Mr M Crowley and others v Sterling Thermal Technology Ltd: 3300972/2021 and others

EMPLOYMENT TRIBUNALS

Case No 3300972/2021

Between

Mr M Crowley (1) Mr E Witney (2) Mr S Rolls (3)Claimant

Sterling Thermal Technology LtdRespondent

Before

Employment Judge Maxwell

(1) Ms Johns (instructed by Counsel) for claimant

Mr Munro (instructed by Solicitor) for respondent

Date 16 March 2023

JUDGMENT

[1]The First Claimant’s claim of unfair dismissal is well-founded and succeeds.

[2]The First Claimant’s claim of direct age discrimination is well-founded and succeeds.

[3]The Second Claimant’s claim of unfair dismissal is well-founded and succeeds.

[4]The Second Claimant’s claim of direct age discrimination is not well-founded and is dismissed.

[5]The Second Claimant’s claim of wrongful dismissal is well-founded and succeeds.

[6]The Third Claimant’s claim of direct age discrimination is well-founded and succeeds.

REASONS

[7]The matter was originally listed for 17 days, although in the event only 15 could be accommodated. Since that original listing, however, the Fourth Claimant, Mr Baytopp had withdrawn his claim and accordingly, would not be giving evidence or cross-examining other witnesses. At the beginning of the hearing before us, the following timetable was agreed: Day 1 Tribunal reading Day 2 Tribunal reading Day 3 Respondent’s evidence – RW (5) Day 4 Respondent’s evidence – RW (2.5) EG (2.5) Day 5 Respondent’s evidence – EG (1.5) MW (2.5) Day 6 Respondent’s evidence – MW (1.5) SB (2.5) Day 7 Respondent’s evidence – SB(1) DD (1.5) NZ (2.5) Day 8 Respondent’s evidence – NZ (4) SS (1) Day 9 Respondent’s evidence – SS (2.5) C1 (2.5) Day 10 Claimants’ evidence C1 (1) C2 (2.5) C3 (1.5) Day 11 Closing C1 (1) C2 (1.25) C3 (1) R

(2) Day 12 Tribunal deliberation Day 13 Tribunal deliberation Day 14 Tribunal deliberation Day 15 judgment and remedy if appropriate

[8]Whilst the order in which witnesses were called varied to some extent from that set out above, the time allocations were largely adhered to and closing submissions finished on day 11. It did not, however, prove possible to give the parties our decision on day 15 and judgment was reserved. Issues Unfair dismissal - Mr Crowley [C1] & Mr Witney [C2]

[9]Whether the Claimants were dismissed for a potentially fair reason.9.1 The Respondent contends the reason for dismissal of Mr Crowley was redundancy or some other substantial reason.

9.2 The Respondent contends the reason for the dismissal of Mr Witney was gross misconduct.

[10]If a potentially fair reason in shown, whether it was reasonable in all circumstances for the Respondent to dismiss. conduct10.1 where the reason for dismissal was conduct, the Tribunal will usually consider whether the Respondent:10.1.1 had reasonable grounds for its belief;

10.1.2 had carried out a reasonable investigation: redundancy

10.2 If the reason for dismissal was redundancy, the Tribunal will usually consider whether the Respondent:10.2.1 adequately warned and consulted;

10.2.2 adopted appropriate pool for selection;

10.2.3 applied appropriate criteria to those within the pool;

10.2.4 took reasonable steps to find alternative employment. generally

10.3 In all cases the Tribunal must consider whether:10.3.1 the Respondent followed a fair procedure;

10.3.2 the decision to dismiss was within the band of reasonable responses. Direct Discrimination - Mr Crowley [C1] Mr Witney [C2] & Mr Rolls [C3]

[11]Whether the Claimants were dismissed because of age (i.e. was this a material factor in the decision).

[12]The Claimants’ ages range from 62 to 66 and they compare themselves with younger employees. Wrongful Dismissal - Mr Witney [C2]

[13]Whether the Claimant was dismissed without notice.

[14]If dismissed without notice, whether the Respondent was entitled to do so because the Claimant was guilty of gross misconduct.

Remedy

[15]Whether if so what remedy or remedies the Claimants are entitled to. Dismissed Claims

[16]Whilst the claim of Mr Witney had included a redundancy payment, this was withdrawn and is now dismissed. Evidence

[17]We were provided with an agreed bundle of documents, to which various additions were made.

[18]We heard evidence from the following witnesses:18.1 Martin Crowley, the First Claimant, formerly employed as Applications Engineer;

18.2 Edmund Witney, the Second Claimant, formerly employed as IT Manager;

18.3 Steven Rolls, the Third Claimant, formerly employed as Quality Inspector;

18.4 Ruth Warner, Head of Human Resources;

18.5 Simon Bryant, IT Manager;

18.6 David Dodds, Director of Connect Systems;

18.7 Sarah Smith, HR Adviser;

18.8 Emrah Göztürk, CEO;

18.9 Mark Woodman, Interim Finance Director with the Respondent;

18.10 Nicola Zeoli, Director of Engineering. Facts

[19]The Respondent is a manufacturer of industrial heat exchangers. The First Claimant, Mr Crowley, was employed as an Account Manager. He started with the Respondent in November 2013, when he was 61 years of age. The Second Claimant, Mr Witney, was the Respondent’s IT manager, having been in post since July 2015, when he was 61 years of age. The Third Claimant, Mr Rolls, began working for the Respondent in October 2018. Initially, he was engaged by way of an agency. He became a direct employee in March 2019, at which time he was 61 year of age. Mr Rolls’ position was Quality Inspector.

[20]The Respondent operates from two sites, one in Birmingham and another in Aylesbury. As at late 2019, there were 120 employees. The business had been in a period of decline, reporting losses over the previous 5 years, having struggled against its competitors and given its fixed operating costs, including labour. The senior management team comprised Graham Roberts as Managing Director and Peter Strickland as Financial Director. Mr Roberts and Mr Strickland reported to the Respondent’s principal shareholders at regular board meetings.

[21]In November 2019, Mrs Warner was appointed as Head of Human Resources.

[22]In March 2020, as was the case for almost every business, the Respondent’s operation was affected by the pandemic and lockdown. Given the importance of the products manufactured by the Respondent, many of its employees were treated as essential workers and continued to attend the business as usual. Nonetheless, a large contingent were required to work from home.

[23]In April 2020, Mr Roberts was dismissed and replaced by Emrah Göztürk, with the job title of CEO.

[24]In May 2020, Mr Zeoli joined as Director of Engineering. Mr Crowley and Mr Rolls reported to him.

[25]Mr Strickland continued in post for much of the year, although by September 2020 his employment had been terminated and Mr Woodman was then appointed interim Financial Director. Mr Woodman had served the Respondent as interim Financial Director on a previous occasion (November 2018 to May 2019) following the departure of yet another Financial Director, Sandra Saganowski.

[26]Whilst we heard no evidence from the Respondent’s owners, given changes in the senior management team during 2020 and then a large redundancy exercise at lower levels, it would appear a decision had been made that substantial change and reduction in costs was required to return the business to profitability. Furlough

[27]The Respondent took advantage of the Coronavirus Job Retention Scheme (“CJRS”). As at 6 April 2020, the Respondent had decided to place 26 employees on furlough. An announcement was made to all employees. This initial group did not include the Claimants.

[28]Subsequently, on 29 May 2020, the Government made changes to the furlough scheme. Only those employees who had been on furlough for a minimum of 3 weeks from 1 July 2020 would continue to be funded. Mrs Warner drew this to the attention of her senior management colleagues. This prompted a further review of employees who might be placed on furlough whilst there was still an opportunity to do so.

[29]At the same time as the Respondent was looking at placing more employees on furlough it was also, at least by the beginning of June, considering a restructure of the business and redundancies, as reflected in emails passing between Mrs Warner and Mr Strickland on 3 June 2020.

[30]On 15 June 2020, Mr Strickland sent an email to Mrs Warner, which was also copied to Mr Göztürk, entitled “redundancy costs of those on furlough”. He said that as part of an application for CBIL he had asked for a calculation of redundancy costs: “assuming all those who are furloughed will be made redundant”.

[31]There was some further discussion about named individuals and also the apprentices. In a later email same day, Mr Strickland wrote: Please include all for now. I will make a case re: apprentices as I fully agree.

[32]Mrs Warner told us there was no presumption that those on furlough would be made redundant. She said the data sought was intended to assist the Respondent to assess redundancy costs, broadly, rather than with respect to particular individuals. Whilst we accept that no final decision had been made about the cohort to be dismissed for redundancy, the furlough selection represented the Respondent’s initial view of those employees it might be able to do with out. A little over half (19 of 33) of those placed on furlough and whose details were used for the redundancy cost calculation in the document Mrs Warner then prepared, were in due course dismissed. Plainly, the case Mr Strickland intended to make was for the apprentices not being dismissed.

[33]The restructure and redundancy exercise became known as Project Romeo. Project Romeo

[34]On 25 August 2020, Mrs Warner wrote to her senior management colleagues in the following terms: Please find attached the document I referred to as a template for getting ready to manage the restructuring programme, code named Project Romeo. For purely illustration purposes I have included some fictional data for the engineering team to explain what is needed to be sure we are clear on the decisions and the communications to individuals. The data in terms of the salary benchmarking is current and so I would suggest that you use this to populate the template with the individual names and roles for all your team members. My proposed timing is no longer relevant as we are working to an exit date of End of November. I will update this after we have taken some time to review it together and consider what it means. But as Emrah has asked if we can target the end of this month to provide your proposal in terms of revised roles in your structure using this template to return your data, that would be a great start. An Excel spreadsheet was attached to this email, identifying a number of positions for redundancy. Numerous versions of the spreadsheets were produced and have formed part of the evidence before us.

[35]An early version of the spreadsheet included with respect to the Claimants: Mr Crowley35.1 a reduction from 5 employees to 3 employees amongst the pool of Application Engineers. Mr Witney

35.2 Mr Witney and Mr Bryant were identified as doing different jobs and not pooled together;

35.3 Mr Witney’s role of IT manager was to be removed;

35.4 the original text included as the rationale for this change was: Outsourcing of IT technical expertise to a third party provider and an assessment that there is insufficient people management workload to justify a senior leadership role to manage the IT Support Analyst;

35.5 Mrs Warner’s comments on that proposed rationale were: Need to be specific about the tasks being outsourced to avoid TUPE claim and produce a short list of other activity related to the role which is not outsourcing to explain that it is not the "whole" role that is transferring. Mr Rolls

35.6 Mr Rolls and Mr Dunne were both identified as having the role of “Quality Inspector”;

35.7 they were in a pool of 2 and there would be a reduction to 1.

[36]When giving evidence, Mrs Warner expressed her surprise at how the Claimants had got hold of earlier versions of certain documents, rather than the final one. She agreed that earlier drafts of these documents had not been disclosed by the Respondent. Such documents should have been disclosed, as they were relevant and might assist the Claimants in their claims (e.g. by supporting an argument that dismissal had been predetermined).

[37]On 9 September 2020, Mrs Warner wrote to Mr Göztürk about Project Romeo. She had now received responses from managers about proposed redundancies and the rationale for the same. She had prepared an Excel spreadsheet reflecting a proposed restructuring in these terms. As the Respondent was proposing to dismiss 20 employees, she advised that collective consultation obligations arose. The various redundancy dismissals to be made in each department were set out in the document Project Romeo Overview. The Respondent’s headcount would drop from 118 to 98.

[38]On 5 October 2020, Mrs Warner provided Mr Göztürk with a cost estimate for Project Romeo. The attached spreadsheet included the Claimants and their redundancy costs. They were each included because it was intended they would be dismissed.

[39]At a board meeting on 13 October 2020, Project Romeo was approved: The project Romeo initiative for rightsizing the business to increase the competitiveness of the company has been discussed. The board approved the project to go ahead with projected savings of approx. 18 positions and approx. 500 k £ annualised savings. Management team to manage the cash requirements for the severance packages. HR report included results of the Salary Benchmarking project results and the board noted that there is a variety of positions that are overpaid as well as some positions are underpaid. Corrective actions will be taken following implementation of Romeo project. The HR Report was provided to the board, all details are as per monthly reports.

[40]On 23 October 2020, Mrs Warner wrote to Mr Woodman about project Romeo. Attached to her email were a number of documents, one of which was a table including 44 employees who would be told they were at risk of redundancy. 15 of those were highlighted in yellow. During cross examination it was suggested to Mrs Warner that when she had sent the documents in this form, those highlighted in yellow were intended to be dismissed. Mrs Warner denied recognising the yellow highlighting and disputed this was the document attached to her email. She said she could think of no reason why she would have highlighted these names. Later in the proceedings, the parties having had an opportunity to inspect the original email and attachments on a device, we were told it was now an agreed fact that Mrs Warner’s email did indeed include the document with yellow highlighting. No application was made to recall Mrs Warner. Later still in the proceedings, we were provided with a schedule including all of those dismissed for redundancy or who left the Respondent’s employment about the same time for any other reason. We were struck by the overlap between those highlighted in yellow and those whose employment was terminated. Indeed, it seemed only one of the yellow highlighted employees was not dismissed and that person shares a surname with someone who was. Our conclusion is the table represented the intention of the Respondent’s senior managers to dismiss as redundant those highlighted in yellow.

[41]On 26 October 2020, the restructuring proposal was announced to employees. The communication was dealt with at the Respondent’s two sites by different management teams. The First Claimant – Mr Crowley

[42]The First Claimant, Mr Crowley, was employed as an Account Manager. He started with the Respondent in November 2013. His task was to secure business for the Respondent, in particular from Siemens in Germany. In June 2016 his job title changed to Applications Engineer but his substantive role remained the same. He prepared product designs and quotes. These related to the various heat exchanger technologies offered by the Respondent: using water to cool hot air (“CACW”); ambient air to cool hot air (“CACA”); and heat pipe technology to cool hot air (“Avantair”).

[43]As at the beginning of 2020, Mr Crowley worked alongside another Application Engineer, Mr Kuen. Up until the end of February 2020, they reported to the Engineering Manager, Nick Wilson.

[44]In April 2020, Mr Siddiqui joined the Respondent on a fixed term contract, as another Application Engineer. He had a previous period of employment with the Respondent between 2013 and 2019.

[45]Nicola Zeoli was appointed as Director of Engineering on 25 May 2020. From this point, the Application Engineers reported to him.

[46]As referred to above, by the beginning of June 2020 the Respondent was considering placing more employees on furlough and also restructuring the business with a view to there being fewer employees going forward.

[47]Very shortly after commencing his employment, Mr Zeoli had a discussion with Shaun Clarke, who he describes as being his predecessor.

[48]Mr Zeoli’s witness statement includes: With regard to the Claimant, Shaun told me that it was generally known by the team that he had plans to buy a bed and breakfast business in France towards the end of that year which was 2020. As the leader of this specialist resource, building succession and understanding the potential risks of a leavers, whatever their reason, was of interest to me so I made a note of it. I added a question mark to note that this was not a confirmed matter. I understood not to take the opinion of anecdotal office banter to be fact and when during my one-to-one meeting with the Claimant, this plan or ambition of him to leave did not come up. It was inappropriate for me to raise it, so I discounted it as a matter I need to consider. This evidence seeks to explain an entry made by Mr Zeoli in a spreadsheet he prepared at about this time relating to Mr Crowley. The document includes information about other employees as well but only that part relating to the Claimant has been disclosed. This provided: Position Location 1:1 meeting Main Skills Notes Applications AY 3.6.20 @ 9:00 CACW Siemens key account, Engineer retire 2020?

[49]We find Mr Clarke told Mr Zeoli that Mr Crowley might be retiring that year. In his evidence at Tribunal, Mr Zeoli explained that retirements were a “sensitive” issue within the Respondent, which had faced difficulties in the recent past as a result of skill and experience being lost on the departure of retiring employees. He said it was good practice to make sure he had a succession plan. Mr Zeoli said he had noted the possible retirement of Mr Crowley, in case the latter brought it up when they spoke and the laws “in this country” did not allow him to raise the subject. The Tribunal asked Mr Zeoli whether it had crossed his mind, during the subsequent redundancy exercise, that if someone other than Mr Crowley were dismissed and then shortly thereafter, Mr Crowley decided to retire, this would create a difficult situation. Whilst accepting this scenario would indeed have been a difficult one, Mr Zeoli denied the thought had ever crossed his mind. Given the importance attached to this matter, as reflected in Mr Zeoli’s note, his evidence on this point was not credible. We are quite satisfied, the fact that the limited information recorded included the possible retirement of Mr Crowley in 2020, is a clear indication that this was seen by Mr Zeoli as an important matter.

