[2012] FWA 5390

Download Word Document


FAIR WORK AUSTRALIA

DECISION

Fair Work Act 2009
s.394—Unfair dismissal

Anastasios Margelis
v
Alfred Health
(U2011/9349)

COMMISSIONER GAY

MELBOURNE, 20 JULY 2012

Termination of employment - arbitration.

[1] On 30 June 2011 Mr Anastasios Margelis (the applicant) lodged a s.394 application for relief following the termination of his employment on 23 June 2011 by Alfred Health (Alfred, the respondent). Mr Margelis had been employed by the respondent since 2003, first as an information technology desktop support officer at Alfred’s Prahran campus and latterly as a systems specialist at the Alfred’s Caulfield campus.

[2] Mr Margelis’ employment had been regulated by the Victorian Public Health Sector (Health and Allied Services, Managers and Administrative Officers) Multiple Enterprise Agreement 2009-2011 [[AE887198 [PR512742]] (the Agreement) under which he was classified as an Administration Officer grade 4. At the relevant time this meant that the applicant’s pay rate was $2602 per 76 hour fortnight.

The Hearing

[3] The evidentiary case was heard in Melbourne from 16 to 18 January 2012, and from 20 to 22 February, with final submissions presented on 14 March 2012. A later exchange of correspondence, initiated by the applicant’s solicitors and commented upon below, concluded on 20 March 2012. Mr J D’Abaco of counsel appeared by permission for Mr Margelis and Mr R Millar of counsel appeared by permission for Alfred Health.

Jurisdiction

[4] Section 394 of the Act provides that a person who has been dismissed may apply for an order granting a remedy. A remedy may be ordered by Fair Work Australia if Fair Work Australia is satisfied that the person was protected from unfair dismissal and the person had been unfairly dismissed - s.390. I considered whether Mr Margelis was protected from unfair dismissal by reference to s.382 and concluded that:

Section 388 had no application and, as this was not a case of redundancy s.389 similarly had no bearing on Mr Margelis’ application. It followed that Mr Margelis is able to have his application heard and determined.

[5] As to s.399, a hearing of the application was appropriate.

[6] During the lengthy hearing, and possibly assisted by an unavoidable break in proceedings which permitted the parties to further consider the case, a great deal of evidence including technical computer based information, much of it expert, was put before Fair Work Australia.

[7] As will be further detailed below, the correspondence received from Mr Margelis’ solicitors after final submissions had been given and decision reserved, included very detailed computer log material. That there should be admission of further material post-case was strongly resisted by the respondent and the applicant’s solicitors sharply criticized for first sending the material sought to be admitted directly to me.

[8] For reasons commented upon later in this decision in some detail I have not given weight to the material supplied after the conclusion of the case. To have done so would have certainly required re-opening the case to hear any further evidence or revised views of the technical experts (Messrs McLeish and Park), to have recalled the applicant and possibly several Alfred Health witnesses. It assists if one understands that all the key players are IT specialists and/or IT managers, well familiar with computer and information technology generally and with the Alfred's computer systems. Prior to the case commencing further material, computer records or logs, had been successfully sought by the applicant and access to these extensive computer records of Alfred Health granted by Fair Work Australia order.

The Witnesses

[9] Additional to that given by Mr Margelis on his own behalf, evidence for the applicant was given by:

[10] For Alfred Health, evidence was given by:

 The Principal Experts

[11] Both Mr McLeish and Mr Park had significant experience in the forensic examination and analysis of questioned IT material, electronic transactions, information technology, electronic security and fraud. Mr McLeish had significant service as a sworn officer in a state police service and as a Federal Police member in reviewing fraud and other forms of criminality involving internet and computer applications. Both experts were familiar with the investigation of improper or unauthorised access attempts into IT systems using various forms of computer platforms. Their evidence was fluent and authoritative. Fortunately, on key issues they spoke as one (for an exception paragraph 13 of Mr Park’s Statement, Exhibit A4 relative to Mr McLeish’s observation at paragraph 89(g) of his statement (Exhibit M1).

The Termination

[12] Mr Margelis’ employment was terminated summarily per medium of correspondence of 23 June 2011 from Mr Gardiner, Alfred health's divisional IT manager, alleging that Mr Margelis had “breached the integrity of Alfred Health’s information technology system by accessing Yann Pasnin’s Alfred Health email account without authorisation on Monday 13 June 2011. This is a breach of Alfred Health IT security policy”. Mr Gardiner’s letter acknowledged that Mr Margelis had denied the allegation relating to his iPhone, and commented further, “but you have been unable to explain the link to your phone” (Attachment AM9, to Exhibit M13, Statement of Mr Margelis). It had been Alfred Health’s initial understanding that the device used to connect to the internet, through Mr Margelis’ home wifi router, had been his iPhone. It later became clear that over the period in question Mr Margelis had not activated or achieved internet connection through his home router by use of his iPhone. Rather, it became clear that over the key period Mr Margelis went online, through his home router, per medium of his laptop.

[13] The Alfred’s 23 June 2011 instrument of dismissal also relied upon an allegation that Mr Margelis had participated in an online written conversation with a fellow IT employee at Alfred Health, who was also subsequently dismissed (hereafter Subsequently Dismissed Employee ‘SDE’). That online conversation set out at paragraph 56 below, was said to contain lewd and offensive remarks about a female IT employee of Alfred Health and Mr Gardiner. Mr Margelis conceded that he had participated in the online conversation (Attachment AM4 to Mr Margelis’ Statement, Exhibit M13) with the fellow SDE, but did not acknowledge that his (Mr Margelis') participation or his actual comments were objectionable. It was said for Mr Margelis that he neither initiated, nor engaged with, the objectionable aspects of the dismissed colleague’s online remarks and Mr Margelis had not further published the objectionable communication.

The Background

[14] In May 2011 Mr Yann Pasnin, the Alfred’s Manager of Information Technology Infrastructure and Operations and Mr Margelis’ direct manager, became aware of the potential misconduct of the SDE. The SDE was also a member of Mr Pasnin's department and, like Mr Margelis, was engaged in the workings of the Alfred’s email systems, file servers, IT security, telecommunications, data communications, service delivery and the like.

[15] Mr Pasnin and Mr Gardiner discussed Mr Pasnin’s concern that Mr Margelis' colleague, the SDE, may have been involved in a ‘variety’ of misconduct and together they successfully sought the approval of the Alfred’s Human Resources Department for the SDE’s office computer to be scrutinised. When approval was forthcoming, Mr Pasnin took an ‘image’ of the SDE’s work computer. This meant that all the material on the computer was available for review by Mr Pasnin. Amongst the material which became apparent was the online conversation between the SDE and Mr Margelis, now said to partially justify termination of the applicant’s employment.

[16] It followed for the investigative Mr Pasnin that a similar mirror-image of Mr Margelis’ computer should be obtained. Again, the permission of Alfred Health's Human Resource Department was sought and granted. As a consequence, Mr Pasnin went to Mr Margelis’ work station at the Alfred Health Caulfield campus at 2 o’clock in the morning of Saturday 11 June 2011, and at about that time took a mirror image of Mr Margelis’ computer’s C drive - including emails and documents (Statement of Mr Pasnin, Exhibit A2, paragraphs 8-9).

[17] It is convenient at this point to take up the narrative provided by Mr Margelis, as in significant part it is not in contest.

The Chronology

[18] The key events in question surround the 2011 Queens Birthday long weekend of Saturday, 11 June to Monday, 13 June 2011. Mr Margelis was not rostered for work over this period and, indeed, part of Mr Margelis’ account was that he was planning to advise the Alfred, and Mr Pasnin particularly, that he intended to also take Tuesday the 14th June as an additional leisure day, an ‘accrued day off’. It seems that Mr Margelis had forgotten to make a timely request and intended to seek to extend the long weekend by making a request, or more accurately, giving advice to that effect, during the course of the long weekend.

[19] Friday 10 June 2011

[20] Saturday 11 June 2011

[21] Sunday 12 June 2011

[22] Tuesday 14 June 2011

[23] Wednesday 15 June 2011

[24] Monday 20 June 2011

The Allegations

[25] On Mr Margelis’ account, at the 20 June meeting it was alleged that:

Mr Margelis’ Reply

[26] Mr Margelis denied accessing Allred’s IT system with his iPhone at 3.30 pm on Monday 13 June and advised Alfred that he would “investigate” to clear his name; admitted accessing the Alfred system on Saturday 11 June on the occasions given earlier and acknowledged participating in an online conversation in late 2010-early 2011.

The Alfred’s 20 June Letter

[27] Mr Margelis was given a letter subsequent to this meeting which reaffirmed Alfred’s view that Mr Margelis had accessed Mr Pasnin’s email account on Monday 13 June per medium of his iPhone - “Alfred Health provided you with access logs that demonstrate your Apple iPhone was used to access the email account”, and that Mr Margelis had participated in a lewd and offensive conversation on Alfred Health’s internet messaging system (Exhibit M13, Attachment AM7).

[28] Mr Margelis was advised in the 20 June correspondence of a requirement that he attend something called a “show cause” meeting on Thursday 23 June, after which a conclusion could be reached by Alfred Health which might result in a review of Mr Margelis’ employment.

The Meeting of 23 June

[29] Mr Margelis’ evidence was that, again with his representative Mr J Katsiris, he attended a further meeting on 23 June 2011 with Messrs Pasnin, Gardiner and Goller. Mr Margelis gave the Alfred Health officers a letter prepared by his solicitors (Attachment AM8 to Exhibit M13) which denied the alleged iPhone access of Mr Pasnin’s email account on Monday 13 June and the deletion of three months of Mr Pasnin's emails.

[30] Mr Margelis’ letter sought additional time to prove that he was not responsible for the alleged security breach by obtaining the services of a ‘forensic expert’ to audit both his iPhone and the Alfred Health IT server. The letter prepared for Mr Margelis continued that, as Mr Margelis was awaiting a response regarding the time which might be involved in such an enquiry, and as to its likely cost, additional time on paid suspension was sought. Mr Margelis’ letter acknowledged the instant messaging conversation, but contended that he had neither initiated or approved of the remarks recorded. The letter concluded that Mr Margelis did not wish to answer further questions about the matters under investigation.

[31] When Mr Margelis was asked by the Alfred officers how long he needed to reply to Alfred Health, Mr Margelis’ witness statement indicated that he replied “to the effect of next week” (Exhibit M13, paragraph 31). In Mr Gardiner’s evidence, after providing the solicitor’s letter, Mr Margelis “became very vague and refused to answer any questions” and gave a non-committal response as to the amount of additional time required. (Exhibit A1, statement of Mr Mark Stephen Gardiner, paragraphs 47 and 48). Mr Goller’s statement (Exhibit A5) had Mr Margelis “...very vague about how long it will take saying “maybe a week or maybe two” but was not definitive” (Exhibit A5, paragraph 13). Mr Katsiris, Mr Margelis’ observer and note taker, records Mr Margelis’ response as “this week/next week” (Exhibit M8). The Alfred Health group then withdrew to consider what had been put by Mr Margelis.

