The invitation letter, dated 3 May 2018, clearly states that the allegation is gross misconduct in respect of misuse of the respondent’s IT equipment and the sending of inappropriate and offensive email to the respondent’s CEO. Furthermore, the letter warns the complainant that if found guilty of gross misconduct, he may be dismissed without notice or pay in lieu of notice.   It also advises the complainant of his right to be accompanied.

The minutes for the disciplinary meeting are very short. They show that Mr B. summarised the charges to the complainant, and that the complainant answered: “No hard feelings”.

The complainant was dismissed by letter dated 24 May 2018, for gross misconduct. He was advised of his right to an appeal, but did not exercise it.   In recognition of his long service, he received three months’ pay in lieu of notice, as well as payment for accrued holidays.

In his oral evidence, Mr B. confirmed that the dismissal for gross misconduct was primarily for the serious breach of trust which had occurred between the parties, although the inappropriate use of the respondent’s laptop and the “intimidating content” of the email were also factors.

In response to a direct question, the respondent denied any knowledge of the complainant’s previous disciplinary record and stated that there were no open disciplinary matters at the time of the investigation and disciplinary process.

The complainant’s main argument in response was that anyone could have re-named any computer with his name and sent the offending email. The complainant stated that IT-literate friends told him this.   Accordingly, the complainant denied sending the email. He also stated that both of his parents were very ill at the time and have since died, and that he spent a lot of time in hospitals. He also stated that he had had a performance review on Monday, 29 January, and had been unhappy with how his salary and bonuses had been restructured by the respondent.

In response to a direct question, the complainant stated that he had been repeatedly disciplined by the respondent before, always, in his words, over “behaviour” issues, rather than the quality of his work. This included a process in which the complainant was issued with a final written warning. In the complainant’s words, there was “quite a bit of history” there.  In this context, the complainant stated that his lack of engagement with the investigation and the disciplinary process stemmed from “having been through the wringer” with the respondent HR department so many times before. In particular, he stated that Mr A. had investigated his conduct previously.     However, in response to a direct question, he confirmed that he had no objected to Mr A. investigating the complaint at the heart of this case.   He also accepted in cross-examination that both the investigation and the disciplinary procedure had been fair, and that he did not seek to allege an intrigue on the part of the respondent to place incriminating materials on his laptop.   The complainant stated that he expected to be dismissed at the end of the disciplinary meeting.   When asked by the respondent’s solicitor why he brought the within proceedings, the complainant replied that he was out of a job and did not think he should be.

The complainant has accepted the investigative and disciplinary processes which led to his dismissal as fair. I note that the evidence which led to the dismissal of the complainant for gross misconduct is only circumstantial, owing to the technology which the sender of the email employed and which was researched from the complainant’s laptop immediately before the offending email was sent. That said, the facts which the forensic IT specialists were able to establish with certainty and which are set out in their report are much stronger in terms of pointing to the complainant’s culpability than the complainant’s vague and generalised denials are in rebutting it.   This is especially so in light of the stated fact that the laptop’s hard drive was encrypted and the BIOS was password protected, both of which are measures which make unauthorised access to a computer more difficult.   I also accept the respondent’s evidence that the complainant’s laptop was the only computer in the entire company to have these internet searches on its search history, and on whose hard drive the attachments sent with the email were found.

I am therefore satisfied that the respondent was within its rights to rely on the outcome of this specialist investigation to confront the complainant and that it would have been for the complainant to offer a cogent rebuttal as to why it was not him who did the internet searches, created the PDF, and composed and sent the email.   A minor but not entirely unimportant detail here is the fact that according to the report, all of this happened at fifteen minutes to midnight, and right after midnight, on 1 and 2 February 2018. It would have been for the complainant to show who of his colleagues would have, or could have, been up at that hour to break into his laptop remotely to do him harm, especially since he had accepted in the investigation meeting that he was in possession of the laptop at the material time. A related question would have been who of his colleagues would have had sufficient IT skills to break the encryption to place the incriminating documents on his hard drive.

I am also satisfied that the incriminating email itself is indeed offensive and intimidatory and that it caused the respondent to lose trust in the complainant.

Last, I note that the complainant did not exercise his right to an appeal.

Overall, I am satisfied that the respondent was within its rights to dismiss the complainant for gross misconduct, and that the processes by which it arrived at this conclusion were fair. The complainant’s dismissal was therefore fair and the within complaint is not well founded and cannot succeed.

As set out in detail above, I find that the complainant’s dismissal by the respondent was not unfair within the meaning of the Unfair Dismissals Acts 1977 to 2015. I therefore dismiss the within complaint pursuant to the provisions of Section 8 of the Unfair Dismissals Acts, 1977 to 2015.

gross misconduct – loss of trust – offensive email – misuse of company IT equipment – specialist forensic IT investigation – fair procedures.