[50]On 9 June 2020 Mr Zeoli called Mr Crowley and told him he was being placed on furlough. The Claimant was surprised by this, in particular because he believed the Respondent could have terminated the employment of Mr Siddiqui. Somewhat surprisingly, Mr Zeoli’s witness statement did not include an explanation of why he chose to place the Claimant on furlough, rather than Mr Kuen or Mr Siddiqui. Counsel for the Claimant suggested Mr Zeoli could, instead, have dismissed Mr Siddiqui. Mr Zeoli replied he was not considering terminating any contract at that time. Whilst immediate terminations may not have been in prospect, it is plain that a restructure with possible redundancies in the near future was under discussion by the Respondent’s senior managers and we are satisfied that Mr Zeoli was aware of this. He denied the suggestion that whoever was furloughed at this time was likely later to be dismissed for redundancy. Only in the course of cross-examination was any reason given by Mr Zeoli for furloughing the Claimant, he said this was because the types of enquiry Mr Crowley dealt with were easier for the other two team members to address. This was a somewhat surprising suggestion, given the Claimant’s very long service in the Department and the fact of Mr Siddiqui only having recently returned. Our conclusion is that Mr Crowley was selected for furlough at this time, in part at least, because Mr Zeoli believed he may be retiring that year in any event and was concerned to ensure a succession plan.

[51]With effect from 28 July 2020, Mr Siddiqui was made a permanent employee of the Respondent. Discussions about a potential restructure, including reducing headcount, had been underway at a senior level within the Respondent for nearly two months of this point. We are satisfied Mr Zeoli knew at this time there was some prospect that the numbers in his department, including amongst the Application Engineers, would be reduced in the near future. The simplest way to avoid the need for a compulsory redundancy would have been not to offer any new permanent contract. In those circumstances, it is difficult to avoid drawing and inference that Mr Siddiqui was seen by Mr Zeoli as part of the succession plan and the Claimant as likely to depart.

[52]In August 2020, Mr Zeoli in consultation with other senior managers, proposed to reduce headcount in the engineering department from 17 to 13 employees. This included reducing the application engineers, recently increased to 3, back down to 2.

[53]By letter of 26 October 2020, Mr Crowley was advised he was at risk of redundancy. Mr Zeoli also spoke to him about this.

[54]On 27 October 2020, an initial redundancy scoring exercise was carried out with respect to the Application Engineers. The scoring matrix was as follows: Skills: none = 0; some basic = 2; competent at half = 4; expert = 8] CACW [max 8 points] CACA [max 8 points] Avantair [max 8 points] Disciplinary Record No current disciplinary warnings Score 10 Current Written or Verbal Warning/s Score 5 Current Final Warning/Suspension Score 0 Attendance Record No absences Score 10 Up to 3 absence occasions in last 12 months Score 5 More than 3 absence occasions in last 12 months Score 0 Length of Service More than 15 years Score 10 5 to 15 years Score 6 Less than 5 years Score 3 The length of service score was only to be used as a tiebreaker.

[55]Mr Crowley was scored: :55.1 skills 14 [CACW 8; CACA 4 & Avantair 2];

55.2 disciplinary 10;

55.3 attendance 10;

55.4 length of service 6;

55.5 total 34.

[56]Mr Siddiqui was scored:56.1 skills 16 [CACW 6; CACA 6 & Avantair 4];

56.2 disciplinary 10;

56.3 attendance 10;

56.4 length of service 3;

56.5 total 36.

[57]Mr Kuen was scored:57.1 Skills 20 [CACW 6; CACA 6 & Avantair 8];

57.2 disciplinary 10;

57.3 attendance 10;

57.4 length of service 6;

57.5 total 40.

[58]By an email 29 October 2020, the Claimant wrote to Mr Zeoli asking for confirmation that he would have sight of his completed selection assessment sheet (i.e. his matrix scores) before the consultation meeting due to take place the following day. He also asked for job descriptions of the vacant positions he had been told about. The Claimant was very concerned about the fairness of any scoring undertaken by Mr Zeoli, given they had only worked together very briefly before he was placed on furlough.

[59]Mr Zeoli had little direct experience of working with Mr Crowley. The overlap between Mr Zeoli starting with the Respondent and the Claimant being placed on furlough was two weeks. In the course of being cross-examined, it was suggested to Mr Zeoli that his opportunity to assess the Claimant’s skill was limited. In response to questions from the Tribunal, Mr Zeoli agreed that by the time of carrying out the first scoring exercise he had worked with Mr Kuen and Mr Siddiqui for some 5 months. Nonetheless, he said this did not mean he was in a better position to assess their skill, or at least to no more than a “minimal” extent. We found his answers in this regard to be unpersuasive and unsatisfactory. At the time of carrying out the first scoring exercise, Mr Zeoli said his sources of information with respect to the Claimant’s skill were the “file” of ongoing work, which he agreed amounted to no more than a “snapshot” and the information he was given by his predecessor, Mr Clarke. Mr Zeoli said he could not fairly assess the Claimant’s skill on the basis of the snapshot and, therefore, he relied upon the information from Mr Clarke. Notwithstanding Mr Zeoli did not agree with the proposition that he only had a limited opportunity to assess the Claimant’s skill, his need to rely upon the opinion of Mr Clarke demonstrates this was so.

[60]Mr Zeoli’s evidence was that his conversation with Mr Clarke about Mr Crowley’s skills was not recorded or noted. This caused us some concern. It appeared there was no transparency in the scoring exercise.

[61]During our deliberations, we noticed that immediately following the spreadsheet extract in which Mr Zeoli recorded his initial conversation with Mr Clarke and the possibility of Mr Crowley retiring in 2020, there appeared to be an extract from another spreadsheet. This was not commented upon during the hearing but was included in a tranche of documents relied upon by the Claimant, which he said had been disclosed by the Respondent (either in these proceedings or by way of a DSAR). Once again this appears to be an extract from a larger document, being the part which refers to the Claimant. This provided: CA CA S&T Avantair Steam Thermal Mechanical D Notes CA CW O y y y n n n n n light involvement on Avantair. Siemens key account

[62]We were struck by the similarity between this document and the one Mr Zeoli agreed he had created following an initial discussion with Mr Clarke about employees in the department. Our finding is that this document must have been created by Mr Zeoli following a discussion with Mr Clarke about the skills and expertise of employees in the department. We cannot say whether this is a discussion which took place at the beginning of Mr Zeoli’s employment, immediately prior to the scoring, or somewhere in between. Nonetheless we note that Mr Crowley is recorded as being skilled in both CACA and CACW. The information here might support the score given to the Claimant for Avantair, on the basis he is recorded as having only “light involvement” in this area. This information does not, however, provide a basis upon which the Claimant would have received only half marks for CACA.

[63]A first consultation meeting took place on 30 October 2020. Mr Zeoli attended for the Respondent, supported by Paul Baker of Penninsula / Face2Face, the Respondent’s employment law advisers. Mr Crowley was accompanied by Mr Kuen. This choice of companion was somewhat odd, given that Mr Kuen was himself in the same pool for redundancy selection. Nonetheless, it is what the Claimant wanted and the Respondent did not object.

[64]Mr Zeoli began by outlining the scoring matrix. There was then discussion about the various scores for different skill areas. Mr Crowley had been awarded the maximum score for CACW and this was touched on only briefly. For CACA the Claimant had only been given half marks and disputed what Mr Zeoli said was his understanding: NZ: Okay, so, on the CACA, on the larger (? 06.16) I think it was designed by someone else, that’s my understanding. MC: Well, it’s incorrect then. NZ: In what respect? MC: Right, when I first joined this company I was headhunted from a major competitor, bringing with me a vast knowledge and experience of a wide range of (? 06.40) products gained during the previous nine years working exclusively in the heat exchange industry. On a daily basis I was involved in the thermal and mechanical design and preparation of costings needed for quotations of CACWs, CACAs, (? 07.02), air blast coolers, (? 07.07) air heaters. During this period I was personally tasked with writing the company’s first computer program with the design of CACAs and separate oil gas to air heat (? 07.21) from thermal exchange first principles. This was successfully completed and put into practice for the preparation of submitting quotations. NZ: Was this done at Sterling, Martin? MC: This was done under the, when the company was operating under the name of Thermo, but let me bring you up to date because more recently when the applications team were introduced to a CACA design review meeting, to bring us up to date with developments, I was surprised that one of the screen images was an image from my original program working, with my handwritten notes on it. I mentioned this at the time during this meeting and it was acknowledged that some of my original workings were still relevant to the selection and design of CACAs. So, also during the past 18 months I have been asked by Nick Wilson on a number of occasions to personally check CACA designs that he has prepared to see if I could improve on his selections. Something that I was able to do and achieve cost savings on what were his original attempts. Do you want to take that on board? NZ: I’m taking notes.

[65]The Claimant also put forward his experience of Avantair: What about the Avanter? MC: Avanter, right, I’ve made numerous visits to various Siemens sites (? 09.20) to promote Avanter to their engineers and salespeople, supporting their then MD’s of Sterling, which has resulted in achieving sales for this product and I’ve also been involved in extensive discussions relating to product development to meet their challenging requirements. So, I’ve got quite a history of working, dealing, designing, selling Avanter to Siemens before Fraser became involved in the company. And actually there’s a crossover in the early days of Fraser’s time. So, again, I’d say I consider that mark of two to be rather an-, it perhaps shows and highlights, you know, how you-,someone-, if you’ve only known me basically less than a month how you can be qualified to assess my skillsets and also what I bring to the company on a wider scale. But yeah, please carry on. I’m sure we’ll come back to these points.

[66]A little later in the meeting, Mr Crowley said he would be appealing the scores he was given. At this stage Mr Baker took over the discussion. He asked for examples in the skill areas. The Claimant said he had already provided these. Mr Baker disagreed with this and asked for specific examples. In response the Claimant said he needed to refer back to his sales sheets (the Claimant was not in the workplace and did not have access to these documents himself). Mr Baker continued to press. The Claimant explained that he was involved in writing the software program the Respondent used for CACA design: MC: Because you’re basically using a program that I had a hand in writing for the design of CACAs, it’s plain and simple as that. PB: Okay. MC: You know, I’ve got a long history of designing and selling CACAs, you know, even prior to joining Sterling. So, yeah, it shouldn’t be under any doubt. PB: Okay, so you had a hand in writing it and I’m not a program designer or developer or anything like that so please do forgive me, but I would assume that if someone has a hand in writing it, they haven’t written the whole thing and therefore, again, I wouldn’t necessarily deem them as an expert just because they’ve added part to it. So, I need to understand, because I need to have a conversation with Nic after this to find out whether Nic is prepared to change his scores and I need to be able to rationalise everything. So, any specific-, We were somewhat surprised by Mr Baker’s comment here. If the Claimant had a hand in writing the software the Respondent used to design CACA projects that would seem to be a good example of his skill in this area. To quickly minimise this on the basis he was not solely responsible for writing the application seems premature. This skill area would in any event appear to be one better discussed between those with a relevant engineering background, which is a point the Claimant made shortly thereafter.

[67]Following this meeting and those held with Mr Kuen and Mr Siddiqui, on 2 November 2020, Mr Zeoli rescored the three Application Engineers:67.1 Mr Crowley was scored:67.1.1 Skill 16 [CACW 6; CACA 6 & Avantair 4];

67.1.2 disciplinary 10;

67.1.3 attendance 5;

67.1.4 length of service 6;

67.1.5 total 31.

67.2 Mr Siddiqui was scored:67.2.1 Skill 18 [CACW 6; CACA 6 & Avantair 6];

67.2.2 disciplinary 10;

67.2.3 attendance 10;

67.2.4 length of service 3;

67.2.5 total 38.

67.3 Mr Kuen was scored:67.3.1 Skill 20 [CACW 6; CACA 6 & Avantair 8];

67.3.2 disciplinary 10;

67.3.3 attendance 10;

67.3.4 length of service 6;

67.3.5 total 40.

[68]A second consultation meeting took place on 2 November 2020. Mr Zeoli opened by saying that in light of what Mr Crowley had told him at the last consultation meeting he was increasing the CACA score from 4 to 6 but reducing the CACW score from 8 to 6 because the Claimant was not using the Aspen software to create designs. The Claimant responded he had no opportunity to use Aspen but that did not mean he was any less expert in CACA. Mr Zeoli said that is what he would base the CACA evaluation on and if the Claimant wished he could appeal.

[69]Mr Zeoli next said he was reducing the attendance score to 5 because Mr Crowley had a knee injury between the 8 and 10 February 2020. The Claimant said he thought it was just one day of absence on the 10th, which was a Monday. The Claimant said he could not have been absent from work on the 8th and 9th given they were a Saturday and Sunday. He also said it was unfair that he was being judged on the basis of the 12-month period against someone who was not with the Respondent for that amount of time (i.e. Mr Siddiqui). Mr Baker pointed out the Claimant would get the same score for attendance even if it were only one day of absence.

[70]Mr Zeoli returned to skills, saying the following: NZ: Just so that I complete my bit, in the evaluation of the skills what I have considered is, for your information, Martin, the basic principles, the electric product design and costing like junction box, terminal box, those aspects of the units, the (? 10.51) design cost and (? 10.53) product configuration in terms of size, application, or environment, or end user. That’s part of the evaluation that I have considered to come up with a score. This was the first time that Mr Zeoli, or anyone else, had offered this explanation of the matters that might be taken into account when deciding which level of expertise was appropriate. Mr Crowley said he was unable to write those points down as quickly as Mr Zeoli had read them out. There was then a discussion about alternative employment. Whilst the Claimant complains that his redundancy selection was unfair and discriminatory, he does not allege any failure by the Respondent with respect to suitable alternative employment.

[71]Mr Zeoli approached Martin Atkin, former Engineering Director, for his comments on the skill levels of the 3 Application Engineers. Mr Atkins responded in an email of 2 November 2020: Fraser Avantair - extensive knowledge having fronted then majority of quotes during my last year. (9) CACA - good knowledge of CACA systems. (8) CACW - knowledge of the underlying structure of the configurator - considered capable of carrying out some maintenance. (9) CACW systems - Not extensive exposure but can apply knowledge from other areas. (8) Mohammad Avantair - good knowledge of the design (8) CACA - Extensive knowledge applying to GE Rugby applications. Lacks flexibility when considering possible configurations (9) CACW - Capable of running the configurator (8) CACW systems - Knowledge applying to GE Rugby applications. Lacks flexibility when considering possible configurations (8) Martin Avantair - some knowledge but less experience in configuring designs (7) CACA - good knowledge of CACA systems. (8) CACW - extensive exposure to the configurator supplying quotes to Siemens (8) CACW systems - Not extensive exposure but can apply knowledge from other areas. (8) In all cases the limiting factor is the ability to think more deeply about the risks associated with a design or configuration. Fraser is probably the most capable from this perspective. Although accurate I consider Mohammad’s approach to be a little one-dimensional with too great a focus on a go / no-go analysis. Martin is less likely to ask for review of a design. He has generally had less experience in a broader range of configuration.

[72]By letter of 4 November 2020, Mr Crowley was advised that he was the lowest scoring in the pool used for identifying which employee would be dismissed for redundancy. He was invited to a further consultation meeting.

[73]The final consultation meeting took place on 6 November 2020. The Claimant challenged his scores: MC: Okay, alright. Okay, I’ll proceed with my comments then. Which include that I consider it confounded and disrespectful to consider me anything less than an expert in CACWs, I have personally carried out product selections , costings, quotes and order negotiations resulting in more than 160 orders with a total order value in excess of €9 million for all variants of this product. During the majority of 2019, leading into 2020, I have personally been called upon by the companies-, been personally called upon as the company’s CACW expert by the then managing director to be part of a team to offer direction in a study to rationalise the design of the product and introduce some standardisation. To thereby bring down costs to secure more sales at increased margins, something that you’ve now told me the company says it’s focused on. I have been the go to individual to answer number of questions from all company departments relating to CACWs. Again, I touch on the CACAs, to ignore the fact that my product expertise was called upon when I was asked to improve on selections already made by my line manager, Nick Wilson, to allow the company to achieve reductions in our costs after we order, have been received and it was something I was able to secure. Returning to the Avanters, having personally run three Avanter orders from Siemens, handling the inquiries from initial receipt through to successful order negotiation and final product delivery, including subsequent liaising with (? 04.44) suppliers and the client to allow the client to successfully carry out final, detailed assembly of (? 04.53). My knowledge and experience of heat exchange products extends over a career period that extends over 17 years on (? 05.04) company’s current product range. There has been a complete failure to recognise or acknowledge what I have brought to the company or the part which I play during these last seven years. I think I’ll finish there for the moment. Silence all round?