[32] After a short break the meeting reconvened and Mr Margelis was told by Mr Goller that he had had enough time and that he was dismissed with immediate effect. The Alfred’s subsequent letter of 23 June (Attachment AM9 to Exhibit M13) formalised this position by setting out Alfred Health’s view that there had occurred serious and wilful misconduct and accordingly Mr Margelis’ employment was terminated immediately. Mr Margelis’ participation in the online conversation was again relied upon in Mr Gardiner’s letter, in that that conversation “contained lewd and offensive remarks about a fellow employee and myself” (Exhibit M13, Attachment AM9).

[33] For reasons which will become obvious, it is informative to set out the Alfred’s other allegations and the conclusion the respondent had reached.

The Case for Mr Margelis

[34] Counsel for the applicant, Mr D’Abaco, argued strenuously that there had been an imperfect capacity given by Alfred Health for Mr Margelis to defend himself, to argue the technically available response to the offences with which he was charged, so that there was an important and substantial natural justice flaw in the respondent’s position.

[35] Mr D’Abaco sought to marginalise his client’s participation in, and the consequences flowing from, the so-called lewd and offensive online conversation because it was a private communication, because Mr Margelis had made no lewd or offensive comments and he had not encouraged them in any active way. It followed that such passive involvement could not form part of the basis for Mr Margelis’ summary termination. An argument was also put that Mr Margelis’ privacy had been violated, by the intrusion of Alfred Health into the private, online communication conducted at work, in working time, and on the Alfred’s in-house computer system, between Mr Margelis and the SDE by Alfred’s ‘imaging’ of Mr Margelis’ computer and, possibly, by checking the SDE's computer.

[36] The alternative proposition advanced by Mr D’Abaco was that should it be found that Mr Margelis did have a participatory role in the 'lewd and offensive' communication, that it should not be regarded as of the sort to warrant anything more than a warning or, perhaps a written warning.

The Attempt to Access Mr Pasnin’s Email

[37] Detailed and forceful submissions were put for Mr Margelis as to the charges relating to the attempt to gain access to Mr Pasnin's email account. These it must be understood were put when it ultimately became clear that the Alfred’s initial prosecution of Mr Margelis was ill-founded. This was because it was accepted at the point of arbitration that Mr Margelis had not used his iPhone on 13 June and had not, in a literal sense, actually accessed Mr Pasnin’s email.  Rather, Mr Margelis was said to have been detected, by his home router’s unique IP number, in an online attempt to gain entry to a particular email account of his manager, Mr Pasnin. These attempted incursions were said to have occurred at 3:31:11 pm, 3:38:52 pm and 3:43:47 pm on 13 June 2011.

[38] Over the period from Saturday 11 June 2011 to Monday 13 June, the Alfred Health computer logs, as researched by Mr Parks and set out his “Chronology of Network Events via Outlook Web Access 11-13 June 2011” (Attachment DP1 to Mr Parks’ Statement, Exhibit A4) reflect Mr Margelis’ unique 12 digit IP address, which Mr Margelis acknowledged was linked to his iPhone (but not used on Monday 13th) and laptop, as involved in nine attempts to access Alfred Health email accounts. The term ‘attempt to access’ as used here connotes a user from an IP address seeking to gain access to an account whether the effort is successful or not. Five of Mr Margelis’ attempts, all successful, were made on Saturday 11 June and each of those was directed to his own inbox.

[39] The remaining four attempts to access an Alfred Health system user’s account were made, according to the Alfred’s logs, on Monday 13 June. Each of these four attempts deposited Mr Margelis’ IP router ‘address’ or unique number, within the Alfred’s computer logs. Two of those attempts, those at 3:38:20pm and 6:37:32 pm, were successful and both of these were directed to Mr Margelis’ own email address (Exhibit DP1).

[40] The two attempts remaining which the respondent argued were referable to Mr Margelis, were, it was submitted, unsuccessful incursions directed to Mr Pasnin’s email account and addressed to a specific folder “/ITS/Mgmt/Mark”. These attempts were initiated on Monday 13 June 2011 at the following times, 3:31:11 pm - 3:31:12 pm, 3:38:52 pm - 3:29:02 pm and 3:43:47 pm. It was these attempts to access Mr Pasnin’s email accounts that were relied upon by Alfred Health, together with the online conversation, as the reasons justifying Mr Margelis’ termination.

The Other Long-Weekend Activity

[41] No attempts to gain access to an Alfred Health system user from Mr Margelis’ home router were detected on Sunday 12 June. Five attempts to gain access to Mr Pasnin’s email account were detected on 12 June. Three IP addresses were involved and for each address no owner’s identity is know. Two of these attempts were successful in gaining access to Mr Pasnin’s email account and examining six particular folders. During both of the successful incursions one of the Pasnin email folders examined by the intruder bore the given name of the female employee mentioned in the online discussion between the SDE and Mr Margelis.

[42] A further four unsuccessful attempts to access Mr Pasnin’s account, again from an IP address revealed in the Alfred’s logs but not able to be linked with an owner, were made early in the morning of Monday 13 June.

[43] The Alfred Health case did not suggest that Mr Margelis could be connected by the respondent’s computer records with the attempts, whether successful or unsuccessful, to gain access to Mr Pasnin’s email accounts on Sunday 12 June and before noon on Monday 13 June 2011. Instead, Mr Margelis’ case defended the allegation that he had sought to gain access to Mr Pasnin’s email by seeking entry on the two midafternoon unsuccessful attempts (3:31:11 and 3:38:52) on 13 June 2011, on each occasion to the email folder of Mr Pasnin entitled “/ITS/Mgmt/Mark”. (The activity given as occurring at 3:43:47 has been regarded, as I have understood the technical opinion, as forming part of the 3:38:52 - 3:39:02 transaction.)

[44] In presenting the case for Mr Margelis, reliance was placed by Mr D’Abaco on the need for Fair Work Australia to be satisfied to the requisite level of satisfaction outlined in Briginshaw (Briginshaw v Briginshaw [1938] 60 CLR 336) because the allegations and consequences to Mr Margelis were said to be “of the utmost seriousness.” (TPN 5759).

Mr Margelis’ Denial

[45] It was put for Mr Margelis that: he was a “very, very credible witness”, having presented as an honest person who had freely admitted to the Alfred that he had participated in the online conversation with his colleague and acknowledged the ownership of the IP ‘address’ linked to the number allocated to his home router. As to demeanour, it was put that Mr Margelis had given evidence in a clear, calm, respectful, non-hostile and open manner, said by Mr D’Abaco to reflect the persona of a man having been wrongfully accused and who was motivated, not by financial gain, but by his pursuit of justice.

Mr McLeish

[46]  As a specialist witness of technical and professional accomplishment, giving expert information technology evidence, Mr McLeish’s opinion was that Mr Margelis had not accessed Mr Pasnin’s emails on Monday 13 June and moreover, that Mr Pasnin’s emails “had not been read, deleted or tampered with on 13 June as had been alleged by Alfred Health at all of the meetings leading up to Mr Margelis’ dismissal.” (Mr D’Abaco TPN 5770).

[47] It was stressed for Mr Margelis that Mr Park, the respondent’s expert witness, had agreed that Mr Margelis had not accessed Mr Pasnin’s email on 13 June 2011 and, similarly, that there had not been reading or deleting of Mr Pasnin’s email by Mr Margelis.

[48] Given particular emphasis was the concession ultimately made by the Alfred’s IT chief, Mr Gardiner, that, by virtue of the evidence of Mr Park and Mr McLeish, it could not be said that there had been any actual compromise of the Alfred’s system, in that Mr Pasnin’s email account had not been breached on that day, 13 June 2011. From this concession, given, it was submitted, only after considerable prevarication by Mr Gardiner, it was said that even if Mr Margelis was considered to have attempted to access Mr Pasnin’s emails, such an attempt could not justify dismissal. This was because there was no actual breach of the ‘integrity’ of the Alfred’s system and it was the system’s integrity that was paramount in the Alfred’s mind.

[49] In putting this argument as to there having been no breach, Mr D’Abaco acknowledged such an attempt (to have the effect of a breach) to be “a very serious matter”, but not such as to justify dismissal because, fundamentally, there had been no breach of the integrity of the Alfred’s system (TPN 5775).

[50] In now dealing with only part of the material canvassed in the case it should not be thought that the other information and evidence has not been considered. Reference to the transcript will reveal close dealings with counsel as the argument was put and, at opportune moments, with the evidence as it was presented. All the evidence and argument has been considered.

The Server Logs

[51] It was submitted for Mr Margelis that without knowing Mr Pasnin’s secret password, with its combination of eight numbers and letters, Mr Margelis could not decrypt or guess Mr Pasnin’s password, “and without that password Mr Margelis could not have accessed Mr Pasnin’s email account and with that knowledge he wouldn’t have attempted to access it either” (Mr D’Abaco TPN 5780).

[52] Of fundamental importance in Mr D’Abaco’s presentation, was acknowledging the fact of the Alfred Health’s server log capturing and recording the IP address of any internet user trying to enter the Alfred system to interrogate an Alfred employee’s email account. Associated with this submission were several others; that Mr Margelis, possessing a tertiary information technology qualification, (an Associate Diploma of the Northern Metropolitan Institute of TAFE) was aware that an attempt, irrespective of its success, would result in the identification of the source of such an illegitimate request to access; that Mr Margelis knew he could not, consistent with Alfred health’s policy, access other employees’ emails and that to seek to achieve such access put an employee so acting at risk of dismissal from Alfred Health (TPN 5792).

The Breach of Alfred Health’s IT System

[53] The applicant’s case described the Alfred’s principal reason for dismissing Mr Margelis as Mr Margelis having breached the integrity of the IT system. It followed that unless it could be shown that such a breach had occurred (and it could not be shown to have occurred) a reason based on an IT integrity breach had no substance. Connected with this argument was that part of Mr Margelis’ case relying on Mr Coulthart’s unchallenged expert evidence, that Mr Margelis’ iPhone had not made connection “to any router or to his IP address on 13 June.” (Mr D’Abaco TPN 5795). I have accepted Mr Coulthart’s evidence that the iPhone played no part of Mr Margelis’ home router connectivity over the weekend in question. On Mr Margelis’ evidence, that left only one device at his home capable of connecting via his router to the internet; Mr Margelis’ laptop. It was Mr Margelis’ evidence that there were no other relevant devices at his home over the weekend in question.