[74]After some communication difficulties (the consultation meetings were conducted remotely) further explanation was offered by the Respondent of the scoring method: PB: Okay, so, what I’m saying is do you want to just clarify the difference between expert and fully competent so that Martin is aware where you’re perceiving that he doesn’t get that differential in points? NZ: Yes, I think we touched (? 08.20), I will rephrase that in these circumstances. So, it’s not only the capability to design across the (? 08.32) model, (? 08.35) possibility to cost propose and design nonstandard size or non-standard application for different environment. So, something that is also outside the standard configuration process. That’s what defined the level of expertise. I’m not saying that Martin, you are not familiar or you are not capable of designing, just a different level of knowledge that we are discussing within the team. MC: Well, (? 09.19) made clear that differential. NZ: And I didn’t made it-, any specific reference to your person, it’s just to the role that we are assessing. Last time I went through the fact that there are electric (? 09.39) design and the costing of (? 09.41) like the junction box, manual box, that might require some advanced knowledge, as well. MC: (? 09.51) this is completely a new introduction to how this-, how this marking process is going on. You can’t make it up as you go along, Nic. NZ: Sorry, but if you hear the discussion that we had last time, I mentioned exactly those points, it’s in the record and I remember you made a comment when I see the record I will write it down, because you probably didn’t have time to recall when I was talking. But it’s clearly stated in the previous conversation. Nevertheless I also would like to consider one of the last (? 10.43), for example, one of the last CACAs that we have sold to Siemens, is there any specific reason why you didn’t design it? Mr Crowley’s observation that Mr Zeoli was making it up as he went along was not only understandable it was accurate. Mr Zeoli began this scoring exercise with almost no direct knowledge of the Claimant and no scoring guide for the matrix criteria. There was no indication of the factors which were required to establish each level of expertise. Mr Zeoli developed his approach as the process went on in response to the challenges made by the Claimant. The relevant factors were never set out clearly for the Claimant. Furthermore, not only was Mr Zeoli’s approach reactive, it was defensive and we find, intended to preserve the Claimant in last place.

[75]Separately from contesting the scoring, the Claimant put forward his proposals to avoid any redundancies being made. There was also a discussion about apprentices and graduates. The subject of apprentices was returned to at the Tribunal and Mr Zeoli was cross examined on this. It is clear, the Respondent wished to allow apprentices to complete their apprenticeships. Separately from considerations of fairness towards the apprentices, their employment by the Respondent was subject to an attractive regime of state funded support. Furthermore, this had no bearing on selection from within the pool of Application Engineers. None of the three was an apprentice and it was not suggested the Claimant was dismissed and then an apprentice appointed to his position or to do his work.

[76]Before the meeting closed Mr Kuen spoke up. He wished to comment upon a matter that had been discussed earlier in the meeting. Mr Zeoli had referred Mr Crowley to a recent CACA order for Siemens, which it transpired the Claimant had not designed and asked him why this was so. The Claimant appeared unfamiliar with this order. Mr Kuen said: NZ: Yeah, I’m here. FK: Just happens that you brought up an example that I was involved with. So, I just want to give clarity for the, sort of, minutes or the record of this meeting that the example you raised was with (? 24.41) job. At the time there was only Martin and myself in the OEM team and the person that was involved with that in allocating the inquiry was Nick Wilson. So, it was Nick Wilson who chose or allocated the inquiry and it just happened to come to me, but as far as I understand that either of us were capable of doing the design. Even (? 25.32) challenges.

[77]Mr Crowley sent a follow-up email later that day: Further to the meeting that took place this afternoon it is wholly untrue to suggest I have no experience with electrical ancillaries. The Siemens Khurais Avantair project demanded high specification electrical cabling, conduit, glands and terminal boxes to interface with the fan-motor sets, all of which I selected and specified for the Engineering Department to include on our drawings prior to also liaising with the Purchasing department to ensure that fully compliant components were installed to meet the Clients specifications.

[78]Mrs Warner discussed various employees who had been selected for dismissal with Mr Baker. She put advice about those in the engineering department in an email of 8 November 2020 sent to Mr Zeoli, which included: Martin Crowley - we have a number of options: - Concede to his point about Mo’s short service provides an advantage on the attendance matter and agree to take the final ratings including length of service giving Martin additional 3 points. I think this is a reasonable concession to address Martins ill feeling about fairness and grudge with Mo. - Concede that Martin is recognised as an expert in CACW and he gains a further 2 points. If I recall you have stated that Martin deferred to Fraser on a particular CACW job recently which for me is justification that he is not the recognised expert and deserved of the additional 2 points. […] I know Nic that you have done a most thorough job with this restructure and I have no doubt about your proposals. I am purely focussed on reducing any sense of injustice from the individuals above to avert appeal potential. If you can provide the above responses, I will include suitable explanations in these individuals termination letters.

[79]Mr Zeoli replied on 9 November 2020: Martin a) I am ok to proceed with your proposal but then it has to apply for all the dept: I believe this might affect the results in Aylesbury design engineering where Chris has longer service than Sundhar b) The skill scoring reflects in my view the status of the things. It is in line with Shaun evaluation and Martin Atkins evaluation so I do not think we should change the score on the CACW unless we increase also the others (none of them was scored as expert on CACW)

[80]Mrs Warner’s response to same day included: Thank you for your commentary. It is indeed very helpful and I will expect it will satisfy Paul to secure the dismissals. I will include the details in the individual letters for completeness as it could avoid a claim being pursued when individuals reflect and of course seek advice. With regard to the length of service being applied, it will not need to affect the whole engineering team, but just the OEM apps team because these are separate selection pools.

[81]By letter of 10 November 2020, Mr Crowley was advised of his dismissal for the reason of redundancy. The letter from Mr Zeoli included: Additionally, during your consultations, you raised several issues, and I can confirm the corresponding responses as follows:• The fairness of comparing your 12-month attendance record with that of another employee with less than a year’s service This has been given consideration and we can accept that to address this concern, we incorporate the points attributed to length of service for all members across your pool, instead of only considering length of service as a factor where scores were equal. This would provide you with an additional 6 points for your 7 years’ service. As this revised rating approach is applied to the other members of the pool I must advise that whilst this does provide you with a benefit, it does not affect the ranking of the scores and you remain the lowest ranked amongst the pool.

• The assessment of your skills does not adequately reflect your own assessment I listened to the points that you made during our second consultation meeting and I did adjust the ratings which I presented to you at our last meeting. This did in fact increase your skill score by 2 points, but to ensure that my approach was consistent and fair this approach did mean that I had to adjust the ratings of the other member of the pool. I have credited you with the competence that you have justified but I must advise that this does not affect the ranking of the scores and you remain the lowest ranked amongst the pool.

[82]The approach adopted with respect to absence is an odd one. Mr Crowley had argued it was unfair to score him and Mr Siddiqui with respect to absence, given the latter had been with the Respondent for a much shorter period and, therefore, had been less at risk of requiring a day off. The Respondent, as reflected in the advice given by Mrs Warner, appears to have accepted this was a good point. The obvious thing to do in those circumstances would have been to remove attendance from the scoring matrix or only consider attendance during the period all three members of the pool had been in the Respondent’s employment. This would have neutralised the criterion, as it would either have been removed entirely or each candidate would have received the maximum score. There is no obvious reason for bringing in the length of service score, which had previously been said only to apply as a tiebreaker. This route was, however, more disadvantageous to the Claimant. Neutralising attendance would have reduced the differential between the Claimant and Mr Siddiqui by 5. Bringing in length of service instead, only reduced the differential by 3.

[83]Mr Zeoli’s rationale with respect to a further change to the skill score is difficult to understand. He begins by saying that he does not agree with Mr Crowley’s selfassessment of his skill level. That conclusion would appear to require no change in the skill scores. Despite that, however, Mr Zeoli then goes on to say that he did adjust the skill ratings with the result the Claimant achieved 2 more points but made the same adjustment for the other members of the pool. Mr Zeoli does not say with respect to which skill area this increase was made. From the emails passing between him and Mrs Warner (which the Claimant would not have seen) it appears the CACW score was changed. If the Claimant made good points about his experience on CACW, then that was a reason for increasing his score. It does not follow, that the scores of others in the pool should be increased for the same reason. If the Claimant did not make good points about his CACW score, then there was no reason to make any increase. What was done here is irrational, it was a fudge intended to give the impression of taking on board the Claimant’s arguments, without allowing this to affect the end result.

[84]In the course of cross-examination, it was suggested by Counsel for Mr Crowley that the Respondent had engaged in tinkering with the scores, whilst seeking to maintain the Claimant in last position. Unfortunately, we have been driven to the conclusion this characterisation is an accurate one. Mr Zeoli was referred to a spreadsheet entitled “Summary of OEM Application Engineers Selection Ratings” being part of Respondent’s disclosure and asked if he had created it. He replied he did not remember and could not explain it. This document appears to contain redundancy selection scoring for the Claimant, Mr Siddiqui and Mr Kuen. On Closer examination, however, its contents are rather curious. The skill scores for the Claimant are CACW 8, CACA 4 and Avantair 4. These scores do not reflect either the first or the second version of the Claimant’s scoring matrices. Nor can this reflect the revision referred to by Mr Zeoli in the Claimant’s dismissal letter because the other two members of the pool have not also been given 8 for CACW. The skills scores for Mr Siddiqui are those from the second scoring exercise. The skill scores for Mr Kuen are those from the first scoring exercise. This document, therefore, contains scores taken from different stages in the scoring process for the other two members of the pool and scores that were never awarded to the Claimant. The inference we have drawn from this unsatisfactory evidence is the one urged upon us by Ms Johns, namely the Respondent was tinkering with the figures in light of the Claimant’s objections, looking to where changes might be made whilst keeping the Claimant in last place.

[85]Our finding, is that Mr Crowley’s selection for redundancy was a predetermined outcome. There were a number of factors which fed into this decision. Firstly, Mr Zeoli wished to preserve the status quo. He had worked with Mr Crowley only briefly before the latter was placed on furlough. Thereafter and for several months, he worked with Mr Kuen and Mr Siddiqui in a satisfactory way. To that extent, his small team of Application Engineers was a known quantity. Dismissing one of those two and bringing back the Claimant introduced undesirable uncertainty. Secondly, Mr Zeoli did believe Mr Kuen and Mr Siddiqui were, slightly, more skilled. This was based on the information he had been given by others, including Mr Atkin. Thirdly, Mr Zeoli was concerned the Claimant may be retiring shortly. It would have been a most unsatisfactory position for the Department if, say, Mr Siddiqui had been dismissed for redundancy and then a short time later the Claimant had retired. Unsurprisingly, Mr Zeoli was concerned about succession planning. The evidence he gave that this latter point had not crossed his mind was unbelievable.

[86]Mr Crowley appealed against his dismissal by letter of 16 November 2020. He alleged the scoring system had been “fixed” to achieve Mr Zeoli’s desired outcome and made various points about the scores awarded and as adjusted. He complained about Mr Siddiqui being given a permanent contract whilst he was kept on furlough and also alleged age discrimination.

[87]The Claimants had noticed that many of those who had been or were expected to be dismissed by the Respondent at this time were over 60. This common thread, appeared to them as evidence of age discrimination. During the Tribunal hearing, Mr Munro repeatedly said that the Claimants had “colluded”. We expressed our concern at his choice of language. The word collusion tends to imply some improper cooperation between them. Whilst the Respondent denied age discrimination, it had not been suggested to any of the Claimants that they were not telling the truth when they said they believed their dismissals were discriminatory because of age. We accept that each of them does, genuinely, believe they were selected for dismissal because of their age and a desire on the part of the Respondent to retain a younger workforce. There is no impropriety if a group of older employees who have all either been recently dismissed or find themselves heading toward the exit, speaking to one another, sharing their experiences or cooperating in bringing claims to the Tribunal.

[88]Subsequent to Mr Crowley’s appeal, Mrs Warner sent him an email in the following terms: Please find the original assessment for you. I was going to share this with you during the appeal hearing but also happy for you to have this now. The breakdown of the basis of scores took account of a range of elements and also some generalisations as detailed below o Expert - Developed reputation as the “go to” for help on this product and allocated the most/more complicated jobs o Fully Competent - Understands fully without guidance o Competent at half - supports sub projects spending up to 2 days without guidance o Some Basics - small sections of a quote/calculation Additionally, the elements considered in determining the ratings for each product, also took account of the degree to which the members of the pool demonstrated capability to: - design, cost and propose non-standard (size, application, environment, end user etc) product configuration and versatility of different software - deal with electrical product design/costing Qunction box, terminal box etc) This text had not been provided to the Claimant previously and was not referred to by Mr Zeoli during the consultation process. In the course of being crossexamined, Mr Zeoli said these factors were not exhaustive and that he had explained how he rated the relevant skills during the consultation process.

[89]The appeal hearing took place on 26 November 2020. The decision-makers were Mrs Warner and Mr Allman. Mr Crowley was accompanied by Mr Kuen. The two versions of the scoring matrix were referred to as revision 0 and revision 1, which are those we have been provided with. There does not appear to have been a third document, recording the scores as, apparently, adjusted by the decision referred to in the letter from Mr Zeoli dismissing the Claimant.

[90]Mrs Warner and Mr Allman spoke at length about the process they said had been followed and how thorough Mr Zeoli had been. When, however, the Claimant gave detailed explanations of the matters he relied upon to contend for higher scores with respect to the technical areas, there was little engagement. Mrs Warner, in response to this information and points made by the Claimant about the differences between the two versions of the scoring sheets, offered to go back to Mr Zeoli and seek “a better explanation for where Nick believes there is a difference and a gap between you being fully competent and competent” The Claimant agreed they should do that. Mrs Warner said she would put it on the task list. Shortly thereafter, Mrs Warner expressed surprise the Claimant was contesting the CACW score as she understood him only to be contesting Avantair. Having read the Claimant’s grounds of appeal document and oral representations up to that point in the appeal hearing, we are unsure why Mrs Warner was of that view. The Claimant took issue with having been marked down for lack of use of a particular software package. He said this was only available on the computer of one of his colleagues, Tom Cann. He went on, however, to explain that he provided all of the information necessary for the relevant fields and Mr Cann, who sat alongside him, merely entered the data. This software package was not made available to the OEM team (i.e. the Application Engineers). The Claimant also relied upon: MC: Well, purely on the go to aspect, during the majority of 2019 leading into 2020 I was personally called upon as the company’s CACW expert by the then managing director to be part of a team to offer direction in a study to rationalise the design of a product and to introduce some standardisation. So, thereby bring down costs to secure more sales at increased margins. There was a regular Friday afternoon session, Graham Roberts-, Mr Allman said that initiative was not finalised and taken forward. The Claimant said that did not dilute his contribution.

[91]Mrs Warner sought to justify the CACW score by saying that no one had been graded expert in this. The Claimant replied that having obtained more than 160 orders worth over €9 million it was an insult to say he was not an expert at dealing with this product. When the Claimant offered to expand upon the customers he had worked with on CACW Mrs Warner said they were not looking at individual customers and an asked if there was anything else they could take away. The Claimant said he was presenting the information they could take away.

[92]The Claimant explained that he was the Respondent’s ‘go to’ individual in connection with CACA and regularly took calls from production and engineering. The Claimant also said that his colleagues, Mr Kuen and Mr Siddiqui, would refer to him on a regular basis seeking help and assistance. Mr Kuen was then invited to speak: RW: Okay, well, I mean I don’t want to compromise you, Fraser, but would you-, as you’re here could you be able to comment about that and the frequency with which that’s happened from your own point of view? You can decline if you don’t’ want to say. FK: On some of the specific designs that Martin has been involved with, yes, I would seek guidance from him. RW: Okay, so, but is that because he has the historic knowledge of that particular design or is it something more general which is about the general understanding of CACW as a product range? FK: Well, I don’t-, I can’t speak for everybody, but I have discussed with Martin both on the practical manufacture and also the thermal design, so on both aspects. RW: And has Martin made decisions for you on that? FK: He’s given me guidance, yeah. RW: Okay. FK: I would have taken the information that he’s given me to put my work together. RW: Okay, thanks Fraser. Okay, so I think that’s-, in addition to the Avanter illustrations I think we do need a little more substance, meat on the bones, in terms of the rationale as to why those weren’t higher. Okay, are you okay with that, Mike, would you say? MA: Well, I’ve put those down as two actions, both Avanter and the CACW rating.

[93]Mrs Warner said that Mr Siddiqui was appointed to fill a vacancy within the budgeted headcount for the function, his skill set fitted the profile of the work at that time and the Respondent wish to retain his skill within the business. Mrs Warner gave stat craft as an example of a project Mr Siddiqui was working on. The Claimant immediately said that he had been working on that. Mrs Warner asked him to let her finish. We note that a very large part of the appeal hearing consisted of Mrs Warner and Mr Allman delivering explanations to the Claimant, rather than receiving or engaging with his arguments.

[94]Mr Crowley suggested that Mr Siddiqui had not been selected for redundancy because the Respondent feared a complaint of race discrimination. Mrs Warner was unwilling to discuss this. There was no evidence to support this allegation, it had not featured in the Claimant’s grounds of appeal and it was, properly, open to Mrs Warner to decline to entertain that.

[95]In connection with age discrimination, Mr Crowley said: MC: Just yesterday, when I was in Aylesbury getting this computer sorted out, (? 01.23.40) came into the IT department and, alright, started general chit-chat, general chit-chat, and then came up with a, oh yes, you know, you were always going to retire anyway. And whoa, whoa, whoa, whoa, whoa, Mile, I have never discussed retirement plans because there hasn’t been any. And yet there’s, it seems through so many people my retirement comes up in conversation, whether it’s directors, team managers or whatever, that there is this strong thread of belief that, well, yeah, Crowley’s is past retirement date and, you know, even if I was to say, you know, no smoke without fire is putting it in the simplest, innocent form, yeah. Excuse me, that’s never gone away, I’ve been constantly quizzed on it, at all levels within the organisation, and, you know, it’s totally unjustified as a topic to engage me in. So, yeah. RW: So, if I could just come back on that then. I mean, yeah, it’s a clumsy thing for sure that was said to you by Mile but I can absolutely assure you that Mile has had no direct impact on the judgment or decision at all, do you accept that The Claimant went on to say that Mr Wilson Mr Roberts and Mr Strickland all made comments in this regard. Mrs Warner said none of these people were involved in the decision to select him for redundancy.

[96]There was a discussion about whether the job description should have featured more in the selection skill set. Mrs Warner emphasised the Claimant’s selection was not about poor performance.

[97]The transcript included comments made by Mr Crowley and Mr Kuen after the meeting had finished. The Respondent cannot, however, be criticised for failing to take into account things that were not said during the meeting and only passed between the Claimant and his companion thereafter.

[98]By letter of 7 December 2020, Mr Crowley was advised that his appeal had been rejected. None of his grounds, including the allegation of fixed scoring, was upheld. The Second Claimant – Mr Witney

[99]The Second Claimant, Mr Witney, was the Respondent’s IT manager, having been in post since July 2015. Mr Witney reported to the FD. Reporting into the Claimant was Simon Bryant. Mr Bryant was tasked with providing “first line support”, which is to say supporting the users with their IT problems. This enabled Mr Witney to focus upon high-level matters. Mr Witney also had access to an external IT services provider, Cloud Systems, with whom he had enjoyed a professional connection which predated his employment by the Respondent. Cloud Systems provided ad-hoc support when it was required, including at times when the Claimant was on annual leave. There was no retainer in place, rather a price would be agreed when this support was needed. Separately, the Claimant would sometimes contact Mr Heappey of Cloud Systems to act as a ‘sounding board’. This was not a paid service, rather it reflected their long-term association.

[100]Prior to the events the subject matter of this claim, the Respondent had suffered two cyber security attacks. The first occurred before Mr Witney joined. The second occurred during his tenure. On the second occasion, Mr Witney had identified the incursion when it was in progress. He successfully stopped this attack in its tracks by physically unplugging the server. The damage done was quickly repaired.

[101]Mr Witney had discussed the need for an improved backup solution with Mr Roberts and Mr Strickland. Whereas the Respondent had backups maintained only on site, the Claimant recommended further cloud-based backup be made. Having explored the costs in this regard, a written proposal was drawn up by Mr Witney and approved by Mr Strickland and Mr Roberts. This included daily incremental backups and a weekly backup of the entire system, which was pushed to the cloud. The extent of the retained cloud backups (the tail) was limited by the amount Mr Robertson Mr Strickland were prepared to agree with respect to ongoing expense for offsite data storage, namely £350 per month. Whilst it would have been technically feasible to retain multiple weekly backups going back in time, this would have required the Respondent to pay for more storage. We pause to note this important document, which captures the backup system approved by the Claimant’s managers was provided by the Respondent when answering the Claimant’s data subject access request (“DSAR”) but appears not to have been found in the course of the Respondent’s investigation when Mr Witney was accused of gross misconduct, including for having failed to implement an appropriate backup solution.

[102]Separately from the risk of external attack, the Respondent had also been undermined from the inside. At earlier times, departing employees were believed to have copied and taken away the Respondent’s commercially sensitive confidential information. The Respondent’s senior management team were very anxious to prevent a repetition of this and sought the assistance of Mr Witney. Having investigated various different options, the Claimant recommended the Respondent purchase the Darktrace product. This included both software and hardware components. Amongst other things, Darktrace would monitor all network traffic and build up a profile of user activity over time. Once the profile was complete, Darktrace could then flag any unusual usual activity, such as a user starting to copy large quantities of the Respondent’s data when this did not appear to be something which fitted their regular pattern of use. Darktrace also provided protection against external threats, although that was not the principal driver behind its acquisition.

[103]The Claimant began negotiating with Darktrace at the end of 2019. The costs associated with this product and service were substantial and depended upon the number of users on the Respondent’s IT system. Terms were agreed in February 2020 although the purchase did not complete until April 2020, as this was desired by the Respondent for accounting reasons, albeit the installation commenced before this point.

[104]One of the Darktrace components was Antigena. This provided an automated response to unusual system activity, whether internal or external. The measures implemented might include preventing a device from accessing the network or limiting the flow of data. Prior to switching on this automatic response, the Claimant decided to leave Darktrace in “human” mode whilst it was building up a picture of network traffic, which might take a number of months to complete. During this time Darktrace would send email alerts to Mr Witney, triggered by network activity. He could then look at the alerts and decide whether to take action on them or not. He was concerned that the measures taken by Antigena when it was still building up a picture may be unpredictable and he did not want network traffic to be throttled unnecessarily. Furthermore, the use of Darktrace to provide protection from external threats was secondary to preventing data theft.

[105]From March 2020, Mr Witney was tasked with facilitating a very large increase in homeworking, as a matter of urgency. He was required to put other projects on hold and focus upon setting up Remote Desktop services. These various projects included: Cyber Essentials Plus; telephony; Solidworks 2000; service desk system; and additional network points. Whilst his approach in delaying Darktrace was the subject of criticism on behalf of the Respondent in these proceedings, we accept his instructions from Mr Roberts and Mr Strickland at the time were clear. Mr Munro’s characterisation of this as “waiting for laptops to become available” is neither accurate nor fair. We accepted the evidence of the Claimant. He had to implement and rollout remote desktop services (“RDS”) for a large number of employees. He had to source and obtain software and hardware in this regard. This was, of course, an exercise in which many businesses were then actively engaged, nationally and internationally. He did not simply wait for supply of the same to fall into his lap. Rather, he searched high and low, utilising his many industry contacts. The use of a 180 day trial licence for Remote Desktop services was approved by Mr Strickland and Mr Roberts. Setting up users on laptops, such that they could access the Respondent’s Systems in the same way as if physically on-site, was a complex and timeconsuming process. Some users required a great deal of support and assistance. Mr Witney recognised that RDS, which depended upon a public / internet facing server, created an increased security risk. This access point might be used by external hackers to penetrate the Respondent’s IT systems. In order to militate against this risk, the Claimant recommended and the Respondent agreed he would install two-factor authentication (“2FA”). Such was the urgency with which homeworking was required, the Claimant was instructed to commence RDS whilst 2FA was still being setup and put into place, which took about 2 or 3 weeks to complete.

[106]By the beginning of April 2020, 2FA was up and running. Remote access was obtained by the Respondent’s employees by way of a username (their email address) and password, which had to comply with conventions as to its length and complexity. In addition to their login credentials, however, users had to enter a code (the second factor) generated by an authentication app on their mobile phones. Whilst some users adapted to the new process with ease, they were in the minority. The greater number struggled and some positively objected. In the face of such objections, Mr Bryant suggested 2FA be deactivated at least for some individuals. Mr Witney did not agree, as he was acutely aware how important this security measure was for the Respondent.

[107]We preferred the evidence of Mr Witney over that of Mr Bryant. Mr Witney was a clear and direct witness. He was at times, as observed by Mr Griffiths in closing, somewhat overeager to answer the questions (i.e. he would not wait for the question to finish before launching into a vigorous answer). Mr Bryant was a, somewhat, less satisfactory witness. Many of his answers were inconsistent or unclear. He appeared, at times, to struggle with relatively straightforward questions. Whilst Mr Munro argued in his closing submissions that Mr Bryant was every bit as capable as the Claimant in matters of IT, this did not accord with our assessment of his answers to questions of a technical nature. There were repeated instances when Mr Bryant’s answers simply failed to engage with the questions asked. Mr Bryant said that 2FA operated intermittently, giving the impression there were times when it was not applied. When pressed on this, however, Mr Bryant said he meant that some users were unable to get the authentication application to work on older mobile phones, rather than that users were able to gain access without the second factor. Mr Bryant also said the password complexity policy set by the Claimant was not adequate and appeared to explain not having raised his concerns contemporaneously on the basis he did not what the policy was at the time. Yet when it was pointed out he would have needed to know the password conventions to assist employees in resetting their passwords, he accepted he must have known this.

[108]The Claimant met with Mr Göztürk early in the latter’s employment. Mr Göztürk considered himself knowledgeable in IT matters and had clear ideas about areas where he was looking for development or improvement. As their discussion proceeded, Mr Göztürk made notes on a whiteboard. In order to ensure he had a copy of these items, the Claimant took a photo of the board. Separately from their respective views on matters of IT, an issue arose about file access. Mr Göztürk wanted access to all of the Respondent’s engineering files. The Claimant said he was unable to give him access to files belonging to the Ministry of Defence (one of the Respondent’s clients). Mr Göztürk was unimpressed and said that no-one would tell him how to run the company. The topic of backups was touched upon only very briefly. It was not something Mr Göztürk noted on the board. Mr Witney explained there were “backups of backups”. This statement was factual, as the onsite backups were themselves backed-up to the cloud. Darktrace was not discussed. The implementation of this product was not then a priority, the Claimant did not raise it and Mr Göztürk did not ask. Mr Strickland was, of course, fully aware of Darktrace.

[109]In May 2020 the Claimant produced a report for use at the Respondent’s board meeting. He provided this to Mr Strickland. The evidence given by Mr Göztürk and Mrs Warner was to the effect that Mr Strickland did not include the Claimant’s IT report in the pack for use at the Board Meeting. This struck us as very odd. No satisfactory reason was advanced for why Mr Strickland would have failed to include the IT report in the pack. The bundle of documents for this hearing did not include a copy of the board pack the Respondent says was prepared. Clearly the Respondent was in possession of the report, as it was provided to the Claimant in response to his DSAR. We have made no finding one way or the other as to the inclusion of the Claimant’s report in the board pack. We are, however, certain it was in the possession of the Respondent, the Claimant having provided it to his line manager.

[110]The Claimant’s May 2020 report comprised an update on IT projects, generally. This included Darktrace: We have installed Darktrace which monitors all user and device behaviour on our network. This enables the system to build a profile for each user and device and identify any abnormalities. Any ransomware attack will be identified and killed as soon as it starts. In the past we have had "data leaks" where company data has been copied by people who intend to leave the company, this type of behaviour will be flagged as soon as it happens. This is a major plus in us obtaining Cyber Essentials Plus.

[111]Notwithstanding the Darktrace project was not a priority at this time, Mr Witney was in email correspondence with its provider, about the installation of their product, both software and hardware. The implementation of Darktrace remained incomplete and in “human” mode at the time of the Claimant’s furlough, which followed shortly thereafter.

[112]On or shortly before 9 June 2020, Mr Göztürk decided to place Mr Witney on furlough. He told Mr Strickland, it would give Mr Bryant an opportunity to take the lead in IT. A number of factors influenced Mr Göztürk’s decision: the Claimant and he had got off to a bad start when the former refused to release files to the latter; the Claimant was one of the higher paid employees and placing him on furlough would bring a saving to the Respondent; Mr Göztürk believed he was knowledgeable in matters of IT and expected Mr Bryant would step up to the task. Asked whether it struck her as odd that Mr Witney, the Head of IT, was being furloughed rather than his junior, Mrs Warner said she assumed it was due to the “cost”, which we accept was part of the decision. Mrs Warner also confirmed that no other head of a department was put on furlough.

[113]Given the Respondent’s increased reliance upon IT at this time, the decision to place the Claimant on furlough is somewhat surprising. The Respondent’s internal resource was extremely limited (just Mr Bryant) and there is no evidence of Mr Göztürk exploring the provision of support from Cloud Systems in the Claimant’s absence.

[114]Mr Witney was told of the decision to place him on furlough at about 1.30pm on 9 June 2020. This meant he would be leaving the business later that day. As such, he had circa 3 hours’ notice before he left. The Claimant telephoned Mr Bryant (the latter was home working at this time) to tell him of the decision.

[115]There was not much done by way of a handover to Mr Bryant. There were two reasons for this. Firstly, given the lack of notice, the Claimant had no opportunity to prepare any handover. Secondly, Mr Bryant was not the Claimant’s equal, professionally. It was not the case that when the Clamant had been absent from the business previously, that Mr Bryant covered for him. Rather, at such times Mr Bryant continued with the provision of first line support and Cloud Systems were brought in to carry out the Claimant’s higher level tasks. The Claimant could not handover his duties to someone who was not equipped to discharge them. Mr Munro’s proposition that Mr Bryant was every bit as capable as the Claimant in matters of IT is undermined by the answers Mr Bryant gave when in the course of cross-examination, the Claimant’s various tasks and projects were put to him and in large measure he agreed these were not matters he could have dealt with.

[116]Mr Witney also called Cloud Systems. He told Mr Heappey of the decision to place him on furlough. They discussed the implementation RDS. The Claimant had been working on published applications, which referred to how software packages would appear to and be accessed by remote users. He asked for support to be provided in finishing that. Mr Witney also asked that Cloud Systems keep an eye on Mr Bryant and give him help if he got stuck.

[117]The letter on 9 June 2020 advising the Claimant of furlough said his employer may require him to return to work at short notice.

[118]On 25 June 2020, Mrs Warner advised Mr Bryant that in the absence of Mr Witney, he had authority to reset any domain, local, admin user accounts in order to support IT services for business. Under the terms of CJRS the Respondent was unable to rely upon Mr Witney. A letter was sent to Mr Witney informing him of the position: As a courtesy to you, I wanted to make you aware that due to strict ruling which prevents us from being able to seek any input from you during your furlough leave, it has been necessary to re-set domain, admin, local or user accounts to enable Simon Bryant to fulfil the requirements of the function. I can assure you that security will not have been compromised and only Simon now has access.