The ‘Lewd and Offensive’ Online Conversation

[54] It was put for Mr Margelis that his typed online conversation with the SDE, utilising the Alfred’s equipment and in work time, occurred some five to seven months before his dismissal and that, pivotally, Mr Margelis had not in the conversation made any lewd or offensive comments. Mr Margelis was said, despite having used the “LOL” response acronym (Laugh/ing Out Loud), in replying to the SDE’s comments, to have not endorsed or encouraged his colleague’s highly objectionable or offensive statements or to have disseminated the comments elsewhere through the Alfred workplace (TPN 5798). In Mr D’Abaco’s submission it followed for Mr Margelis that the conversation was no more than a private, albeit unwise, ‘conversation’ between two fellow employees.

[55] No condonation argument could be said to arise by virtue of the effluxion of time since the on line conversation, as Alfred Health had only recently become aware of the conversation. It followed that there had been no delay in prosecution of the online conversation.

[56] The lewd and offensive conversation is set out below. The name of the Alfred Health female employee given in the conversations as a candidate for rape has been omitted.

The 13 June Attempt to Access

[57] At arbitration the Alfred case against Mr Margelis was that he had twice attempted to gain access to Mr Pasnin’s Alfred email account on Monday 13 June. This was said to be supported by the fact of the expert evidence of both sides’ specialist expert witnesses, Mr McLeish and Mr Park, concurring. The point of agreement was a central one, that at 3.31pm and 3.38pm on Monday 13 June 2011, Mr Margelis’ home router, to which his laptop was connected wirelessly, was linked (by the router’s unique identification number) to two unsuccessful attempts to log on to Mr Pasnin’s email. Mr Margelis denied accessing, attempting to access or having knowledge of such activities on others’ behalf as to Mr Pasnin’s email account via either of his home devices on the 13 June or on any other day. Mr Margelis’ case offered several explanations.

The Spoofing Explanation

[58] It was suggested for the applicant that an explanation for Mr Margelis’ unique home IP router address coming to be captured on the Alfred’s IT system server files as a would-be intruder into Mr Pasnin’s email system, was that a person or persons unknown may have not only disguised their true IP address from appearing on the Alfred system (as they sought to illegitimately gain entry to Mr Pasnin’s email) but had substituted that of Mr Margelis. Fair Work Australia was told that the practice of party A obscuring their computer device’s unique numeric IP address by substituting that of party B as an illicit entry was sought to be achieved into the system of party C, is known as ‘spoofing’. This practice, which it seems is extremely rare and requires IT skills of a high order, was a practice of which Mr McLeish and Mr Park had heard.

[59] Nothing was put as to who may have done such a thing; to have attempted to have entered Mr Pasnin’s email system or why they would have contrived by ‘spoofing’ to have Mr Margelis’ IP number attach to their computer’s two failed enquiries of the afternoon of Monday 13 June - that is, assuming it was one and not two spoofers.

The Unknown Router User

[60] The second explanation offered for the use of Mr Margelis’ home router IP number, and consistent with his claim of complete innocence, was that a person or persons unknown had sought, without Mr Margelis’ knowledge, to use his wireless router. By doing so, that is, by surreptitiously logging on to the internet by ‘jumping on’ to the applicant’s router, Mr Margelis’ router number would have been recorded on the Alfred system as that unknown user went about their business. As Mr Margelis had given evidence that no other device (other than his iPhone and home laptop) were at his home on Monday 13 June, it was clear that such a person or persons must have used the router signal by locating their computer sufficiently close to the router to have somehow availed of it. Mr Margelis’ evidence was that he was entirely unaware of any such activity at or connected to his router on Monday 13 June.

[61] There was no evidence from the applicant, or even speculation, as to who such a miscreant might have been or explanation why somebody would bring their computer to a place sufficiently proximate to Mr Margelis’ home to permit them to have Mr Margelis’ router accept the ‘foreign’ computer as forming part of Mr Margelis’ computer hardware. To avail of Mr Margelis’ router would require the illegitimate user to enter Mr Margelis’ secret router code in their machine. There was no evidence as to how an illegitimate user would or could have gained access to the router in a way that could have led to the device being accepted.

[62] One consequence of such a surreptitious activity, were it successful, was that the interloper assumed Mr Margelis’ identity, not only for the technical purpose of making or attempting to make the connection with Mr Pasnin’s email, but also to surely have the Alfred system identify the intrusion as an act referable to Mr Margelis.

The Alternative Submission

[63] It was put for Mr Margelis that should Fair Work Australia not accept that a spoofer or otherwise unauthorised and unknown person had purloined use of Mr Margelis’ router without his knowledge or authorisation on Monday 13 June 2011 and, rather, that Mr Margelis had twice attempted to access his manager’s email system on 13 June, that such a finding would not justify his dismissal.

[64] The basis of this submission was that through the email access attempt recorded as referable to Mr Margelis’ router (which was of course denied), there had still not occurred a breach of the Alfred IT system. This was because “there was no flow of information, there was no reading or deletion or tampering with Mr Pasnin’s emails.” It was an offense against the Alfred’s policies, warranting “perhaps a final written warning, but not, in all the circumstances...summary dismissal.” (Mr D’Abaco TPN 5806).

Mr Margelis’ Service

[65] Strong reliance was placed on Mr Margelis’ service extending from 2003 during which his employment record was said to have been unblemished.

The s.387 Criteria

[66] It was said fundamentally, that there was no valid reason evident in the position adopted by Alfred Health In carefully reviewing the procedural steps taken by Alfred Health as applied to the considerations given at s.387, it was contended that the authorities require an employee, when matters are being put to them in relation to their performance or conduct, to be put on notice that they are facing the prospect of dismissal. (Mr D’Abaco submissions TPN 5813-14). The Alfred letters of 15 and 20 June were criticised on the basis that they did not refer sufficiently explicitly to termination of employment.

[67] Because dismissal itself was a consequence that was never in terms spelt out to Mr Margelis, it was said to be open to Fair Work Australia “...to find that it wasn’t made clear that Mr Margelis was facing a possible termination of his employment and in that regard there was a flaw in the procedural process outlined by the respondent” (TPN 5814).

[68] As to s.387(c), dealing with whether an employee was given an opportunity to respond to any reason related to the capacity or conduct of the person, while an opportunity to respond was given, very little material in support of his supposed misconduct was said to have been put to Mr Margelis. (Transcript PN5815). Complaint was made that despite being given the log file (Attachment MYP2 to Mr Pasnin’s Witness Statement, Exhibit A2) produced by Mr Pasnin, which was the document relied upon by the respondent, Mr Margelis was not then provided with broader access to Alfred’s full log server files - despite Mr Margelis asking for them in his solicitor’s letter given to Alfred Health on 23 June 2011.

[69] Although Mr Margelis’ counsel acknowledged (TPN 5816) that access was ultimately given by order of Fair Work Australia, such access was achieved only in the days leading up to the hearing. Particularly stressed was the fact that Alfred’s original view, that Mr Margelis had actually accessed Mr Pasnin’s email account, was changed to allege that Mr Margelis had twice sought to gain access to Mr Pasnin’s Alfred email account.

Mr Pasnin’s Evidence

[70] Under s.387(h) reliance was placed on excerpts of Mr Pasnin’s evidence and his account which had earlier, in turn, been relied upon by Mr Gardiner and Mr Goller as they went about making the final decision. Fair Work Australia was invited to place little, if any, weight upon the evidence given by Mr Pasnin by virtue of his comparatively poor technical qualifications, evidence said to be evasive and reflective of poor recollection, Mr Pasnin’s endeavours to keep the availability of the VPN logs (ultimately produced) beyond reach and Mr Pasnin permitting Mr Gardiner to believe that Mr Gardiner’s offer of making material available to assist Mr Margelis had been effective when, in fact, the offer was made to a mobile message bank attached to a phone Mr Pasnin knew had been handed in by Mr Margelis (TPN 5825-5829).

[71] It was submitted that the evidence had shown that contrary to what Mr Pasnin had said as to using his home computer over the weekend in question (that he had not used his home computer to go online at the Alfred system), that he had accessed the Alfred system with his computer and that significant quantities of material flowed between Mr Pasnin’s computer and the Alfred system. While this was put as a general submission as to Mr Pasnin’s credit, it was called up by Mr D’Abaco to support the somewhat tentative views expressed by Mr Roberts. Mr Roberts had questioned the log entries that related to Mr Margelis’ accessing his own emails and those efforts associated with Mr Margelis’ alleged attempts to access Mr Pasnin’s account potentially as having been artificially created; the result of a ‘cut and paste job’ (TPN 5843).

[72] It was part of the applicant’s case that there could not be certainty in this regard as the evidence was not such as to permit findings.

[73] It was also said to be relevant that Mr Pasnin did not reveal to Mr Margelis (or to Messrs Gardiner or Goller) that his, Mr Pasnin’s, email had twice been successfully accessed illegitimately on Sunday 12 June 2011. It was put that had the applicant known of the successful accessing of Mr Pasnin’s emails on 12 June, he (Mr Margelis) may have been able, in some undisclosed way, to investigate the 12 June access, argue that that person was responsible for the 13 June attempt to gain access, and to have been able to “respond more fully” to the Alfred’s allegation.

The Critique of the Alfred

[74] Mr D’Abaco posed a series of questions in relation to the treatment by the Alfred of the unauthorised accessing of Mr Pasnin’s email account. It was submitted that Mr Pasnin’s ‘investigation’ was desultory; that having traced one of the IP addresses linked to the illegitimate accessing to a public library, no further steps were taken, for example, to see if video tape existed of the library users. It was suggested that the inference was open that after Mr Margelis’ termination, Mr Pasnin “did not feel the need to do anything further”. (Exhibit M19, paragraph 52). Such incompleteness, and other examples were given, was seized upon by Mr D’Abaco to traduce Mr Pasnin’s investigation.

[75] Reliance was placed upon the unlikelihood of Alfred Health having given consideration when determining whether to dismiss Mr Margelis, to the applicant’s eight years service, said to be ‘unblemished’, and his impending nuptials in Greece. It was put in this regard that Mr Gardiner’s inability to recall considering these matters in the final employer caucus when engaged with his colleagues in considering the action to be taken, permits Fair Work Australia to conclude that these matters were not considered. Fair Work Australia was urged to decline to accept the evidence of Mr Goller that the more general considerations were considered in the final employer discussion as to penalty.

[76] Emphasis was also given to Mr Gardiner averring that no alternative to dismissal, no other form of disciplinary action was considered by Alfred Health.

[77] It was submitted that Mr Goller’s dogmatic and inflexible attitude, said to have been apparent in cross-examination, indicated a high-handed attitude that characterised Alfred Health’s approach to Mr Margelis’ dismissal.

Remedy

[78] Mr Margelis did not seek re employment, having purchased a business at the end of 2011. In seeking six months compensation it was put that such a sum:

[79] It was further put for Mr Margelis as to s.392(2)(e), that as a consequence of not working during the six months following his termination, some seven months wages lost and legal and forensic costs incurred were in the order of $65,000.