[119]It follows that Mr Bryant was then able to make any changes he wished to the settings of the Respondent’s IT systems. Furthermore, Mr Bryant already had access to all of the passwords, as this was something he had been given at the start of his employment. Mr Witney had explained the rationale for this as being in case he was “run over by a bus”. Mr Bryant’s evidence on this point was unsatisfactory. He initially denied having access to the passwords. Then when the Claimant’s case was put, he conceded he was given access to these passwords (stored in a locker application) at the start of his employment. He then went on to say he lost this access but did not raise such loss with the Claimant or ask for it to be restored. His evidence on this point was unclear and unsatisfactory. We are satisfied Mr Bryant had access to the passwords at all times. He could and should have been monitoring the Claimant’s email inbox.

[120]On 11 July 2020, the Respondent suffered a devastating Ransomware attack. Hackers breached the Respondent’s IT system, encrypted its data and demanded a ransom in exchange for providing the decryption keys. This attack had started shortly before the weekly backup was due to be made. As a consequence, by the time the attack was discovered the previous week’s cloud backup had been overwritten by newly encrypted data and could not be used to restore the system.

[121]Notwithstanding Mr Witney’s furlough letter had expressly reserved the right to bring him back on short notice and this might have appeared a time of great need, the Respondent did not utilise that.

[122]On 27 July 2020, Mrs Warner wrote to Mr Strickland. Her email included: I'd also be grateful to understand if there is any input that I can give regarding the Cyber attack. It sounds like it's been full on. I did have an initial discussion with Emrah when it first came to light and it sounded like there was a potential employee matter to address, so it would be good to catch up on this too.

[123]We are satisfied the “potential employee matter” referred to a disciplinary case against Mr Witney. Blame was being attributed to him for the cyber attack. Given he had been on furlough for more than an month, Mr Bryant had been in charge and the latter was said to have reset the admin accounts, this conclusion appears somewhat premature. On the other hand, if Mr Witney were not to blame in some way, that might cast doubt on the wisdom of the decision to dispense with his services.

[124]In an email of 30 July 2022, Mr Strickland set out a detailed chronology of the cyber attack and this included: Monday 13th July - IT down, ransom attack identified expectation that non-encrypted back up available to reload onto the system - expected recovery time was 2 days. It was identified that the off site backup in the cloud (which is for disaster recovery in the event of a fire) had backed up the encrypted system over the course of the weekend. Encryption identified as starting COP Friday 6pm 10th July therefore, daily offsite backups were backing up an encrypted system over the course of the weekend. Insurance company was notified COP Monday. Engagement with: 1) CFC- Underwriters 2) NCC - Forensic and recovery team 3) Coveware - attacker liaison based in Connecticut 4) Kennedys - Legal advisors Internal parties: 1) STTIT 2) Cloud solutions 3) Latter: Epicor/ Jerry/Epaccsys

[125]Mr Strickland’s email had a diagram intended to represent the route taken by the hackers into the Respondent’s network. This must have been provided by NCC (rather than being something of his own devising). He also included a short summary: This is what happened! This was an opportunistic attack via the remote server network. During this time the system under went c23K attempts to get onto the network. The malware was clever in that it looked for admin accounts and then looked at server footprints to identify potential admin passwords as well as trying common passwords. The password that got in was 'Bananal4' - unknown who set this but it's not complex enough! The malware also had a network scanner which is why it was able to get into our convoluted IT system and wander all over it. It is also confirmed that no activity relating to extraction of data has been identified (ISP speeds, zip files etc) and therefore safe to conclude data was not extracted from the business.

[126]Mr Strickland’s email did not include anything about account lockout threshold (“ALT”) the number of password attempts allowed before an account is locked, or account lockout duration (“ALD”) the time for which an account is locked before further passwords may be attempted. Nor did he say anything about 2FA, whether this was in operation and if so, how it was circumvented. Once again, it appears likely this summary and the matters commented upon or not was prepared on the basis of information from NCC.

[127]Mr Strickland’s email detailed the negotiations with those who were holding the Respondent’s data ransom, payments made to the criminals, receipt of the decryption keys and restoration of the data in stages (99% by 30 July 2020).

[128]In August 2020, NCC provided a “forensic report” based upon their investigations. The copy of the report included in the Tribunal hearing bundle was the same as at provided to Mr Witney during subsequent disciplinary proceedings. It is very heavily redacted. Indeed, so little of the report’s content remains visible that it’s probative value is limited. The summary includes: Following the successful RDP logon using the compromised local Administrator account, the attacker [redacted] […] The analysis of event logs acquired from the provided hosts allowed NCC Group to create a high-level diagram of attacker’s lateral movement activity on the Sterling network. This diagram showing the initial entry point in dark grey colour can be seen below in Figure 1 - Attacker's Lateral Movement Activity. [diagram redacted, although it is likely Mr Strickland inserted this into the body of his email of 30 July 2020] […] It should be noted that the effectiveness of this investigation was significantly affected by the [redacted]

[129]Whilst the basis upon which the successful attack occurred cannot be discerned from this heavily redacted report, the advice on remedial steps is visible: 1 .4 Containment & Remediation In order to fully remediate an incident, actions need to be taken in quick succession to prevent an adversary re-entering the network and ensure the environment is adequately secured preventing known beacon/backdoor activity. The following actions have been derived from a range of sources including IOC’s from the investigation but also threat intelligence acquired from NCC Group’s research team. Remedial actions should take place simultaneously at a pre-agreed time to ensure complete eradication of the threat actor. The following actions have been derived from the threat actor’s activity identified during the engagement 1 .4.1 Implement a Robust Password Policy of 16 Characters or More Implementing a strong password policy will assist in preventing common password based attacks and decreases the success rate of brute-force attacks considerably. It is imperative that a password policy is established prior to resetting account passwords. 1 .4.2 Reset the KRBTGT Account Password Twice To fully a revoke a golden ticket, KRBTGT account passwords must be changed twice. Microsoft provide a script to assist in completing the password change. 1 .4.3 Implement Multifactor Authentication (MFA) for all Externally Accessible Accounts All accounts should be forced to adopt MFA to log in externally to Sterling’s services. 1 .4.4 Block the Following lOCs on Security Appliances The following domains, IP Addresses and hashes should be blocked and any attempts to access them should be investigated. Full IOC list is provided in section 3.3.

[130]We pause to note, the recommended steps do not include setting a value for ALT in the group or local password policy. Had ALT been found to be zero, whether on a compromised local administrator account for otherwise, we would have expected remedial advice to set a value for this of, say, 3 or 5, so as to frustrate a brute force attack. Whilst the report does recommend requiring passwords of 16 characters or more, no comment is made on the previous policy in place during the Mr Witney’s tenure, which required 8 characters, including upper and lowercase letters along with a number. Indeed it is unclear whether that policy was found still to be in place when the forensic investigation was carried out. We also note the recommendation to implement MFA for all externally accessible accounts. This is somewhat surprising. 2FA (a form of MFA) was in place when the Claimant went on furlough, yet this recommendation would tend to suggest it was not found or not operative when the attack occurred. All witnesses before us agreed 2FA would have prevented an attack of this sort. Finally, we note there is no mention of the password “banana14”, to which we will return later in this decision.

[131]The forensic report was prepared for the Respondent’s insurers. It was not intended to be an investigation into the conduct of Mr Witney. The authors do not, therefore, appear to have addressed the actions he took and, importantly for present purposes, when any relevant changes to the system were made or vulnerabilities introduced (i.e. during the Claimant’s tenure or after he went on furlough).

[132]By the beginning of September 2020, at latest, a decision had been made by Mr Göztürk to terminate Mr Witney’s employment. The only question was the mechanism by which this would be achieved, namely redundancy, misconduct or a negotiated exit. On 3 September 2020, Mrs Warner sought the redundancy costs for Mr Witney based upon a termination date of 30 September 2020. She forwarded these to Mr Göztürk saying: If we dismissed him on grounds of gross incompetence we would not pay him the redundancy element. There is a small risk that we are unable to produce the evidence to demonstrate he is culpable for the cyber-attack, let’s say he provides evidence that Graham blocked him on spending money to protect us etc. Whilst we have the argument that he lied to you, he could argue a mis-understanding etc. It might be preferable to consider a settlement agreement which would result in adding potentially £5-10k so similar value to redundancy.

[133]Mrs Warner was giving advice she believed the Respondent was in strong position to dismiss Mr Witney for gross incompetence, on the basis that he had failed to implement sufficiently robust protections for the Respondent’s IT system. As an alternative, she advised the Respondent could argue that he had lied to Mr Göztürk about the backup solution in place, although she thought this potentially weak on the basis the Claimant would say there was a misunderstanding. We pause to note that what we have found the Claimant told Mr Göztürk about backups was entirely factual. The other option was redundancy, albeit with associated costs.

[134]Mr Göztürk replied to this, saying the Claimant should be dismissed for redundancy. In response, Mrs Warner wrote: Ok fine. If you can discuss with Peter that he and Sarah meet Ed to initiative the proposal that his role “may” not exist in a revised organisation structure for IT. This can formulise the first consultation meeting. I will check with Sarah that she is up for this. Timing wise, Sarah is back from her short break on Wednesday 9th but there is a possibility that she may extend this if she feels that she needs more time to rest. Failing that, I could support Peter to manage this meeting. I will need to send out notification letter to Ed tomorrow as I will be out of the office Monday and Tuesday next week also. Peter may well say the day before board will be difficult to fit in but I will let you handle that. Providing I have the business case for the change, there will not be too much prep work to be honest. We then have to listen to his responses in a follow up meeting. We note the word “may” is in quotation marks. Given this was written in response to instruction from Mr Göztürk that Mr Witney should be dismissed as redundant from 30 September 2020, it evidences an intention to tell the Claimant his position was merely at risk, when in truth a decision to dismiss had already been made.

[135]By letter of 15 September 2020, Mr Strickland was dismissed. The Respondent’s letter to him set out numerous concerns over three pages, including with respect to IT: Failing to deliver the IT audit, despite my requesting it twice since you advised me on my first day in April 2020 that it was being planned. This failing potentially could have identified our system vulnerabilities and averted the recent near catastrophic cyberattack.

[136]On 17 September 2020, Mr Woodman, was brought in as interim Financial Director, by way of his own service company. He had previous experience working for the Respondent, during which time he had found the Claimant to be a combative person. One of his first steps, was to commission an audit of the Respondent’s IT systems.

[137]We are also satisfied that Mr Woodman expressed a strong view that the Respondent continued to need an IT manager (an unsurprising opinion given the recent attack) and could not, therefore, make the Claimant’s role redundant. In response to this, Mr Göztürk decided the Claimant should be dismissed for misconduct. To this end, Mr Göztürk set about developing the grounds for such a dismissal and put these in an email of 14 October 2020:a. Tony Heappey (cloud systems) told me during the cyberattack that Ed had asked him to whitelist some IP addresses for a spoof emailing program so it can send spoof emails from our server. I have asked Tony to blacklist those addresses with immediate effect. Beside a potential vulnerability and data leak risk, I believe this is unethical. My understanding is that the mentioned system (program) Ed implemented has been sending users fake emails to trick them to click on some links to expose whether they are falling into those things. (@Mark Woodman, this might be the Darktrace invoice you are chasing) 2. Backup Systems a. When I questioned Ed before his furlough, I have asked him about the security of the backups. He ensured me that there is a local back up server, and offsite backups (plural). I was led to believe there were multiple backups offsite, which proved not the case. Our major setback during the cyberattack was that our backup system got corrupted and we haven't had any opportunity to use backups. The backups were overwriting itself, so the corrupted files in the local server wrote over the backup server over the weekend of attack. This put us in a critical position as we had no means to recover our data other than getting recovery keys from the hackers. We were lucky that their keys worked, as this is not always the case. The whole recovery got delayed and caused higher costs (ransom payment, lost time of the business). I was told by Tony that this were not the recommended backup method from their end but Ed had cut the budget therefore reduced the scope. a. I was given the list of a user group called Zendto users that had administrative privileges on our domain. This user group has been removed from the system following cyberattack. I found out that this was an open source file transfer software. Ed had allowed users to have admin privileges to use a free file distribution service, therefore risking the integrity of our system. 4. Cyber Essentials non-conformances: I have gone through the cyberessentials certification Ed has done for our business. This is required for us to continue our Defence work (worth millions to the business). a. Software Firewalls: The certification requires all devices (laptops, tablets etc.) to have software firewalls enabled. The laptop I was given has windows firewall disabled. I learned this was common practice and was instructed to build them this way by Ed.

b. Admin Password management: The certification asks for a "formal written down process for deciding to give someone access to systems at administrator level". Ed has specified in this certification step that "The only accounts with administrator access are in IT and full Administrator password is known to the IT Manager as well as recorded in a list in a sealed envelope locked in company safe, all except the Domain Administration passwords are stored in an application (Keepass) and secured by two factor administration." We have seen that the ZendTo users were given admin access (non-conforming), I could not locate a company safe with passwords (still looking). On top of that, Ed had used a basic password (Bananal4) for the local admin on computers without a formal process. I was given by him a local admin password without a formal process so I could install some software, and you can guess, the password was Banana14. He told me at that time that it poses no risk to the business as it's just a local admin. This is how we got hacked. Hackers used this weak password on one of the machines as first point of entry. 5. Unlicenced Software: Finally we are getting our full IT audit done, and one of the findings I was told is that there are about 26 server applications without software keys applied to them. I don't know for sure, whether the business haven't bought the licences or have bought them but forgot to apply them (sounds fishy). This appears to be that this software is "pirate" software, and if correct it's a criminal offence to use them (Directors can go to jail). The final audit report is due shortly, which should clarify this final topic. Upon the above, I leave it up to you and Peninsula to decide on the correct course of action.

[138]As far as white listing is concerned, we do not understand the criticism. This was part of a penetration testing exercise (paying an external service provider to attempt to penetrate your IT system). This a prudent step undertaken by many businesses. This was not something commented upon by NCC, adversely or at all. We also note that at a later stage, Mr Bryant himself engaged a third-party to conduct penetration tests on the Respondent’s IT systems. As far as backups were concerned, there were multiple offsite backups, daily incremental followed by the entire system once a week. Unfortunately, in this case, the cyber attack began shortly before the weekly backup and so the previous week’s good data was overwritten with useless information. Mr Göztürk does not say (and we do not find) the Claimant told him that complete backups stretching back a number of weeks were maintained in the cloud. The amount of offsite data storage was dependent upon how much the Respondent was willing to pay for this, which had been settled before Mr Göztürk joined the Respondent. Mr Göztürk does not appear to have made any enquiry of the Claimant or to have looked at documents in the Respondent’s possession, which recorded the backup solution approved by the senior management team. Mr Göztürk does not explain the source of his information that a group of users were given admin access in order to deploy Zendto. This is not something supported by the NCC report, or any other source to which we have been referred. Cyber essentials includes several points. Whilst Mr Göztürk refers to Windows firewall being turned off. He neglects to mention the Respondent used a different firewall system. As for password management, to the extent that Mr Göztürk complains about him being given an administrator password of banana14 so that he might install software, plainly this is something he was aware of before the cyber attack and did not then consider to involve any misconduct on the part of the Claimant. There was no evidence that the first point of entry to the Respondent’s IT systems (i.e. the RDS server) had an admin account with the password banana14. That particular admin password was on a local server, which ran old DOS programs relating to engineering drawings, into which that admin password had been coded. We do not understand how Mr Göztürk had come to this conclusion. Finally, the reference to pirate software is misconceived. This complaint appears to refer to applications without current licences. There was no evidence of the software being counterfeit. Some of the applications in use at this time had been purchased when Mr Witney was setting up remote working, including short-term or trial licences. That such licences were not renewed after his departure on furlough, can scarcely be a criticism of the Claimant. We have explored Mr Göztürk’s reasoning at some length, notwithstanding the points set out here do not entirely mirror the grounds subsequently relied upon to justify Mr Witney’s dismissal, and have come to the conclusion the Claimant is correct when he says the Respondent “threw the kitchen sink” at him in order to secure a dismissal. Mr Göztürk has set out at a series of weak and in some respects entirely unjustified conclusions, to support that end. He was no doubt hopeful the Respondent’s employment law advisors, Peninsula, would support dismissal.

[139]Mrs Warner replied to Mr Göztürk later that day, saying his account provided a strong case for gross misconduct and there was already sufficient detail to move forward with this.