The Final Submissions for Alfred Health

[80] Alfred Health made extensive submissions supplementing the original argument that the dismissal was procedurally fair, substantively fair and reasonable given that the applicant was guilty of the clearly serious act of misconduct in having attempted to gain unauthorized access to his manager’s email account and for participation in the online discussion.

The Two Uncontested Facts

[81] Alfred Health submitted that after six hearing days, two uncontested facts remained. The first was that over the 2011 10-13 June Queens Birthday long weekend, there was, what the applicant’s specialist witness Mr McLeish termed, ‘unusual’ activity surrounding Mr Pasnin’s Alfred email account. Some of this activity was said to have resulted in unauthorised access and disturbance to the Pasnin email accounts and some attempted incursions which did not succeed in gaining access.

[82] The second Alfred Health uncontested fact was - that “the only ‘positive’ identification as to involvement with this activity has been that of a router belonging to the applicant, Mr Margelis” (Supplementary Outline of Respondent’s Submissions [hereafter SOORS] paragraph 13).

Mr Margelis’ Router

[83] Particular emphasis was placed by counsel for Alfred Health that irrespective of what else might be said of the evidence in this case, “the fact remains that Mr Margelis’ router was recorded on the log maintained by the respondent of access through its external Outlook Web Access system” (SOORS, paragraph 4).

[84] The case for Alfred Health postulated that there were only three possible explanations for Mr Margelis’ unique router ID number to appear as it did on the Alfred Health Outlook Web Access log referable to Mr Pasnin. These were that:

The Set Up

[85] The applicant gave evidence favouring the view that he was, or had been, set up. In Mr Margelis view this had occurred, in part, because in April 2011 he had lent support to queries made concerning his and other Alfred officer’s eligibility for an on-call allowance contained within the Agreement (Exhibit M13, Mr Margelis’ Witness Statement, paragraph 12 & 13). It was Mr Margelis’ view that Alfred Health was critical of his position in this regard.

[86] It was also said that Alfred Health was out ‘to get’ Mr Margelis because of queries with Mr Margelis’ certificates from his myotherapist relating to a lower back issue. Mr Margelis’ evidence was that upon being told by Mr Goller on 15 June 2011 of the allegation of serious misconduct he had said that he ‘wouldn’t be back’ (TPN 1586). Alfred Health emphasized as without foundation Mr Margelis’ evidence to the effect that, “... they were going to frame me, to put illegal software or inappropriate material on my computer” (TPN 1592), and “... that management is colluding with co-workers about me” (TPN 1582).

[87] The respondent pointed to a lack of evidence or motive to support such serious claims - that Mr Margelis was being set up or that there was collusion by Alfred Health management with co-workers. The witnesses of the respondent included those close to the termination, the decision-makers; Messrs Goller,  Gardiner and Pasnin. Although all were central to Mr Margelis’ suspicions, it was highlighted that they “were not cross-examined on any such alleged motive for fabricating evidence against Mr Margelis” (SOORS, paragraph 8). There was no evidence relating to co-workers colluding against Mr Margelis.

[88] Alfred Health took issue with the two explanations offered in the applicant’s case in support of the ‘set up’ theory. The first of these rejected by Alfred Health, to which I now turn, was Mr Margelis’ assertion that the Alfred’s data, relied upon by the employer in concluding that Mr Margelis had been involved in the attempt to access Mr Pasnin’s email, was questionable.

Interference with Data

[89] Mr A N Roberts, a specialist engaged by Mr Margelis, had given evidence regarding Exhibit MPY2, the Excel spreadsheet compiled by Mr Pasnin as a condensation of Alfred Health’s computer records, or logs, dealing with the long weekend incursions directed to Mr Pasnin’s email. Mr Roberts expressed concern as to the integrity of the data in Mr Pasnin’s spreadsheet and when in the box, had said (of Mr Pasnin’s spreadsheet) that the lines in the log which suggested Mr Margelis’ router was involved, looked as if they had been cut and pasted from another source (TPN 2561).

[90] In reply to Mr Robert’s criticisms, Alfred Health emphasised that Mr Roberts’ views were not adopted by either of the other experts, Mr McLeish or Mr Park.

Mr Pasnin’s Edited Spreadsheet

[91] Alfred Health submitted that Mr Pasnin had been open about the relevant lines of data presented in his spreadsheet, Exhibit MPY2, having been simplified and edited to make the information “more readily understandable...”, but “...not modified or interfered with in any way” (SOORS, paragraph 12).

[92] The Alfred’s principal rebuttal of Mr Roberts’ comment was based on Mr Robert’s view being limited by the information provided to him - the paper log compiled by Mr Pasnin. Mr Millar’s argument was advanced in this way:

The Theory of Spoofing

[93] It was the Alfred position that the suggestion Mr Margelis’ IP address had been used or given by another intruder to cast blame on Mr Margelis, and to hide the intruder’s true identity, was fanciful and unsupported by any evidence. Alfred Health had made an initial objection to the giving of evidence by Mr McLeish relating to IP spoofing, as the subject had not been detailed in Mr McLeish’s witness statement. The Alfred’s objection was rejected and the evidence permitted to be given. The first suggestion of IP spoofing had arisen, it seemed, as a result of Mr McLeish’s conversation with Mr D’Abaco on the day prior to Mr McLeish giving evidence, when, as might be expected, a discussion was being had between counsel and his client’s principal expert witness.

[94] Upon my permitting Mr McLeish to give his evidence as to IP spoofing it became clear that over some 15 years of police investigative work, including his forensic specialisation in IT fraud, Mr McLeish had:

[95] The Alfred case emphasised the considerable technical expertise required by spoofing “for an isolated attempt to gain entry on the Monday afternoon of 13 June 2011. If a person had been seeking to set up Mr Margelis in this way, then presumably the access via this “spoofing” method would have been used on other occasions throughout that weekend” (SOORS, paragraph 19).

The Spoofing Theory Applied To The Chronology

[96] The events of 13 June 2011 were said by the Alfred to render the spoofing theory inherently improbable. In this regard the relevant Alfred Health computer log records Mr Margelis’ router as engaged in or connected with the following activity on the afternoon of Monday 13 June 2011:

[97]  The respondent highlighted that the attempts to gain entry to Mr Pasnin’s emails ‘sandwiched’ Mr Margelis’ successful entry to his email system in-box. The Alfred submission was that the ‘spoofer’ would have to have not only used Mr Margelis’ router address number but to also have known the router password and further, to have gained access to Mr Margelis’ account with its code name and password. Mr McLeish agreed in cross-examination that “...if a spoofer were involved, it was somebody who was successfully able to get into Mr Margelis’ account and then unsuccessfully try to get into Mr Pasnin’s account?” (TPN 712).

As To The Alfred’s Investigation Being Inadequate

[98] The Alfred contended that Mr D’Abaco’s critique of the respondent’s investigation, on the ground that it overlooked spoofing, lacked any credible basis. As the evidence favouring Mr Margelis’ involvement was said to be clear and unambiguous, it was submitted that there was no need for Alfred Health to go into ‘obscure internet based theories’ (SOORS, paragraph 22). It was put that the inherently improbable spoofing idea does not bear upon Fair Work Australia’s analysis on the balance of probabilities.

[99] It was said that there is no motive for Mr Margelis to have been ‘set up’ and no sound basis for concluding that this had occurred.

An Unfortunate Coincidence

[100] The Alfred’s final submissions dealt with an alternative explanation to those previously dealt with, (that Mr Margelis had been ‘set up’ or that he was involved in the illegitimate activity). The alternative explanation was that another person “not attempting to frame Mr Margelis on behalf of Alfred Heath”, may have accessed Mr Margelis’ router and attempted to gain access to Mr Pasnin’s account.

[101] Alfred Health relied upon Mr Margelis’ evidence in this regard; that the router at his home does not have a sufficiently powerful signal to be picked up or accessed by a passer-by or someone not in the house or in the driveway (TPN 2347). Mr Margelis’ evidence was that no one could have “dropped by and picked it up” (TPN 2352) and further, as to access to his router, that “it needs authentication of a 36 pin character” (TPN 2349).

[102] Given that it was Mr Margelis’ further evidence that his iPhone had not been connected to the internet on 13 June 2011, that there were no other devices being used which were connected to the internet, no visitors or persons in the house over the period (other than Mr Margelis’ then fiancé and his brother-in-law), it seemed that there was no basis for suggesting an ‘outsider’ had gained access through Mr Margelis’ router.

[103] Should another person, neighbour or person nearby have, notwithstanding the formidable difficulties outlined above, somehow have gained access through Mr Margelis’ router, there remained no explanation why such a person would seek to gain access to Mr Pasnin’s email account. That the activity of such an opportunistic the intruder was not devoted to some entirely extraneous purpose, and rather, was devoted to endeavouring to gain access to an email account of Mr Margelis’ superior officer at his place of work was said to be entirely without credibility.

Mr Margelis’ Involvement

[104] The respondent’s principal submission was that the evidence pointed to the only credible explanation for the events in question being that Mr Margelis was involved.

[105] This was said to be the only conclusion realistically capable of being reached when it was considered that:

[106] Alfred Health relied on Mr Margelis’ evidence that he had wanted to know what Mr Pasnin was doing and why Mr Pasnin was ‘cloning’ Mr Margelis’ computer (TPN 1940-41). Alfred Health argued that with this in mind it was not surprising that later in the same weekend Mr Margelis sought to gain access to Mr Pasnin’s email account (SOORS, paragraph 28).

[107] The sequence and timing of activity reflected in the Alfred Health log of Mr Margelis’ router activity reveal that Mr Margelis’ logged on to his Alfred Health email account at 3:38:20 to 3:38:22 when the log then reflected the further attempt to enter Mr Pasnin’s account from or through Mr Margelis’ router thirty seconds later at 3:38:52 pm.

[108] It was also argued that the person attempting to make the unauthorised access via Mr Margelis’ router, on Monday 13 June, “had prior knowledge of the workings of Mr Pasnin’s account”, and it was noted that, “The extended period of access on Sunday 12 June 2011 was to the very same subfolder as the attempted access on Monday 13 June 2011” (SOORS, paragraph 31).

[109] The failure of Mr Margelis was noted, notwithstanding the extensive and expensive efforts he had gone to ‘to clear his name’, to take ‘relatively obvious steps’ to lend support to his case. These included that Mr Margelis had not produced his laptop’s log file that would confirm the events of the afternoon of 13 June 2011. Further attempts to obtain similar records from his own internet service provider had not been pursued ‘despite initial enquiries’ (SOORS, paragraph 32).

[110] Alfred Health submitted that given Mr McLeish had taken an ‘image’ of Mr Margelis’ home computer shortly after the termination, which could have been checked to see “if Mr Margelis’ computer indicated activity different from that shown on the Alfred logs...He could have looked at the image to help establish whether there had been spoofing” (SOORS, paragraph 33). This had not occurred.

[111] It was submitted that Mr Park’s evidence allowed for a second computer being involved. Alfred Health submitted that even had there been a second computer availing of Mr Margelis’ router, it was located at his house to permit access and required the router authentication code. The possibility of a second computer being involved was said by Alfred to in no way exculpate Mr Margelis (SOORS, paragraph 34).

The Employer’s Conclusion

[112] The case for Alfred Health centred upon the likelihood, on the balance of probabilities assessment, that of the various possible explanations the more likely was, and is, that Mr Margelis was involved in the attempt to gain access to Mr Pasnin’s email system. To the assertion that Mr Margelis was not personally involved, it was put that “it seems clear that he knows additional information about what happened which he has chosen not to share with his employer. His involvement in the activities that weekend is the most likely explanation as to why his electronic fingerprint has been left on the illegitimate accessing” (SOORS, paragraph 35).

The Investigation

[113] To the suggestion that the investigation was deficient, particularly in the light of the various specialist reports now gathered for the conduct of this case, Alfred Health said that in the light of the evidence then available of the involvement of Mr Margelis’ home router, a relatively straightforward analysis was at the time justified, and when engaged in, led to the conclusion that Mr Margelis had been involved in serious misconduct.

The Reason Originally Given

[114] Alfred Health relied upon the decision of a number of authorities, particularly that of the Full Bench in MM Cables (A Division of Metal Manufactures) v Victor Zammit (Print S1806), as support for the proposition that the “allegations ultimately sustained in an unfair dismissal proceeding may well differ from the precise nature of the allegations at the time of termination” (SOORS, paragraph 37).

[115] Applied to this case it was put that the applicant could not rely upon a technical defence to argue that the exact grounds in justification put by the employer at the time had not been made out. For Alfred Health it was entirely sufficient for the evidence to show a valid reason - which need not necessarily be a ‘carbon copy’ of the reason given at the time of termination.

The Online Conversation

[116] The respondent placed emphasis also on the lewd and insulting internet messaging conversation had between Mr Margelis and the SDE. Alfred Health submitted that Mr Margelis’ approval of the comments made by the SDE reflected misconduct, which while of itself not decisive, was quite properly taken into account by the Alfred and supported the decision to terminate.

Aspects of Little or No Relevance

[117] The respondent acknowledged the different views as to access, versus attempted access, held by the principal witnesses. While Mr Pasnin alone held to the view that Mr Margelis’ activity on Monday 13 June did involve access to his (Mr Pasnin’s) email account, not just attempted access, it was clear from the evidence of both expert witnesses, Messrs McLeish and Park, that that was not so. It was their view that the activity emanating from Mr Margelis’ router could only be described as attempted access.

[118] It was also said to be of no relevance whether Mr Margelis was involved in the activities that saw both successful and unsuccessful access attempts upon Mr Pasnin’s account on Sunday 12 June 2011. This was despite the Alfred’s view that it was “entirely probable” that Mr Margelis was involved in that activity which had led to the deletion of significant parts of Mr Pasnin’s email accounts (SOORS, paragraph 49). It was said to be an irrelevant issue because Mr Margelis was not dismissed for the email deletion.

[119] The emphasis within the applicant’s case, particularly as to querying Mr Pasnin’s role, was said by the respondent to be either irrelevant or unimportant. Whether Mr Pasnin’s home computer was configured, as he averred, to automatically access the Alfred system was said to be ‘a classic furphy’ (SOORS, paragraph 55) because even should one conclude that Mr Pasnin had accessed the Alfred system over the weekend in question, him doing so does not explain how Mr Margelis’ router ‘Fingerprint’ was left on the OWA log in question.

[120] Much of the applicant’s case was said by Alfred Health to have been taken up with distractions that do not bear on the explanation or lack of explanation for Mr Margelis’ attempt to access his employer’s email system.

Distinctions

[121] For the Alfred, an attempt to gain access was as serious as having gained access to an employer’s email. For the Alfred, “it was the wrongful intention to access the e-mails of Mr Pasnin which attracts reprobation, rather than whether he was successful (sic) able to do so” (SOORS, paragraph 45). The Alfred Health case in this regard was that the attempt was:

[122] Alfred Health submitted generally, quite apart from any policy stipulation, that such an act was wrongful - as indeed was acknowledged by Mr Margelis in several different ways and that such an act could lead to dismissal (TPN 1896-97).

[123] Mr Millar emphasised for the Alfred that Mr Margelis’ position, as a senior IT operative, with ‘administrator’ access, enjoyed by few, meant he had a broad access and knowledge of the Alfred system. This was said to reflect the trust of the employer, which had been breached. It was the breach of trust which in Mr Goller’s evidence supported his decision to terminate. Mr Goller’s evidence was that his decision to terminate would have been the same had he thought, at the time, that Mr Margelis had unsuccessfully sought to gain access to his manager’s email system (SOORS 47).

The Misdescription of Mr Margelis’ Electronic Device

[124] As set out earlier, it had been the respondent’s initial thought that Mr Margelis had used his iPhone in the questioned transactions. Alfred did not accept that the responsibility for this impression reflected the employer’s error. Alfred Health relied on the fact that the notes of the 20 June 2011 disciplinary interview, taken by Mr Margelis’ representative/friend, Mr Katsiris, indicated that it was Mr Margelis who had created an original “impression that his iPhone had the IP address concerned, rather than the router” (SOORS, paragraph 51).

[125] It was the respondent’s submission that it did not matter which of Mr Margelis’ devices, iPhone or laptop, was used in the attempts of 13 June or that the letter of termination incorrectly referred to the iPhone and did not refer to the internet router as the medium through which the attempt passed electronically.

Remedy

[126] As Mr Margelis did not ultimately seek reinstatement, Alfred Health submitted that compensation ought not be given because:

[127] It followed that any compensation that might be awarded be reduced by reason of Mr Margelis’ failure to mitigate.

[128] As to s.392(3) it was suggested, in the alternative to the respondent’s primary positions, that because Mr Margelis’ misconduct contributed to the decision to dismiss, the compensation which might otherwise be awarded should be reduced accordingly.

Mr Margelis’ Right of Reply

[129] The reply for the applicant stressed that this was not a simple case. In the applicant’s view, the respondent had illegitimately conflated the events relating to Mr Pasnin’s email which had occurred on Sunday 12 June and Monday 13 June 2011. The conflation was that while Alfred Health had not the ‘foggiest’ idea of who was responsible for the two successful incursions into Mr Pasnin’s email account on Sunday 12 June, and the seven unsuccessful attempts to gain access over the period in question, the two unsuccessful attempts of 13 June emanating from Mr Margelis’ router were rolled into the earlier occasions. Where Mr Millar had spoken of the details of the allegations against Mr Margelis having evolved during the investigation process, Mr D’Abaco submitted the allegations made against Mr Margelis had changed. The ‘change’ was explained as being the result of the McLeish and Park reports.

[130] The subject of particular criticism by Mr D’Abaco was the Alfred Health investigation. It was put for the respondent that the procedure undertaken on 20 and 23 June was window-dressing, arranged by the human resources specialist, Mr Goller. In this respect Fair Work Australia was asked to form a view on the basis of all the evidence and information available at arbitration, objectively determined, rather than consider what may have been reasonably open to the Alfred Health management. Thus was Mr Millar’s submission as to the ‘defensibility’ of the employer’s actions investigating the events in question criticised.

The Investigative Failure

[131] It was put for Mr Margelis that the respondent had failed to investigate the ‘unusual activity’ (to adopt Mr McLeish’s term) occurring over the long weekend in relation to Mr Pasnin’s email account. Mr D’Abaco emphasised that the investigative process should have extended to the 23 June 2011 dismissal date. Note was also taken that there had been limited data analysis conducted by Alfred Health, particularly into the events of 12 June 2011 when there had occurred the successful and unsuccessful attempts to gain entry to Mr Pasnin’s email account. Mr D’Abaco put the argument in this way:

The Failure to Produce Mr Margelis’ Computer Logs

[132] Mr D’Abaco responded to Mr Margelis’ failure to produce his home computer logs by arguing:

[133] It was said that the allegations ‘which now found the dismissal’ had become apparent as the applicant’s case only through the course of the hearing, so that “the fact that that material has not been provided is explicable in all the circumstances”.

[134] In explanation for Mr Margelis’ router having been recorded as involved in the Pasnin email incursion attempts the applicant submitted that “...it is not necessary for the applicant to go so far as to have to provide an explanation as to how it occurred. Ultimately, the reasons for dismissal lie with the respondent...” (Mr D’Abaco, TPN 6260).

[135] The applicant’s case asserted that there was doubt or uncertainty surrounding the suggestion that Mr Margelis attempted to access Mr Pasnin’s email account and, were Fair Work Australia to be against the respondent on that issue, “...that (attempted) access on two instances was not sufficient to warrant his summary dismissal for what is in effect termed by the respondent “serious and wilful misconduct”. (Mr D’Abaco, TPN 6260).

[136] In relation to spoofing, Mr Margelis’ case in reply did not accept that such a possibility was fanciful. Spoofing as an explanation was put by Mr D’Abaco as lying “within the realm of possibility, albeit very much at the lower end of the spectrum” (TPN 6261).

[137] It is important to note the elucidation given by the applicant’s case in reply as to spoofing. First, the applicant’s reply made clear that the issue of spoofing was not advanced as part of its critique of the Alfred Health investigation.

[138] What was being advanced was the possibility of spoofing as the reason for Mr Margelis’ IP router appearing on the relevant Alfred Health logs. The two allied points were put in this way:

[139] A response was also given to the Alfred’s submission as to the unlikelihood of an unknown third party having surreptitiously gained access to Mr Margelis’ home router on Monday 13 June so as to have sent the offending access request seeking entry to Mr Pasnin’s email. The applicant’s reply was that Mr Pasnin was not only Mr Margelis’ boss but that he supervised some fifty other Alfred IT staff.

[140] It was part of the Alfred Health case also to highlight that the attempts to enter Mr Pasnin’s emails were specific, in that principally they sought access to a folder which did exist within his email configuration, ‘/ITS/Mgmt/Mark’. In reply to the respondent’s description of such an attempt as ‘focussed’, it was put that there had been no evidence led that Mr Margelis had knowledge of Mr Pasnin’s email configuration. On the evidence before Fair Work Australia, of Mr Margelis’ knowledge of the Pasnin email layout, it was said to not be available to Alfred Health to put such an allegation.

Mr Margelis’ Denial

[141] It was put for the applicant that Mr Margelis’ denial of the charge of improper use of the system, in him seeking access to Mr Pasnin’s account, was absolute. Mr Margelis had denied entirely the Alfred Health hypothesis, that he, having been advised by his Caulfield campus workmate Mr Avci shortly after 2:00 am on Saturday 11 June 2011 that Mr Pasnin had at that very late hour taken an image of Mr Margelis’ work computer, had determined to see what Mr Pasnin knew by interrogating Mr Pasnin’s emails. Mr Margelis was described as having given straightforward, calm, emphatic and non-rancorous evidence which was believable and should be believed by Fair Work Australia. It was put that to find for Alfred Heath was necessarily to make a finding negative to Mr Margelis’ credit.