[140]On 25 October 2020, Mrs Warner wrote to Mr Woodman with advice in connection a number of employees. As far Mr Witney was concerned she said:• Ed - Mark to call him to inform of the Company announcement and explain that whilst his role is not impacted by the restructuring, there are concerns regarding his performance which warrant an investigation. Full details of the areas of concern will be included in writing and an invitation to attend an investigative meeting will be sent to him by the end of the following day. Investigation will be conducted by our employment advisor partners Peninsula.

[141]A letter was sent by Mr Woodman to Mr Witney the following day, advising he was not at risk of redundancy but would be investigated in connection with various allegations: […] However, I do wish to forewarn you that some concerns have come to light which need investigating. Whilst you have been on furlough a number of concerns with the IT system have been flagged, which has given us serious cause for concern. We will need to investigate these issues with you, and we will be in touch in due course to arrange an investigation meeting. This has been brought to our attention following the cyber-attack on in July, which has led to these internal investigations. I have included below a number of areas for concern, which will be addressed with you at a meeting. A separate letter, with an invite to the meeting as well as more specific allegations will be sent to you very shortly. 2. Back-up systems 4.Cyber essentials non-conformances - Software firewalls - Admin Password Management 5. Unlicenced Software 6. Lack of contracts with Cloud Systems 7. Dark trace

[142]The alleged misconduct largely reflected Mr Göztürk’s email of 14 October 2020. There was, however, an additional allegation, namely lack of contracts with Cloud Systems. We have not been told who thought this up. It might be that it stemmed from Mr Bryant saying he had been unable to obtain support from Cloud Systems. The Respondent had received some ongoing services from Cloud Systems, for which a regular fee was paid. The Respondent received other services from Cloud Systems on an ad hoc basis, as and when these were required, at which times a fee would be agreed. Mr Bryant sought assistance from Cloud Systems in the aftermath of the cyber attack and says this was not forthcoming or at least not the extent he had hoped for. When Mr Witney was IT manager, he was able to call upon Mr Heappey of Cloud Systems for unpaid advice from time to time, with the latter acting as a sounding board. No doubt Mr Heappey was willing to do this as a result of their long professional relationship and in the hope of future paid work. More extensive requests for IT support from Mr Bryant, without any offer of immediate payment or indication that future paid work was likely, may have been a less attractive proposition. We cannot, however, see how the contractual position with Cloud Systems as at July 2020 can be a matter of misconduct on the part of the Claimant. He did not misrepresent the arrangement with Cloud Systems. The need for more ongoing support was an obvious consequence of the Respondent dispensing with its IT manager. There would seem to be no obvious reason for the Claimant to have entered into a contract for services of a sort and in a volume not required when he was supporting the system.

[143]As the disciplinary matter against Mr Witney progressed, there was a degree of ebb and flow with respect to the allegations, with allegations being withdrawn (presumably because they were believed not to be strong enough) but then replaced with others, thereby maintaining a high number of charges. This is consistent with the Respondent’s wish to secure the Claimant’s dismissal and then defend any subsequent claim for unfair dismissal.

[144]In October 2020, Mr Woodman learned of Darktrace as a result of receiving an invoice. He spoke to Mr Bryant about it, who said he had little knowledge. Subsequently, Mr Bryant received training and assistance from Darktrace to manage the implementation, in particular setting the Antigena component to automatic mode. Mr Bryant was initially fearful of taking this step because he was concerned it would disrupt network traffic and block access to servers but went ahead, having been assured by Darktrace that any measures implemented could be reversed. We pause to note, by this point Darktrace had been running for several months during which it had an opportunity to build up a picture of the Respondent’s typical network traffic. It had also captured an atypical event, namely the cybersecurity breach. The position was not, as Mr Munro said at this hearing, that Darktrace had not previously been “installed”. Installation took place in or before April 2020.

[145]On 26 October 2020, Darktrace provided a report with information from their systems about the ransomware attack: Antigena Settings Matt and I have just spent some time reviewing the Sterling TT UI and settings, and I can confirm Darktrace Antigena Network (autonomous response capability) was set up in Human Confirmation mode over this period. This means Ed would have received notifications for Antigena responses which he would have been able to 'decline' or 'accept'. July attack On reviewing the UI, we can confirm that Darktrace saw what we believe to be the full cyber kill chain of the July attack, Ed would have received multiple Antigena Network actions in Human Confirmation Mode at various stages of the attack cycle. As an example, please see attached screenshot of a device exhibiting ransomware like behaviour, very shortly after the unusual activity begins, Antigena recommends an action to 'Quarantine device for 24 hours'. Our in built Al analyst also created a number of summary reports of the activity. I have attached an example that shows the initial Scanning of devices, followed by a large number of SMB login failures to multiple devices, then a suspicious chain of administration connections, and lastly the encryption of files over SMB. Ed would have received real time notifications for this activity as it played out in real time, and there would have been accompanying Antigena Responses available for Ed to 'accept'. This report does not include the Antigena responses to this activity, but we can go through this with you on the UI if that would be helpful at all. We note Mr Witney could not receive any emails from Darktrace whilst he was on furlough.

[146]By letter of 29 October 2020, Mr Witney was advised he was suspended on full pay from 1 November 2020.

[147]On 3 November 2020, Connect Systems provided an audit report on the Respondent’s IT system. The report addressed the sufficiency and suitability of the Respondent’s current setup and made recommendations for how this might be improved, along with offering to implement the same and provide future services. The audit was carried out several months after the Claimant last touched the system and following a rebuild, necessitated by the cyber attack. Connect Systems were not tasked with investigating the Claimant’s conduct and any steps he took or failed to. As far as backups are concerned, the report noted: You use URBackup to backup your server environment. This is a free open source backup solution, we wouldn't expect to see this in a company of your size and if there are issues the support would be limited. Simon tells us you are backing up approximately 22TB of data The current backup strategy is not clear and or documented There is an online backup to Cloud Systems, however in the latest breach, this was compromised also. This could have been prevented by either Insider Protection or implementing a tape drive so that you have an offline copy of your data and an archive of historical data. From the reference to the backup strategy not being documented, it is apparent the report’s author was not provided with the document in the Respondent’s possessions which we have already referred, describing the agreed solution.

[148]The Connect Systems report commented upon the cyber attack:• The most recent breach was due to the fact you had an internet facing Windows Server 2003 VM, with the old domain setup and vulnerable accounts. This is still active, however the remote access appears to have been disabled, this needs decommissioning as soon as possible.

• You have a number of Windows Server 2008 R2 VMs running, these are no longer supported and as such aren't receiving any Windows Updates / Security Patches, leaving you vulnerable. The services running on these servers need to be migrated elsewhere and the servers decommissioned. The initial comment about how and why the cyber occurred is, plainly, the result of mistaken information having been given to Connect Systems by the Respondent. Connect Systems do not appear to have been provided with a copy of the forensic report. The Windows Server 2003 virtual machine was not “Internet facing”. The only Internet facing access point to the Respondent’s network was the RDS server, which required and was running a much later version of Windows. The Connect System report continues by saying “the remote access appears to have been disabled”. The obvious reason for such remote access to have been found disabled is because it had never been enabled on the 2003 VM. From the summary in Mr Strickland’s email it is apparent the point of entry found by NCC was the RDS server and only thereafter, did the attack search for and breach a local admin account. In connection with the provision of inaccurate information, whereas Mr Bryant is expressly referred to as the source of much of what Connect Systems were told, Mr Witney was not spoken to at all.

[149]The report from Connect Systems noted that Sophos firewalls were installed at both of the Respondent’s sites.

[150]The Connect Systems report included a section on password policies. The current password policy was found to require a minimum of 8 characters and meet complexity requirements. ALT was set to 0. The report’s authors observed: - This is a good basic password policy, however critically you do not have "Account Lockout threshold" enabled and we would recommend this is enabled. This stops hackers using a brute force attack to compromise an account on your network. It changes the amount of time to crack a password from seconds, minutes and hours to number of years or decades. - We recommend the following policy work be carried out: o Implement screen locking after a set time the device is idle, this protects user devices if they are left somewhere or they walk away from their machine. o The most recent compromised password is still in use on some systems and should be changed immediately. o Review admin accounts and disable all that are not required. Change passwords on all of the admin accounts following the departure of incumben o The password security advise these days is to use a [redacted] o End User Training is strongly recommended, we use a service called KnowBe4 which will train users on what to spot on malicious emails and websites and general best practice working from a security point of view. We can also carry out simulated phishing attacks to assess staff competency and assist with training. o We would spend a couple of days reviewing network policy to tidy it up and make sure it is easily manageable from anyone IT literate, spending time with Simon to get him up to speed on it.

[151]The report does not say when ALT was set to 0. The change logs were not examined. Connect Systems were auditing the current setup and making recommendations, they were not seeking to identify whether or not the Claimant was at fault in this regard. We also note the simulated phishing attack recommended appears to be a similar exercise to that for which Mr Göztürk had criticised the Claimant, under the heading “white listing”. Furthermore and despite the Respondent having been aware for many months that banana14 was the compromised admin password, this had still not been changed. Whilst this was considered something that would support the dismissal of a long-standing employee, Mr Bryant had not changed it nor had Mr Göztürk or Mr Strickland given instructions that be done.

[152]As far as remote access was concerned, the Connect Systems report noted: Remote Access You use Remote Desktop Services farm made of 4 servers and use Duo two factor authentication for security. There are only 2 servers that the users actually connect to, the other two are a broker and a gateway; we would suggest this is a little light given the number of staff you have. You are currently using redirected folders on your laptops; this causes big issues when you are taking the laptops offsite as they can no longer access the server. We recommend: Creating two additional RDS servers to cater for the number of users. Disabling inbound VPN connections, this gives user devices direct access onto your network. Enabling Roaming Profiles for mobile devices-laptops will then have a local cache, removing the need to be network attached to function. It is apparent that 2FA (which would have prevented the successful cyber) was found to be back up and running.

[153]The final part of the Connect Systems report which is legible (the last few pages of entirely redacted) includes a risk assessment, set out with a colour-coded traffic light system. Amongst the highest priority (red) matters, the following was noted: We feel that Simon will need a lot of assistance with 2nd and 3rd line support particularly initially whilst we bring the systems under control This conclusion supports our finding about the relative technical abilities of Mr Witney on the one hand Mr Bryant on the other, along with the Respondent’s greater need for external support after having dispensed with its own IT manager.

[154]Backups were identified as another high priority concern: This is the biggest area of concern, the backup strategy is not documented, there is no offline backup of your data and in a recent cyber attack you were not able to recover from backup.

[155]Password policy was also one of the red traffic light recommendations: Not having a password lockout after X number of failed attempts is a big no no from a security point of view, this needs to be addressed as soon as possible. The administrator passwords need changing ASAP, particularly the one that was compromised, and we need to review what admin accounts are in use and if they are still required.

[156]Following a change to the CJRS, by letter of 4 November 2020 Mr Witney was advised that he would be treated as having been on furlough from 2 November 2020. He remained suspended. Investigation

[157]The Respondent asked its employment law adviser, Peninsula / Face2Face, to carry out an investigation.

[158]By letter of 16 November 2020, the Claimant was required to attend on investigation meeting. The allegations to be discussed were set out follows: 2. Back-up systems 4. Cyber essentials non-conformancesa. Software firewalls

b. Admin Password Management 5. Unlicenced Software 6. Contract agreements with Cloud Systems 7. Disaster Recovery protocols 8. Authorisation, Installation and utilisation of Dark Trace Software This included a new allegation, namely number 7, disaster recovery protocols.

[159]The investigator was Duncan Rutter of Peninsula / Face2Face. He was in correspondence with the Respondent’s senior managers.

[160]By email of 18 November 2020, Mr Göztürk provided a statement to Mr Rutter: Shortly after I started, I had discussion with Ed concerning our IT systems and security. One of the specific topics I discussed with him was why we are having so many servers on site and how safe our backup systems were. He explained to me that there is a local back-up server, and offsite backups (plural). I was led to believe there were multiple backups offsite, which proved not the case. I asked him also concerning the security of these backups and he told me that they were kept in professional server farms and are safe. I also asked for what kind of improvements he thought was necessary and whether we needed to spend more on any areas. He did not come about any specific one. Our major setback during the cyberattack was that our backup system got corrupted and we haven't had any opportunity to use backups. We found out that the backup was overwriting itself, so the corrupted files in the local server wrote over the backup server over the weekend of attack. This put us in a critical position as we had no means to recover our data other than getting recovery keys from the hackers. We were lucky that their keys worked, as this is not always the case. The whole recovery got delayed and caused higher costs (ransom payment, lost time of the business). I was told by Tony that this were not the recommended backup method from their end but Ed had cut the budget therefore reduced the scope.

[161]Mr Göztürk’s recollection of his conversation with Mr Witney about backups appears to have developed by the time of this email. We do not accept their conversation descended into detail about the security of the backups, server farms and whether the Claimant thought it was necessary to spend more money in this area. From the whiteboard photo it is clear that backups were at most a peripheral matter, as Mr Göztürk did not even consider it necessary to make a note in this regard. Furthermore, the suggestion that it was Mr Witney who “cut the budget” is an unrealistic one. The Claimant’s budget was set from above, namely by his line manager the FD Mr Strickland and whilst Mr Göztürk would not have been a party to that matter (it predating his own employment) we find it difficult to accept that Mr Göztürk would have believed the position to be otherwise. Mr Göztürk was attempting to cast the Claimant in a negative light.

[162]Also on 18 November 2020, Mr Rutter interviewed the Claimant. Despite only two days having elapsed (i.e. from 16 to 18 November) between the letter requiring his attendance and investigatory interview, the list of “incidents” about which Mr Rutter asked questions was not the same as that sent to the Claimant.

[163]Mr Rutter provided his final investigation report on Monday 23 November 2020. Given the Claimant had only been interviewed on Wednesday 18 November, there were a large number of allegations and the subject matter of this investigation involved matters of a highly technical nature, the turnaround speed is astonishing. He found a case to answer on 9 of the 10 incidents.

[164]Mr Rutter was not called as a witness in these proceedings. As such, there was no opportunity for him to be asked questions either about this swift timescale or any of the individual conclusions he reached.

[165]We will look more closely at the conclusions reached by Mr Rutter and the evidence available to him later in this decision, when addressing whether the Respondent carried out a reasonable investigation (i.e. an investigation that at least some reasonable employers would consider sufficient) before dismissing Mr Witney. Disciplinary

[166]The Respondent wrote to Mr Witney on 7 December 2020 requiring him to attend a disciplinary hearing on 10 December 2020 by videoconference. The allegations had been slightly reworked but broadly reflected the incidents in Mr Rutter’s report. The Claimant was provided with a copy of the investigation report and attachments. He was warned that the allegations were considered to amount to gross misconduct and he may be summarily dismissed. He was told of his right to be accompanied. The technical reports were redacted as they have been previously. In his evidence at the Tribunal, Mr Woodman agreed it was unfair to provide this material to the Claimant in this way, in circumstances where his job was on the line.

[167]The Claimant asked for an in-person hearing and more time to prepare. The Respondent acceded to this request, arranging for the disciplinary to take place in Birmingham on 14 December 2020.

[168]By an email of 11 December 2020, the Claimant requested various documents in order to defend himself:• All emails between either Cloud Systems, Graham Roberts, Sandra Saganowski and myself relating to the backup solution.

• All emails between myself and Cloud Systems relating to "White Listing" email accounts.

• All emails between myself Cloud Systems relating to Zendto.

• All emails between myself and Cyber Security, (including all reports)

• All emails between myself and Darktrace. November 2019 to June 2020

• All emails between Peter Strickland and myself.

• All emails from me relating to remote working and two factor authentication. March 2020 to June 2020

• All emails between Emrah and myself. From Emrah's start date

• All emails with monthly IT reports attached. Past 5 years 6 months

[169]Quite plainly, the documents requested related to the incidents Mr Witney had been questioned about and allegations he would face at the disciplinary. The Claimant was hoping to corroborate the explanations he had given previously. In circumstances where so little weight had been attached to his oral account at the investigatory stage and a preference made for evidence coming from the Respondent’s senior managers (to which we will return later in this decision) his wish for evidence of this sort was all the more understandable. Almost none of this material was provided.