The Insinuation From the 12 June Accessing

[142] Mr D’Abaco made much of the successful accessing of Mr Pasnin’s account on Sunday 12 June. The question was posed, ‘If Mr Margelis had been the person who had successfully gained access to Mr Pasnin’s account ‘/ITS/Mgmt/Mark’ (and others) as someone had done on 12 June, why would they go back there the next day?’ It was said not to make sense, not least because Mr Margelis was not guilty of either of the 12 June access and attempted access and the 13 June attempted access.

[143] Again, it was put that “attempted access, is (a) uncertain at best, and (b) even if it were to be made out, did not justify summary dismissal” (TPN 6300). The apparent concessions gained from Mr Margelis in cross-examination, as to the action of an employee seeking to gain access to his superior’s email being serious and reflecting misconduct potentially justifying termination of employment, was said to be of no account; that question being a matter for Fair Work Australia.

[144] In a number of respects Mr Pasnin’s evidence was said to be unreliable - for example, as to Mr Pasnin having accessed his emails over the period in question and Mr Pasnin’s odd insistence (against the experts) that Mr Margelis had successfully accessed Mr Pasnin’s emails on 13 June.

[145] Mr D’Abaco did not allege that Mr Pasnin had sought to ‘set up’ Mr Margelis, saying, “...as a member of counsel I can only put that sort of allegation on clear and cogent material. I accept that that clear and cogent material does not exist” (TPN 6303).

Consideration

The Post-Case Approach to Fair Work Australia

[146] As already indicated, following the last day of hearing and reservation of decision on 14 March 2012, correspondence was received addressed to me from solicitors representing Mr Margelis. The correspondence of 15 March enclosed some 48 pages of what were said to be “Mozilla log files for our client’s laptop for the day 13 June 2011.” Seeking for the material to form part of the case, the solicitors for Mr Margelis relied on s.590(1) of the Act providing that Fair Work Australia could inform itself in such manner as it considers appropriate. The content of the ‘log files’, which named the particular sites visited by Mr Margelis, was sought to be not disclosed by Fair Work Australia.

[147] The solicitors for Alfred Health responded in correspondence to me on 16 March that:

[148] The respondent’s solicitors opined that it was highly improper for the applicant’s solicitors to address me seeking to supply and introduce additional materials after evidence and final submissions. As to the applicant’s solicitor’s claim that it could not have been anticipated by the applicant that submissions would follow the absence of logs in the applicant’s case, the respondent’s solicitors drew attention to the applicant being cross-examined on the provision of logs outside the respondent’s control. Further, correspondence to Optus of 18 January 2012 was nominated, dealing with the applicant’s desire to obtain logs of computer activity. It was said that the applicant and his legal representatives had had ample opportunity to produce material supporting the applicant’s claim and had not done so, even with the benefit of legal representation.

[149] On 19 March Mr Margelis’ solicitors again wrote to me indicating:

[150] On 20 March 2012 Alfred Health’s solicitors responded stating that:

[151] It was my view that in fairness to the respondent the material ought not be admitted after such detailed, often technical cases had been closed, decision reserved and when there had been more than ample opportunity for a complete record or statement of the relevant activity within Mr Margelis’ laptop to have been submitted had it been the desire of Mr Margelis to do so. In this regard I was mindful that Mr McLeish had made an image of the contents of Mr Margelis’ laptop early in his enquiries on behalf of the applicant. The machine’s activity on 13 June was entirely available for his examination, never having been under the control of Alfred Health. Relatively few entries required review, over a short time-frame. Mr Margelis knew that his iPhone had not made any relevant connection to, or through, the router at his home on 13 June 2011. On Mr Margelis’ evidence no further devices, other than the laptop, were linked to the router and no visitors used the router access to the internet on that day.

[152] I was mindful also that the case for Mr Margelis had been a fundamentally forensic one from its inception, as evidenced by the material from Messrs Roberts and Coulthart - with Mr Margelis commissioning examination of his iPhone, with a subsequent report and then having Mr McLeish institute his in situ review of the complete Alfred Health logs relating to Mr Pasnin’s exhibit MYP2.

[153] Against this backdrop it seemed to me that regard should not be had for the questioned ‘Mozilla’ material after decision had been reserved without the benefit of full examination and submissions. This was so in my view when the relevance of such material, in the possession at all times of Mr Margelis, was, or should have been apparent from first familiarisation with the facts. I was also mindful of the likely strength of the points sketched in opposition to the material being produced. It seemed to me that there was force in the view of Alfred Health’s solicitors, that the Mozilla system, said to have been an internet browser also installed on Mr Margelis’ laptop (and which had been mentioned in the evidence), was not the system likely to have been involved in the attempted access through Mr Margelis’ router. In this regard the case had been conducted on the basis deriving largely from Exhibit MPY2, which had not suggested that the internet browser or program (whatever be the correct nomenclature) used to seek access to Mr Pasnin’s emails was Mozilla. There had been many opportunities to challenge this view or raise additional matters.

[154] In declining to open debate on the sites visited by the applicant, and sought by Mr Margelis’ solicitor to not be divulged, and times of visits reflected in the Mozilla browser material, I had regard for the objections of Alfred Health and concluded they were persuasive. Had the Mozilla browser material been admitted, the case would not only have been re-opened, it would have been substantially broadened as it appeared to me to be highly likely for it to have then been necessary for the experts to re-investigate and prepare reports on the questioned Mozilla (and any other browser) material, the activities and times involved and, of course, give evidence and be cross-examined.

[155] I was also mindful in this regard for Mr D’Abaco’s emphatic submission that, insofar as his client’s legal and forensic costs were concerned, Mr Margelis’ resources were spent. My understanding is that the access attempts subject to such close scrutiny in this case using Mr Margelis’ router, utilised Outlook Web access - not Mozilla. Only Mozilla detail from Mr Margelis’ laptop was sought to be introduced and then only for 13 June, not including 12 June. As more than one device can avail of the router in gaining web access, the record of Mozilla activity, even if found to be complete and to cover all Mozilla sponsored web based activity of 13 June may well have proved inconclusive unless all the laptop activity had been revealed. It was my understanding that no events relating to Mr Margelis’ laptop using Outlook web access were produced in the solicitor’s material. I felt this to be curious given that Mr Margelis had sponsored the report of Mr A N Roberts (of 5 July 2011) in which it had been concluded that “The entries using Outlook Express were the entries logging into the “Y. Pasnin” account” (Exhibit M10, paragraph 8). Mr Robert’s report advised that, in his view, the material reviewed referable to the questioned activity associated with the router contained entries from “at least three different devices; an iPhone, a computer using Mozilla (Web Browser) and Microsoft Vista, and a computer using Outlook Express, Microsoft Internet Explorer and Vista” (Exhibit M10, paragraph 8).

[156] Mr Robert’s view and all the associated material had been readily available to Mr Margelis, and potentially, to Mr McLeish. Mr D’Abaco did not identify with the request for admission of the Mozilla material. Having regard for all these matters I determined to not re-open the case by admitting the material.

The Alfred Health Investigation

[157] I turn now to consider the applicant’s criticism of the investigation. It is said that the investigation would have benefitted insofar as Mr Margelis was concerned, by including the events of Sunday 12 June - the day of the first attempts to gain access and the only day of the gaining of access. Without requiring the investigative finesse of the employer to be the equal of a police enquiry, it is not easy to understand the segmented approach which was seemingly adopted by Mr Pasnin.

[158] By this I am referring to Mr Pasnin not having told Mr Gardiner of both the attempted and the successful incursions which occurred prior to those attempts related to Mr Margelis’ router. I have considered the argument of the applicant that had Mr Margelis been told of the early entries and attempted entries his reply to the Alfred in the events of 13 June may have been different and his ‘enquiries’, presumably into the source of the incursions, may have benefitted. There was nothing specific put in these regards.

[159] While Mr Pasnin’s segregation of the incursions (by which expression is included the attempts to gain entry) to distinguish those from Mr Margelis’ router and those not, is understandable, it is not easy to understand why Mr Gardiner had not been told of the incursions of Sunday 12 June from the unknown routers. After all, there had been successful entry achieved, a security breach for the Alfred of the highest moment.

[160] One must recall that Mr Margelis was asked to explain his home router’s IP address appearing on the Alfred logs as the source of the 13 June access attempts. Mr Margelis denied knowledge of any attempts to gain entry to Mr Pasnin’s email accounts. It is true that Alfred Health wrongly linked the attempts with Mr Margelis’ iPhone, whether encouraged by Mr Margelis’ responses in the interviews or not. Any effort to link the earlier incursions to Mr Margelis and have Mr Margelis appear responsible or answer for those events would have been criticised - and rightly so.

[161] It must also in my view be appreciated that as soon as Mr Margelis denied any knowledge of how his router’s unique IP number could have been associated with an attempted incursion or of any knowledge of such attempts, one can appreciate that Alfred Health may not have wished to appraise Mr Margelis in detail of any further knowledge possessed by Alfred Health as to the earlier attempts.

[162] In my view Mr Margelis was notified of the allegations against him, which constituted the reason for his dismissal as referred to in s.387(b), even though his iPhone was given, incorrectly, as the conduit between his home router and the Alfred Health site housing Mr Pasnin’s email accounts. Mr Margelis’ evidence in this proceeding established very clearly that Mr Margelis understood that an employee’s surreptitious entry to their employer’s email correspondence and files, or an attempt to achieve such entry, was a very serious offence and that it breached Alfred Health’s relevant policy.

[163] In my view the chronology of events establishes that Mr Margelis was given an opportunity to respond to the reason which related, in this case, to his conduct. Indeed, the notes taken by Mr Katsiris, Mr Margelis’ support person, have been of real assistance in the case. Mr Katsiris’ witness statement (Exhibit M8), contains his notes of the meetings held between Mr Margelis and Messrs Gardiner, Goller and Pasnin on 20 and 23 June 2011. I have noted that Mr Katsiris’ record of the meeting of 20 June records Mr Margelis as having initially denied that the IP address which related to his home router was his. Mr Katsiris notes read, “I did not hack into (sic) this not my IP Address” (Exhibit M8, attachment JK1, page 2). Mr Margelis was later content to acknowledge the IP address as his and his evidence was that he had not denied the router was his. Mr Katsiris’ notes of 20 June record Mr Pasnin putting to Mr Margelis that, as to the 13 June log-ins, the “signatures come back from your address” and then notes Mr Pasnin as making the associated point, “IP address belongs to the iPhone” (Exhibit M8, attachment JK1, page 3).

[164] There was some comment during the case from Alfred Health that Mr Margelis, knowing as he did that the iPhone had not been used to make email access via the router, had not made mention of other device/s linked to the router.

[165] While there can be no doubt that the emphasis at the first meeting on 20 June was on Mr Margelis having used his iPhone, Mr Katsiris’ notes record Mr Pasnin as having queried Mr Margelis over his activity on Saturday morning 11 June. Mr Katsiris’ notes attribute to Mr Pasnin the comment:

[166] This was said to have introduced the fact of a device other than an iPhone being also involved; that what was put by Alfred Health did not rely solely on an assertion that the iPhone was used. It is true that later the employer did focus on the iPhone.

[167] It is clear that as to s.387(d) there was no unreasonable refusal to permit a support person to be present and I have noted that Alfred Health’s correspondence to Mr Margelis strongly recommended he have a representative present.

[168] I have also concluded that, referable to s.387(c), Mr Margelis was given a chance to review the material summarised by Mr Pasnin in the spreadsheet MYP2 and to respond. As computer specialists all, Messrs Margelis, Pasnin and Gardiner, I have taken it that they would have realised that the range of information selected by Mr Pasnin to include in the spreadsheet was but a small part of the very extensive information regarding the transactions captured by the Alfred Health system (the server logs), as the system is monitored and, amongst other things a record made of who comes calling.

[169] Mr Park’s evidence made clear that Mr Pasnin had been sensibly selective in his aggregation of relevant information for inclusion in the spreadsheet compiled for the purpose of discussion with Mr Margelis. It became clear that the relevant records include many thousands of lines of information (if ‘lines’ be the correct term) and that the massive amounts of information required editing.

The ‘Set Up’

[170] I have not accepted that Exhibit MYP2 is flawed by means of Mr Pasnin having manipulated the information it records or by it ‘editing’ or excluding information or by having it include information intended to mislead, by having included information intended to misrepresent the incursions or to wrongly implicate Mr Margelis. The fact is that Mr McLeish, having access to the full Alfred electronic records, the logs of the events in question, makes no such claim against Mr Pasnin’s document. One can be quite confident that any indication suggestive of Mr Pasnin having altered the records to present a slanted or false impression would have been immediately, and quite properly, brought to notice by Mr McLeish. I have also no doubt that, similarly, had Mr Park’s investigation unearthed any suspicious entry suggestive of manipulation of the data captured in the logs by Mr Pasnin he would have given it immediate prominence. There was no such suggestion from either of these experts and taken as a whole their evidence was to the contrary. I have not regarded either’s evidence as particularly partisan.

[171] What Mr Park’s evidence did make clear was the need for Mr Pasnin to have provided a summary document like Exhibit MYP2 by reason of the thousands of lines of information captured by the Alfred’s logs.

[172] There is, it must be said, no evidence challenging the link to Mr Margelis’ router or indicating that Mr Pasnin has altered or sought to ensure the evidence wrongly points to Mr Margelis. I have found the access attempt of 13 June 2011 linked to Mr Margelis’ router did originate from Mr Margelis’ home router and that no evidence has been adjusted or altered to wrongly or falsely implicate Mr Margelis.

[173] As to the notion that Mr Pasnin may have sought to ‘set up’ Mr Margelis I have noted Mr D’Abaco’s submission that no such allegation was able, on the evidence, to be made (TPN 6303). That said, there were several curious aspects of Mr Pasnin’s evidence. These included Mr Pasnin not having told Mr Gardiner of the fact of the successful incursions, Mr Pasnin’s insistence that successful entry had been achieved by the interloper on Sunday 13 June, the unimpressive episode of the telephone message left by Mr Gardiner and Mr Pasnin having over the weekend accessed his office email accounts, downloaded information and then sought to deny that he had done so. Had it been necessary to rely on Mr Pasnin’s evidence on a key point where there was persuasive contrary evidence I would not have been inclined to accept Mr Pasnin’s uncorroborated version of events. In reaching the necessary conclusions required in this case I have not had to do so.

Mr Margelis’ Evidence

The Basis for Determination

[174] By virtue of the specialist, expert evidence before Fair Work Australia, much of it agreed, there exists in this case a body of information, relevant to Mr Margelis’ router and the attempts to gain access to Mr Pasnin’s email account on 13 June 2011. Simply put, there is no basis upon which the link between Mr Margelis and the attempts of 13 June can be disregarded or thought not to the responsibility of Mr Margelis.

[175] It is true as forcefully put by Mr D’Abaco, that Mr Margelis did present as a calm witness who simply denied any wrongdoing, and who accepted readily (too readily for Mr D’Abaco) the seriousness and likely employment implication for an employee who sought by some unofficial or dishonourable means to gain access to their employer’s email accounts and folders.

[176] At the time of his dismissal and shortly after, Mr Margelis claimed to have been ‘set up’ and the victim of manipulated records falsely or wrongly indicating his connection with the attempt to gain access. An illustration of this belief was Mr Margelis’ evidence concerning ‘hidden text’ in the spreadsheet containing the summary of the Alfred’s logs over the period, (Exhibit MYP2).

[177] Mr Margelis’ Witness Statement, Exhibit M13, contains the following passage, referring to Exhibit MYP2, a copy of which was given to Mr Margelis at the meeting of Monday 23 June 2011.

[178] While Mr D’Abaco was at pains to indicate that this matter - the startling revelation of ‘secret text’ implicating Mr Pasnin - formed no part of the case as finally put, I have considered Mr Margelis’ evidence concerning secret or hidden text of some relevance. Although the experts jointly averred that Mr Margelis’ view, that there could be ‘hidden text’ in the document reviewed by Mr Margelis was simply wrong, because the document was a copy - its electronic link with the original having been broken, for Mr Margelis it was proof positive that the document and Mr Pasnin’s enquiry was a sham. It was very curious that no copy of the incriminating page discovered by Mr Margelis showing “Yann” (for Yann Pasnin) as ‘hidden text’ and responsible for the entries the subject of Mr Margelis’ dismissal, was tendered. Mr Margelis’ account and the inexplicable failure to provide a copy of what would have been such a telling indication of Mr Pasnin’s involvement in producing fake material against Mr Margelis’ interests, has done nothing to enhance Mr Margelis’ credibility. In the context of the non-provision of this page, I am also mindful that Mr Margelis’ explanation of the lengthy period when he had returned from Greece and prior to the case coming on, was that he was researching the case.

The VPN Files

[179] Some time was taken up in examining the various systems of communication which exist at Alfred Health. Ultimately these files and the different capacities for system interrogation available to the employees involved in this case have not shed light on the key events required to be considered as to the events of 12 and 13 June 2011.

The Evidence of Mr Park and Mr McLeish

[180] As observed already, in large measure the evidence of these highly credentialed specialists was consistent. I have already indicated Mr McLeish’s position as to a number of issues and that generally I have relied upon his evidence. It will also be of assistance to note Mr Park’s evidence on several key issues.

[181] Mr Park, a Chartered Accountant, holds a Graduate Certificate in Fraud Investigation and currently practices in the area of forensic technology investigation, data analysis and data base design. Mr Park, also holding degrees in law and commerce, indicated that he had read the Victorian Supreme Court Expert Witness Code and agreed to be bound by it.

[182] Mr Park indicated that he understood his role as “to provide independent computer forensic expert assistance in relation to technology issues arising from this matter” (Exhibit A4, Mr Park’s Statement).

The Attempts of 13 June 2011

[183] Mr Park’s examination of the Alfred Health audit logs permitted him to reach similar conclusions to those of Mr McLeish. I propose to avoid unnecessary repetition by dealing with Mr Park’s summary. Mr Park’s evidence was that his review revealed Mr Margelis’ router was recorded as having initiated the electronic request for the server to endeavour to access a subfolder within Mr Pasnin’s email account. This request was made via Mr Margelis’ home router at 3:31:11 to 3:31:12 pm on the Monday afternoon, 13 June 2011. The request was denied, possibly, according to Mr Park, owing to Alfred’s authentication requirements, because the valid user ID and password combination were lacking (TPN 4960).

[184] Some seven minutes later Margelis’ home router was the indirect source of a further request, this time to Mr Margelis’ Alfred Health email account. This access extended for two seconds as the logs record, from 3:38:20 to 3:38:22. In my view it is more probable than not that Mr Margelis rather than a spoofer or passerby was operating his home laptop because the confirmed connection recorded in the log reflects connection and no error codes. This is a consequence, I have concluded, of Mr Margelis successfully advising his user ID and secret password. It will be recalled on Mr Margelis’ account there was no other person or device utilising his router on that day.

[185] Mr Park’s evidence was that thirty seconds (3:38:22 to 3:38:52) after the successful access of Mr Margelis’ own email account a further attempt was made from or via Mr Margelis’ router, to gain access to Mr Pasnin’s email folder. This occurred at 3:38:52 seconds to 3:39:02 seconds. A further, or possibly a continuing attempt, also unsuccessful, was made to access Mr Pasnin’s email account via Mr Margelis’ home router at 3:43:47 pm. In my view on the balance of probability these transactions were the result of Mr Margelis using his laptop or some other device to seek to access Mr Pasnin’s email account via the router known to be that at Mr Margelis’ home.

[186] I have noted that the email accounts of Mr Pasnin sought to be accessed on both occasions on 13 June were to the email folder “/ITS/Mgmt/Mark”. There had occurred four attempts to gain access to Mr Pasnin’s email account earlier on that day, 13 June, all of which were unsuccessful. All were from a router whose IP number is known but whose owner is unknown. All four of the earlier attempts that day had sought to access the same Pasnin email folder. That folder was “/ITS/Mgmt/Mark”. Of the two successful and three unsuccessful attempts to access Mr Pasnin’s email system on Sunday 12 June, all five sought access to “/ITS/Mgmt/Mark” while the successful intruder also accessed other folders. Both successful incursions, where material was opened and read, accessed a file marked “ITS/Mgmt/?” where ? represents the first or given name of the female employee the subject of the rape comment in the SDE and Mr Margelis’ online conversation.

[187] Mr Park’s evidence was that, like Mr McLeish, he was provided with the full OWA log of Alfred Health in electronic form, which appeared to be complete and which, insofar as the much queried Pasnin spreadsheet condensation of the relevant matter, Exhibit MYP2, appeared free of any indication of interference (TPN 5002). It became clear from Mr Park’s evidence that the information held within the Alfred Health logs (the full OWA log) was enormously detailed, occupying ‘a couple’ of thousand lines per event, explaining the need for it to be condensed for the purposes of Alfred Health in presenting the outline of activity referable to Mr Margelis’ router, to him in the meetings of 20 and 23 June 2011.

[188] It was Mr Park’s evidence that the full OWA log maintained by the respondent appeared to be complete (TPN 5000), free of interference (TPN 5002) and gave no cause for Mr Park to doubt the veracity of the information when it was condensed into Mr Pasnin’s abbreviated log (TPN 5010). I have accepted Mr McLeish and Ms Park’s evidence in this regard and accordingly I have accepted that Exhibit MYP2 may be relied upon. I have concluded that there is no foundation in Mr Margelis’ evidence as to Mr Pasnin having sought to ‘set up’ Mr Margelis by editing, falsely rendering, or otherwise being responsible for Mr Margelis’ IP router number appearing in Alfred Health’s logs. I have entirely dismissed the claim of secret text implicating Mr Margelis in the attempted entries as being at the behest of Mr Pasnin.