[170]The Respondent having failed to make its own enquiry of Mr Strickland, Mr Witney wrote to him about furlough, receiving a reply on 11 December 2020 which he submitted for the disciplinary: You have asked me to inform you of the events that took place when you were placed on furlough. As of January 2020, it was decided by Grham Roberts, the previous CEO/MD that I would be your line manager. During that time, we had agreed actions in your employment appraisal which due to the requirements of the business during Covid were partially put-on hold with an IT audit being pushed back until STT were in a better financial position. The closing date for furloughing staff was Wednesday 10th June, as of the 9th of June I had already placed 2 employees within my team on furlough with a view of not placing anybody else on furlough. With the deadline looming Emrah had called me into his office following a lunch time stroll with Mark Jabri (Ops Director) on the 9th. During that discussion Emrah had said he had discussed with Mark about placing you on Furlough as it would give Simon an opportunity to take the IT lead. My response is that I did not agree with this statement as business continuity was key to ensuring STT's cash position improved (given the poor sales) and that in the past we had experienced IT outages when Ed had taken annual leave. However, if this was an instruction then I would place Ed on furlough, Emrah confirmed it was an instruction, I immediately expressed the same concerns and disagreement with Mark Jabri in his office prior to discussing the decision to place you on furlough with yourself. I then asked HR to complete the necessary letter to place you on furlough, my understanding was that this was with immediate effect and under the advice of the HR department. Around late July I received an email from the HR consultant Ruth Warner, who understood from Emrah that there was a disciplinary issue with yourself, this false accusation based on zero evidence. I had formally raised concerns to the shareholders over a number of incidences, which included this, which ultimately saw my contract of employment terminated. I also attach the reasons given for my termination; one paragraph implies that I was to blame for the cyber-attack I have prepared responses refuting these claims (based on no evidence) however, I need to priorities finding a new job with career prospects. I find the reasons inconsistent with the meetings held and dialogue had prior to receiving the termination letter, which was 10 days after my termination. The tactic appears to raise as many things as possible without evidence so that it becomes too costly to defend but I believe the process followed is neither fair or best practice.

[171]The disciplinary hearing went ahead on 15 December 2020. The decision-maker was Patrick Kiernan of Peninsula / Face2Face, the Respondent’s employment law adviser (strictly speaking, he would make a recommendation then it would be a matter for the Respondent decide whether to act on it).

[172]Subsequent to that disciplinary hearing, by letter of 4 January 2021 the Claimant was invited to a further disciplinary hearing (described in the letter as an “reconvened disciplinary hearing”) in connection with two new allegations: - Taking part in activities that causes the company to lose faith in your integrity, namely alleged serious performance concerns, resulting in an irrevocable breakdown in trust and confidence in your position as IT manager. Further particulars being it is alleged that your performance is not at the level we would expect from a manager with your experience and at your salary level. This has manifested in a number of concerns which have been discussed with you in the investigatory meeting of 18th November 2020. Further particulars being that the amount and seriousness of errors in your work (outlined in allegations 1-7 of the disciplinary invite letter dated 7th December 2020) has resulted in the company’s inability to sufficiently defend itself in the cyber-attack which took place on 11th July 2020 and which resulted in the company's data being stolen. - It is further alleged that the aforementioned cyber-attack resulted in a serious financial detriment to the company of £39,600 in ransomware to pay the hackers to retrieve the data, as well as an additional £47,200 in legal fees and breach reporting. The total identifiable costs of the attack amount to £86,800, as well as associated reputational and operational damage. The company alleges, that if proven, this amounts to a gross breach of trust and a fundamental breach of contract and will be considered as Gross Misconduct.

[173]We were given no clear explanation of the rationale for, at this late stage, the addition of two further allegations. It is difficult to avoid drawing the inference that it was intended to further bolster the decision to dismiss. An email of the same date from Mrs Warner to Mr Göztürk to Mr Woodman about securing the dismissal of Mr Witney provided: A quick update. I have had a very apologetic Face2face manager on the phone this morning confirming that they will do the follow up hearing using Patrick, without any cost to us. I'll be hearing later today when this will take place but they assure ASAP. This will secure a summarily dismissal subject to anything new coming to light of course. We continue to claim 80% of his salary so cost wise it's a smaller impact although more than we want to be paying I agree. This will get over the line hopefully by the end of this week. The reference to securing the Claimant’s dismissal and getting this “over the line” is further evidence of pre-determination in this matter. The apology from Mr Kiernan would appear to be for needing to meet with Mr Witney again.

[174]Mr Kiernan met with the Claimant for a second disciplinary hearing on 6 January 2021 and delivered his report on 11 January 2021. He was not called as a witness by the Respondent. As a result, we could not ask him any questions about the conclusions in his report.

[175]We will look more closely at the findings made by Mr Kiernan and the evidence available to him later in this decision, when addressing whether the Respondent had reasonable grounds to support a conclusion that Mr Witney was guilty of the alleged misconduct (i.e. whether the evidence obtained allowed for such a conclusion).

[176]Mr Kiernan upheld all of the allegations in full, save for one which was upheld in part only. Unsurprisingly, given the serious nature of the allegations, Mr Kiernan recommended summary dismissal.

[177]The Respondent’s senior managers, Mr Göztürk, Mrs Warner and Mr Woodman decided to dismiss Mr Witney. In the case of Mr Göztürk and Mrs Warner, their approach was to adopt Mr Kiernan’s report to justify a decision to terminate the Claimant’s employment they had made some months before. We do not know whether Mr Woodman was aware that his colleagues had already made their minds up. Mr Woodman did, however, decide to go along with their wish in this regard and he accepted Mr Kiernan’s recommendation without carefully considering the contents of the report provided. The steps necessary to obtain a clear answer from Mr Woodman on this latter point reflected poorly on him and undermined our confidence in his evidence. Mr Woodman was cross-examined by Mr Griffiths on the conclusions reached by Mr Kiernan. Having been taken through the report, it became apparent that Mr Woodman did not understand or could not explain a number of the conclusions reached and in other respects, appeared to disagree with Mr Kiernan. Mr Woodman also agreed it was unfair to have required the Claimant to respond to these serious allegations without having given him sight of unredacted copies of the technical reports. The Judge asked Mr Woodman if he critically assessed the report received. His reply suggested a possible misunderstanding and so the Judge sought to explain more fully what he had meant, namely that on receipt of the report Mr Woodman should have read it carefully, not assuming the conclusions were well-founded or ill-founded but instead considering whether they appeared to be supported by the reasoning set out and evidence obtained. The suggested approach having been explained more fully, Mr Woodman conceded he did not read the report in this way. We were surprised by the need for this lengthy exposition and our finding is that Mr Woodman’s initial response was evasive, as he sought to avoid admitting he had not looked at any of the conclusions set out in Mr Kiernan’s report with a critical eye. Dismissal

[178]Mr Witney was dismissed by the Respondent’s letter of 14 January 2021, which appeared to summarise the findings made by Mr Kiernan. The Claimant had actually learnt of the decision by way of third party supplier and wrote saying as much to Mrs Warner on 13 January 2021, along with requesting the return of his personal property. Mrs Warner replied denying that any third-party had been told of such a decision and saying his case was still under review.

[179]The Claimant felt the whole process had been entirely unfair and any appeal would be a waste of time. The Third Claimant – Mr Rolls

[180]The Third Claimant, Mr Rolls, began working for the Respondent in October 2018. Initially, he was engaged by way of an agency. He became a direct employee in March 2019. Mr Rolls’ position was Quality Inspector. His main task was to carry out an inspection of the Respondent’s final product before it was sent to the customer. Mr Rolls worked under the Product Quality Manager, Chris Normington. On more than one occasion, Mr Normington had said to the Claimant he would like to like to get younger people into the department. Other employees in the Quality Department included the Quality Manager, David Bastuba.

[181]When doing his job, Mr Rolls completed release notes. These documents would reflect the inspection he had carried out and result in him declaring a pass or fail. They would later also be countersigned by Mr Normington but this was something of a formality as, in many cases, the product would already have been sent to the customer. A large number of release notes were put into evidence. In many instances, we appeared to have two release notes for the same product. One completed by the Claimant, including a pass or fail and another, the origin of which was unclear. Mr Munro argued these duplicates showed that Mr Rolls was not solely responsible for the final check, suggesting that other employees had done the same work on the same products. The Respondent’s argument was speculative and indeed the evidence of Mrs Warner on this point did not stem from any direct knowledge of the process. The Respondent chose not to call Mr Normington or anyone else from the department. Mr Rolls said he had never seen these duplicates before and that only he had carried out the final inspection in each of those cases. We accepted his evidence. It is unclear why these duplicate release notes were created, it may be they reflected a review of the product at the end of the manufacturing process before Mr Rolls did his work. There were a smaller number of release notes where the final inspection had actually been carried out by others instead of the Claimant and we accepted this occurred to a limited extent when he was absent from work on annual leave and also when part of that process was delegated to a customer or supplier.

[182]In February 2020, the Respondent advertised for a new role of Product Quality Inspector. Whilst the job title was similar to that held by Mr Rolls, the intended new position had a different focus. This included visiting supplier sites and ensuring the product or materials were of the required quality before they were shipped to the Respondent. Another aspect was attending customer sites, to ensure the finished product delivered by the Respondent performed as it had been required to. These activities would bookend the work done by the Claimant and it had not been part of his job to travel to third party sites. Recruitment to this position appears, however, to have been overtaken by events (i.e. the pandemic) and no immediate appointment was made.

[183]On 15 April 2020, Mr Rolls contacted Sarah Smith, the Respondent’s HR advisor. He explained that his son was vulnerable to Covid because of underlying health problems and had to remain isolated. The Claimant was concerned about the possibility of bringing Covid home and passing it onto his son. He was willing to work from home but recognised that most of his duties needed to be carried out at the Respondent’s premises. Because the Claimant’s skill were still needed in the business, he had not been placed on furlough. In lieu of being furloughed, Mr Rolls requested immediate annual leave. Mark Jabri, the Operations Director, decided to approve the annual leave whilst he considered the position further. The Claimant provided a copy of the official letter received with respect to his son’s vulnerability and need to shield.

[184]Mr Rolls only made a limited challenge to the evidence Ms Smith gave about his furlough, namely: regarding paragraph 43, he did not remember saying positive things about the safety of the Respondent’s working practices at this time; regarding paragraph 45, he had only suggested Mr Normington could carry out his duties and no-one else; regarding paragraph 51, he had only contacted her a couple of times for an update about his request to be placed on furlough. We accepted Ms Smith’s evidence at paragraphs 42 through to 54, where it was not challenged. We also accepted what she told us in one contentious area, as it is likely the Claimant did contact her on more than the two occasions about being placed on furlough. It is quite clear that the Claimant was very concerned for the wellbeing of his son. He went so far as to buy his own mask, at some expense, when the UK Government’s position was still that face masks offered no protection from Covid. Given his understandable concerns, it is likely he was very keen to be furloughed and chased this up more often than he now recalls. We think, consciously or unconsciously, Mr Rolls is downplaying his enthusiasm for furlough because he believes this is a factor relied upon by the Respondent to justify its subsequent actions.

[185]The Respondent did not wish to furlough the Claimant. He had skills the Respondent needed in the business. No one else was doing his job at the time. As a result of the Claimant’s persistently expressed and understandable wish not to be travelling into work and back home again when this might put his son at risk, the Respondent relented and reallocated his duties to other employees, in particular Mr Normington taking over final inspections. Tool calibration was dealt with by Mr Bastuba.

[186]The Claimant agreed furlough terms on 6 May 2020. At this time said he looked forward to returning to work in 3 weeks, being the point when he anticipated the furlough scheme would end.

[187]On 21 May 2020, Mr Rolls was told that his furlough leave would continue until the (recently extended) furlough scheme ended or there was a resumption of work at the Respondent. He was one of a number of employees to receive such communications. In response, Mr Rolls contacted Ms Smith to say he was now ready to return. She was somewhat surprised by this request, given the Claimant’s primary focus had been his son’s health. Nonetheless, Ms Smith took this request to Mr Jabri, who did not agree.

[188]An appointment to the Product Quality Inspector role was not made until 29 May 2022, when it was offered to an internal candidate, Lee Dunne. Mr Dunne was much younger than the Claimant, being in early in his early 40s. Although recruited in May, Mr Dunne was not released from his existing role until the end of June 2020. When starting in the Quality Department, Mr Dunne was unable to visit suppliers or customers because of Covid. He did, however, take over the final inspections from Mr Normington. Given the delay in recruiting to this new position and the changed circumstances when the Respondent made its offer to Mr Dunne, another other option would have been to bring Mr Rolls back from furlough. The Respondent did not call Mr Jabri or Mr Normington to give evidence at the Tribunal. There was no opportunity to ask them questions about this. We think it likely that Mr Jabri consulted with Mr Normington about these matters, given the latter was working hands-on in the department and managing the same.

[189]In August 2020, Mr Rolls spoke with Ms Smith again. He was concerned about remaining on furlough and wanted to return to work as soon as possible. He told her about his previous experience and how he might be suitable for other roles within the Respondent. Mr Rolls was concerned about the prospect of job losses and feared that if he remained on furlough this would increase the prospect of him being made redundant. Once again, Ms Smith told Mr Jabri what the Claimant had said but he was not brought back.

[190]Subsequently, the Respondent looked at the possibility of restructuring and making redundancies in the Quality Department. One of the positions which was considered at this time was the Claimant’s. It is again likely that Mr Jabri consulted with Mr Normington on this, as the latter would be called upon to manage the circumstances created by any decision in this regard.

[191]We were provided with many iterations of documents prepared by the Respondent in connection with the proposed restructure, identifying which employees were at risk. The Respondent referred us to the final version of a “Restructuring Planning Template” document, which was taken forward by the Company and implemented. This identified Mr Rolls as being in a pool of one, with his role disappearing. The rationale included for this change was “Volume related activity for this role has reduced to such an extent that it can not justify a full role. Will be dispersed across other roles within operations.”

[192]When cross-examining Mrs Warner, Mr Rolls took her to another version of the “Restructuring Planning Template”. This showed Mr Rolls and Mr Dunne in a pool of two, from which one job would be lost. In the “reasons for change” column, the following text appeared: need narrative to explain this proposed reduction and that there are sufficient differences in task and skill required for new Quality Goods in process Inspector role Mrs Warner said this was an earlier version, she had put names into categories and was raising whether these people should be in a pool. She said the information in this version was incorrect and this was demonstrated by both the Claimant and Mr Dunne both being given the job title of “Quality Inspector”, when the latter should have been “Product Quality Inspector”. Her account invited a conclusion this was her work and Mr Jabri was not involved. The difficulty with that explanation is the document already included a proposed reduction in headcount of one from amongst the Claimant and Mr Dunne. Such a proposal can only have come from Mr Jabri. Mrs Warner would not have taken it upon herself to suggest reductions in the number of employees carrying out particular functions. This earlier document must have reflected Mr Jabri’s earlier thinking. It follows, therefore, that Mr Jabri had at one stage anticipated making a choice between the Claimant and Mr Dunne.

[193]There was no opportunity to ask Mr Jabri to explain when and how he decided not to proceed with a choice between these two men but instead to pool the Claimant on his own. Separately from obtaining HR advice, it is likely Mr Jabri consulted with Mr Normington, as it would be the latter who would have to manage the department once the restructure was effected. Given that a decision was made to put the Claimant in a pool of one, Mr Normington must have indicated that he wished to maintain the current arrangement and continue with Mr Dunne. This was, therefore, a decision made by Mr Jabri jointly and in consultation with Mr Normington. Pooling the Claimant on his own would avoid a scoring exercise and result in his dismissal. The rationale developed to justify this approach was based upon the different job descriptions for the Quality Inspector and Product Quality Inspector. Whilst comparing job descriptions is not an illegitimate approach when considering how to approach redundancy selection, in this case it tended to obscure the practical reality, which was that the Mr Dunne was in very large measure doing the same job as the Claimant had. The job description drafted for the Product Quality Inspector in February had been overtaken by events and did not reflect the duties Mr Dunne was actually carrying out.

[194]Following the group announcement on 26 October 2020, Mr Jabri spoke with Mr Rolls about his position being at risk. This was said to be a first consultation meeting. Mr Jabri told the Claimant that his post was no longer required as the Respondent was seeking to reduce costs through a realignment. The Claimant asked about alternative vacancies. Mr Jabri gave him a list of the 5 positions that were currently open. The Claimant said that Mr Dunne was now doing his job. Mr Jabri responded that Mr Dunne had a different remit and other aspects of the Claimant’s role had been redistributed across the business. Mr Jabri’s response tended to minimise the very real and substantial overlap in duties which existed at that time. The Claimant proposed a number of alternative jobs that did not exist but could be created for him. Mr Jabri said he would investigate this and there would be two further consultation meetings.