Mr Parks Evidence as to Spoofing

[189] Like Mr McLeish, Mr Park was aware of the concept of spoofing, most particularly it was said, when a multitude of requests are sent to besiege a computer network, in an endeavour to have it ‘crash’, thereby permitting the assaulting party an opportunity to penetrate that network. Mr Park had come across such a hacking practice ‘a few years ago’ (TPN 5103). Mr Park was then asked:

[190] Mr Parks was asked to comment upon the likelihood of the 13 June attempts (to access Mr Pasnin’s accounts from Mr Margelis’ router) being consistent with an episode of spoofing. Mr Parks spoke of the twelve minute cluster within which the failed attempts to gain access to Mr Pasnin’s accounts, 3:31:11, 3:38:52, ‘bookend’ Mr Margelis accessing his email account at 3:38:20. Mr Parks commented on the position were it posited that all three actions were spoofed, saying that were that so, the spoofer would have needed to know Mr Margelis’ secret user ID and his password (TPN 5019) together with the information needed to access Mr Pasnin’s account. Mr Park’s evidence was that the considerable knowledge required and exhibited in the attempts in question suggested that those involved had knowledge of the detail of the Alfred’s IT systems (TPN 5020).

[191] Mr Parks was asked a range of questions as to the events of 13 June relating to Mr Margelis’ router. Mr Park’s view was that while there may have been only one machine, on the information before him it was likely that two computers were involved in the transactions emanating from Mr Margelis’ home on that afternoon and early evening. This was said to be the case, “Given that there’s only a matter of seconds involved, it’s more likely that two different machines were involved” (Mr Parks TPN 5622).

[192] The Alfred Health case was that in either event, the access attempts at 3:31:11, 3:38:52 and 3:43:47 and the access gained to Mr Margelis’ email account at 3:38:20 all travelled through or were processed by Mr Margelis’ router.

[193] Having considered the competing contentions in this case I have concluded that, on the balance of probabilities, it is more probable that there was no spoofing of the attempts to access Mr Pasnin’s email accounts than there was spoofing. There is no evidence to support a finding that a spoofer or several spoofers were responsible for the attempts to gain access to Mr Pasnin’s account. This means that I do not accept that someone had sought to access Mr Pasnin’s email accounts, possibly relevant to the disciplinary enquiries that Mr Pasnin was involved in at the very time in that related to Mr Margelis, and substituted Mr Margelis’ unique router - thereby identifying Mr Margelis as the illegitimate enquirer.

[194] I have concluded that the incidence of spoofing is as Mr D’Abaco put it “exceedingly rare” (TPN 5803). Neither of the principal expert witnesses have seen it applied in a case like this. Mr Park, an impressively experienced IT specialist had never personally encountered it (TPN 5014). It seems that spoofing is an IT phenomenon bordering on the esoteric, such is the level of sophisticated accomplishment required to apply the technique. On all the evidence before me spoofing in this case must be discounted on both technical and commonsense grounds. I note that spoofing had not been even considered as actually having occurred in this case until discussed as a matter of theoretical possibility in discussions between Mr Margelis’ counsel and Mr McLeish. The supporting material (despite IT specialist Mr Margelis’ months of research into the case) was a photocopy of an internet article on spoofing ‘Googled’ within 24 hours of the giving of Mr McLeish’s evidence. It should be acknowledged that Mr D’Abaco’s submission in this regard did not extend beyond nominating spoofing as a possible explanation for the events in question, not as the explanation. Mr D’Abaco is able to submit that spoofing is a theoretical explanation to Mr Margelis’ IP router number appearing on the Alfred’s records. I have found on the balance of probabilities in this case that spoofing is not the explanation in these instances.

Jumping On

[195] On the balance of probabilities I have not accepted that unknown to Mr Margelis someone was able to gain access to Mr Margelis’ router on 13 June 2011. Mr Margelis acknowledged the limited strength of the router. I have not considered it probable at all that someone did hide sufficiently near Mr Margelis’ house on the afternoon in question and somehow gain access, past his router’s 32 bit password, to send an enquiry to Mr Pasnin’s email accounts via Mr Margelis’ router. In my view it is fanciful to suggest that a person unknown to Mr Margelis, or someone associated with Alfred Health, would hide or did hide near Mr Margelis’ house with a computer device on the afternoon and early evening in question. On the balance of probabilities I have declined to accept that the access attempts of 13 June are explained by someone having accessed Mr Margelis’ router in such a way.

[196] On the balance of probabilities I have concluded that the attempts to enter Mr Pasnin’s email accounts on 13 June 2011 did emanate from Mr Margelis’ home, and on the balance of probabilities I have concluded that Mr Margelis was responsible for the enquiries; for the use to which his router was put. I have concluded that Mr Margelis was using his computer over the period - and have noted that in one instance, 20 seconds before the second access attempt, Mr Margelis was at his computer entering his account at Alfred Health.

The Seriousness of Covert Entry to an Employer’s Email Accounts

[197] I am unable to accept the proposition that the attempt by an employee to gain surreptitious entry or to gain access to their manager’s email accounts without permission and in breach of a published and reasonable policy is other than serious misconduct. While I would not seek to speak beyond the facts of this case, in my view such an attempt is undoubtedly an act of serious misconduct for which summary termination would be a reasonable and rational response. In my view it provides a valid reason. An employee taking active measures to gain entry to the employee’s manager’s efiles and accounts is a serious breach of trust and of the Alfred IT Policy, but more generally is an act quite destructive of the employee’s obligation to properly conduct themselves by applying the relevant IT policies and not break into private files of other employees - of whatever seniority. A termination in such circumstances could not in my view be considered harsh, unjust or unreasonable. In my view Alfred Health did have a valid reason in that Mr Margelis was involved in the access attempts occurring in the afternoon of 13 June 2011. In my view Alfred Health did have a valid reason in that Mr Margelis was involved in the access attempts occurring in the afternoon of 13 June 2011 and I so find. For those reasons the application must be dismissed.

The Online Conversation

[198]  This element of the case was put in a supplementary way, to bolster the reason for which Alfred Health acted. It was had regard for at the time by the Alfred’s officers and in my view it was open to Alfred Health to consider Mr Margelis’ involvement in the conversation as of a real concern. I am aware of the case put for Mr Margelis - that he was not the initiator and should not be found culpable for the private comments of the SDE.

[199] It will hopefully be sufficient to note that the conversation, held during work time, using Alfred equipment and commenting in an infantile and violent way about an Alfred manager and about the rape of a female Alfred Health workmate, cannot be said to be a private conversation, not work related or something for which they cannot or should not be brought to account. While one understands that the SDE and Mr Margelis may have intended their conversation to not be further published, the fact is that internet, online conversations to or from a work computer are inherently non-private as they are cached and stored on logs potentially awaiting their eventual wider distribution. There will be many other permutations of work-related commentary and conversations not necessarily considered here. Relevant to this case I am conscious that Workplace IT Specialists, working constantly in the context of applying and safeguarding Alfred Health’s IT policy can be reasonably expected to maintain the standard of non-offensive content required by the Policy.

[200] It must be noted that Mr Margelis was involved in a participatory sense in the conversation. It was not merely a message received in his in-box. The asinine comments about Mr Gardiner, calling up gratification in violence are surpassed only by the repugnant suggestion of sexual violation of the named female colleague. Mr Margelis’ reaction was to send the “Laughing out Loud” response. It is distressing and worrying dialogue - particularly because its participants apparently saw it as in good humour.

[201] I would not cavil at Alfred Health regarding the participation in the conversation as misconduct such as to fortify the decision to terminate Mr Margelis’ employment.

[202] As the events of the case transpired, the base reason for Alfred Health’s termination of Mr Margelis’ employment did not require buttressing. This is because of the conclusion reached, a necessary jurisdictional finding, in light of the evidence before Fair Work Australia that Mr Margelis was involved in the attempted accessing of his manager’s email account on 13 June 2011. In my view, as recorded above, this activity was serious misconduct such as to warrant summary termination. Accordingly, I find that Alfred Health did have a valid reason for terminating Mr Margelis’ employment within the meaning of s.387(1) in that it related to Mr Margelis’ conduct, namely, seeking to breach the Alfred’s IT policy by gaining access to his manager’s email accounts without authority. Insofar as I have considered Mr Margelis’ involvement in the online conversation as also reflecting Mr Margelis’ misconduct I would add to the finding just made as to s.387(a), that the conversation also provides a valid reason by virtue of “its effect on the safety and welfare of other employees”. This is because in the light of the eventual publication of the conversation, the applicant’s conduct in responding in the way he did to the SDE must be considered as conducing negatively to the safety and welfare of the Alfred female employee named in the conversation as to be the victim of rape. Fairness to Mr Margelis requires it be noted that Mr Margelis did not initiate this comment or introduce such a repellent notion.

[203] As indicated earlier I find pursuant to s.387(b) that Mr Margelis was notified of the reason for his dismissal, that being the breach of Alfred Health’s policy as to accessing other employee’s IT accounts. I have, of course, been conscious of the inaccuracy of the Alfred’s initial belief that the iPhone had been used to gain access through Mr Margelis’ router - rather than the laptop computer. I have not regarded the incorrect nomination of the instrument used, given the applicant’s IT skills, as other than a sidelight, an inconsequence and a technicality which should not influence the proper resolution of the case. For it to do so would offend the s.381(2) objects of Part3-2 of the Act, requiring that both employer and employee received a ‘fair go all round’.

[204] I find pursuant to s.387(c) that Mr Margelis was given the necessary opportunity to respond and as to s.387(d) that there was no unreasonable refusal to permit a support person.

[205] Section 387(e) is not relevant, this not being a performance related case.

[206] As to s.387(f) I have considered the degree to which the Alfred’s size might have been likely to impact on the procedures followed in effecting the dismissal.

[207] There being human resource management specialists at the Alfred, and involved in this case, there is no such absence as is contemplated by s.387(g).

[208] As to s.387(e) I have had regard in considering the narrative of the case for Mr Margelis’ significant failure to mitigate his loss until the December purchase of a business. Had the decision in this case been different there is a high likelihood that any amount awarded would have been very significantly decremented for this reason.

[209] For all those reasons the application must be dismissed.

COMMISSIONER

Appearances:

J D’Abaco, of counsel, for the Applicant.

R Millar, of counsel, for the Respondent.

Hearing details:

2012.
Melbourne:
January 18, 19, 20;
February 20, 21, 22;
March 14.

Printed by authority of the Commonwealth Government Printer

<Price code J, PR525556>