[195]The next meeting with Mr Rolls was on 27 October 2020. Mr Jabri attended, supported by Mr Baker of Peninsular/ Face2Face. This was conducted by remote means and there were some initial communication difficulties. There was then a disagreement about whether the Claimant’s primary function was final inspection. The Claimant emphasised the importance of this activity and its financial value. There was also a discussion about the job descriptions for Quality Inspector and Product Quality Inspector. The Claimant asked about his performance and Mr Jabri explained there were no concerns. The Claimant was unable to put forward a percentage figure for the proportion of his time spent on final inspections. He said all of the final inspection sheets would have his signature on, except for periods when he was on holiday. The Claimant said Mr Dunne was doing his job and it would be better done by someone with 18 months experience and degree in mechanical engineering (i.e. the Claimant). There was also some discussion of alternative vacancies.

[196]By letter of 6 November 2020, the Claimant was invited to another consultation meeting. He was warned that if an alternative to redundancy was not found then his employment may be terminated.

[197]The last consultation meeting took place on 9 November 2020. Mr Jabri was supported by a different consultant from Peninsula / Face2Face, Saragh Reid. Mr Rolls was accompanied by Mr Normington. The Claimant had prepared a “skills list” summarising his qualifications and experience, which he worked through. The Claimant argued that all of this was relevant to his role with the Respondent. There was discussion of the Product Quality Inspector position and as before, some disagreement as to what the Claimant’s role comprised and how much of his time was spent on final inspections as opposed to other activities. Mr Jabri then spoke of the position from February, March and April where turnover had been down and how the Claimant’s other duties had been redistributed.

[198]When the Claimant came to ask questions of Mr Normington, these concerned his performance, decision-making and attitude. Mr Jabri repeated what he had said on the last occasion about performance not being an issue. The Claimant did not ask Mr Normington any questions about the proportion of his time spent on final inspections, how his duties have been reallocated or whether Mr Dunne was now doing his job. When the Claimant described Mr Normington’s part in the final inspection process, Mr Jabri asked Mr Normington if he agreed with that. There appeared to be some disagreement between the Claimant and Mr Normington about the extent to which the latter was doing a "final audit”.

[199]By a letter of 10 November 2020, Mr Rolls was given one month’s notice of dismissal for redundancy. Shortly thereafter, the Claimant asked Ms Smith to send him the scoring system and his scores. She replied, advising that there were no selection criteria as it was only the Claimant’s role which was proposed not to exist in the new structure.

[200]By a letter of 16 November 2020, Mr Rolls appealed. His grounds included that: the Product Quality Inspector (i.e. Mr Dunne) was now carrying out his role but was not put into the pool; no scoring system was used; the decision was a foregone conclusion; he was more qualified, more experienced and his performance was good; he had been selected because of age.

[201]The appeal hearing took place on 25 November 2020. Mrs Warner and Mr Zeoli were the decision makers. Mr Rolls was accompanied by Mr Bastuba. There was a discussion about job descriptions for the roles of Quality Inspector and Product Quality Inspector. Mrs Warner said: RW: Yeah it’s-, the job itself was advertised in January I think and there was-, I think there were- , I believe there were some external candidates interviewed, but not appointed in February, so just to be clear, this is a complete extract from the existing job descriptions. So this is not produced to demonstrate a new evaluation of what those two jobs are. This is what was always intended in-, in theory i guess to be the difference between those two jobs. And I think the reason that it's relevant is what you’re-, what you’re concerned about is that your job has been-, is the same as the job that Lee Dunn (ph 09.03) does, and if that was the case I think we would argue that those jobs therefore needed to have been pooled together, and if there's a reduction in the level of activity, you would select one of those two people to come out of it. Now, after lots of you know really detailed thought and consideration it was understood that this is what-, has been explained to me by Mark who made this proposal in terms of restructure. Is that the job that you and Lee Dunn do is significantly different, and I think that’s demonstrated by these-, these two job descriptions. Now, you may well be correct that aspects or the majority of your role is being covered elsewhere and

[202]It is apparent that from the outset of the appeal hearing, Mr Zeoli and Mrs Warner were arguing in favour of the decision made by Mr Jabri, rather than adopting a more neutral stance and inviting the Claimant to explain his objections. Mrs Warner did, however, ask Mr Bastuba whether he could confirm Mr Dunne was now carrying out the final inspection role. Mr Bastuba replied that Mr Dunne had been doing the final inspections and was unable to do parts of the new role he had been recruited to, such as visiting suppliers, because of Covid.

[203]When Mrs Warner asked the Claimant to agree that some of the duties undertaken by Mr Dunne would not be matters he dealt with, the Claimant said they were similar and reiterated that final inspection was the main part of his role. He also emphasised the financial value of this activity.

[204]Mrs Warner suggested that Mr Dunne had been recruited to a very different role but the duties he had carried out in practice had been influenced by Covid and Mr Rolls going on furlough. She said an important consideration was how much of the Claimant’s duties had transferred. The Claimant said he was not arguing that all of his duties had been transferred to Mr Dunne. He also understood that Mr Dunne had been recruited to a different role, concerned with supplier quality. During the course of this appeal hearing the factual difference between the parties was not huge. The was, however, an issue of principle, being if in practice final inspections had been the Claimant’s main duty and this was now carried out by Mr Dunne, whether that factor obliged the Respondent to pool him with the Claimant for redundancy selection.

[205]The Claimant raised his good performance again. Mrs Warner explained that his performance was not in issue. They had been no comparison between him and Mr Dunne, in terms of how well they did their jobs.

[206]When Mrs Warner asked Mr Rolls what his complaint of age discrimination was based on, he replied: SR: On several occasions Chris Normington has said he would-, he would like to get younger people into the department. He has said that to me in the past. I'm not saying-, I'm just stating that as a fact. In response to this, Mrs Warner said that Mr Normington had not been involved in the decision to select him for redundancy.

[207]By a letter of 7 December 2020, the Claimant’s appeal was not upheld. The rationale for this decision was set out over 3 pages. Mrs Warner outlined the reorganisation which had taken place in the Quality Department, including the recruitment of Mr Dunne before concluding: The panel therefore find that whilst the individual aspects of your role are still required to be performed, your selecting manager, has proposed to re-organize these tasks in a different way and disperse them across different groups of people to achieve efficiency, appropriate ownership and cost effectiveness. We conclude that this is a fair selection for redundancy, and we uphold the decision.

[208]With respect to pooling the following conclusion was set out: In consideration of this ground for appeal, the panel took account of the similarities and differences of these two roles and how the content of your role of Quality Inspector was proposed to be addressed in the revised organization. The panel were satisfied that the roles were not interchangeable because there were proportions of each job that were not overlapping. It also established that as the activities of the QI role were being dispersed amongst more than just the PQI role, and it concluded therefore that it would not have been appropriate to pool just these two roles together.

[209]Mrs Warner’s letter dealt, briefly, with the lack of a selection as between Mr Rolls and Mr Dunne, the Claimant’s assertion the outcome had been a forgone conclusion and his reliance upon having a greater level of qualification and experience. With respect to age discrimination, she wrote: The appeal panel have investigated the allegation regarding Chris Normington’s remarks and whilst we find them to be unhelpful, we do believe them to be non-specific and intended to be in support of graduate and apprentice intake rather than comparative with any existing employee. It therefore finds there to be no substance to the claim that this remark has had any influence on the decisions to reorganise the function which have resulted in displacing you.

[210]Mrs Warner had spoken to Mr Normington. He did not deny the comments attributed to him by the Claimant. Mrs Warner’s description of his remarks as being “non-specific” etc, is difficult to understand and it appears to be her trying to find a way of admitting that factual truth of the Claimant’s allegation without conceding any of this amounted to age discrimination. Law Unfair Dismissal

[211]Pursuant to section 98(1)(a) of the Employment Rights Act 1996 ( “ERA”), it is for the respondent to show that the reason for the claimant’s dismissal was potentially fair and fell within section 98(1)(b).

[212]If the reason for dismissal falls within section 98(1)(b), neither party has the burden of proving fairness or unfairness within section 98(4) of ERA, which In any case where the employer has fulfilled the requirements of subsection (1) the determination of the question whether the dismissal is fair or unfair having regard to the reason shown by the employer -(a) depends on whether in the circumstances (including the size and administrative resources of the employer’s undertaking) the employer acted reasonably or unreasonably in treating it as sufficient reason for dismissing the employee, and

(b) shall be determined in accordance with equity and the substantial merits of the case.

[213]The function of the employment tribunal is to review the reasonableness of the employer’s decision and not to substitute its own view. The question for the employment tribunal is whether the decision to dismiss fell within the band of reasonable responses, which is to say that a reasonable employer may have considered it sufficient to justify dismissal; see Iceland Frozen Foods v Jones

[1983] IRLR 439

EAT.

[214]After an appeal, the question is whether the process as a whole was fair ; see Taylor v OCS Group Limited

[2006] IRLR 613

CA, per Smith LJ:46. […] In our view, it would be quite inappropriate for an ET to attempt such categorisation. What matters is not whether the internal appeal was technically a rehearing or a review but whether the disciplinary process as a whole was fair.

47. […] The use of the words 'rehearing' and 'review', albeit only intended by way of illustration, does create a risk that ETs will fall into the trap of deciding whether the dismissal procedure was fair or unfair by reference to their view of whether an appeal hearing was a rehearing or a mere review. This error is avoided if ETs realise that their task is to apply the statutory test. In doing that, they should consider the fairness of the whole of the disciplinary process. If they find that an early stage of the process was defective and unfair in some way, they will want to examine any subsequent proceeding with particular care. But their purpose in so doing will not be to determine whether it amounted to a rehearing or a review but to determine whether, due to the fairness or unfairness of the procedures adopted, the thoroughness or lack of it of the process and the open-mindedness (or not) of the decision-maker, the overall process was fair, notwithstanding any deficiencies at the early stage. Conduct

[215]Where the reason for dismissal is conduct the employment tribunal will take into account the guidance of the EAT in BHS v Burchell

[1978] IRLR 379

. The employment tribunal must be satisfied:215.1 that the respondent had a genuine belief that the claimant was guilty of the misconduct;

215.2 that such belief was based on reasonable grounds;

215.3 that such belief was reached after a reasonable investigation.

[216]The employment tribunal must also be satisfied that the misconduct was sufficient to justify dismissing the claimant.

[217]The band of reasonable responses test applies as much to the Burchell criteria as it does to whether the misconduct was sufficiently serious to justify dismissal; see Sainsbury’s Supermarkets v Hitt

[2003] IRLR 23

CA.

[218]Where an appeal hearing is conducted then the Burchell criteria must also be applied at that stage, in accordance with the decision of the House of Lords in West Midlands Co-operative Society v Tipton

[1986] IRLR 112

and the speech of Lord Bridge: “A dismissal is unfair if the employer unreasonably treats his real reason as a sufficient reason to dismiss the employee, either when he makes his original decision to dismiss or when he maintains that decision at the conclusion of an internal appeal.” Redundancy

[219]ERA section 139 provides: (1) For the purposes of this Act an employee who is dismissed shall be taken to be dismissed by reason of redundancy if the dismissal is wholly or mainly attributable to... (b) the fact that the requirements of that business-- (i) for employees to carry out work of a particular kind, or (ii) for employees to carry out work of a particular kind in the place where the employee was employed by the employer, have ceased or diminished or are expected to cease or diminish.

[220]The leading authority on the definition of redundancy is Murray v Foyle Meats

[1999] IRLR 562

HL. Lord Irvine said of section 139: “My Lords, the language of para. (b) is in my view simplicity itself. It asks two questions of fact. The first is whether one or other of various states of economic affairs exists. In this case, the relevant one is whether the requirements of the business for employees to carry out work of a particular kind have diminished. The second question is whether the dismissal is attributable, wholly or mainly, to that state of affairs. This is a question of causation. In the present case, the tribunal found as a fact that the requirements of the business for employees to work in the slaughter hall had diminished. Secondly, they found that that state of affairs had led to the appellants being dismissed. That, in my opinion, is the end of the matter.”

[221]As to a fair redundancy selection process, guidance was provided by the EAT in Williams v Compair Maxam

[1982] IRLR 83

, Browne-Wilkinson J presiding setout principles of good practice: “1. The employer will seek to give as much warning as possible of impending redundancies so as to enable the union and employees who may be affected to take early steps to inform themselves of the relevant facts, consider possible alternative solutions and, if necessary, find alternative employment in the undertaking or elsewhere. 2. The employer will consult the union as to the best means by which the desired management result can be achieved fairly and with as little hardship to the employees as possible. In particular, the employer will seek to agree with the union the criteria to be applied in selecting the employees to be made redundant. When a selection has been made, the employer will consider with the union whether the selection has been made in accordance with those criteria. 3. Whether or not an agreement as to the criteria to be adopted has been agreed with the union, the employer will seek to establish criteria for selection which so far as possible do not depend solely upon the opinion of the person making the selection but can be objectively checked against such things as attendance record, efficiency at the job, experience, or length of service. 4. The employer will seek to ensure that the selection is made fairly in accordance with these criteria and will consider any representations the union may make as to such selection. 5. The employer will seek to see whether instead of dismissing an employee he could offer him alternative employment.”

[222]The band of reasonable responses test applies to the respondent’s decision in identifying the pool from which the redundant employee will be selected, which is to say that a dismissal would only be unfair for this reason if the pool was such that no reasonable employer would have chosen it; see Capita Hartshead v Byard

[2012] ICR 1256

EAT. All Cases

[223]Where an appeal hearing is conducted then the Burchell criteria must also be applied at that stage, in accordance with the decision of the House of Lords in West Midlands Co-operative Society v Tipton

[1986] IRLR 112

[224]After an appeal, the question is whether the process as a whole was fair ; see Taylor v OCS Group Limited

[2006] IRLR 613

[225]EqA section 13(1) provides: (1) A person (A) discriminates against another (B) if, because of a protected characteristic, A treats B less favourably than A treats or would treat others.

[226]The Tribunal must consider whether:226.1 the claimant received less favourable treatment;

226.2 if so, whether that was because of a protected characteristic.

[227]The question of whether there was less favourable treatment is answered by comparing the way in which the claimant was treated with the way in which others have been treated, or would have been treated. This exercise may involve looking at the treatment of a real comparator, or how a hypothetical comparator is likely to have been treated. In making this comparison we must be sure to compare like with like and particular to apply EqA section 23(1), which (1) On a comparison of cases for the purposes of section 13, 14 or 19 there must be no material difference between the circumstances relating to each case.

[228]Evidence of the treatment of an actual comparator who is not close enough to satisfy the statutory definition may nonetheless by of assistance since it may help to inform a finding of how a hypothetical comparator would have been treated.

[229]As to whether any less favourable treatment was because of the claimant’s protected characteristic:229.1 direct evidence of discrimination is rare and it will frequently be necessary for employment tribunals to draw inferences from the primary facts;

229.2 if we are satisfied that the claimant’s protected characteristic was one of the reasons for the treatment complained of, it will be sufficient if that reason had a significant influence on the outcome, it need not be the sole or principal reason;

[230]In the absence of a real comparator and as an alternative to constructing a hypothetical comparator, in an appropriate case is may be sufficient to answer the “reason why” question - why did the claimant receive the treatment complained of.

[231]The definition in EqA section 13 makes no reference to the protected characteristic of any particular person, and discrimination may occur when A is discriminated against because of a protected characteristic that A does not possess; this is sometimes known as ‘discrimination by association’.

[232]The burden of proof is addressed in EqA section 136, which so far as material (2) If there are facts from which the court could decide, in the absence of any other explanation, that a person (A) contravened the provision concerned, the court must hold that the contravention occurred. (3) But subsection (2) does not apply if A shows that A did not contravene the provision occurred.

[233]When considering whether the claimant has satisfied the initial burden of proving facts from which a Tribunal might find discrimination, the Tribunal must consider the entirety of the evidence, whether adduced by the claimant or respondent; see Laing v Manchester City Council

[2006] IRLR 748

EAT.

[234]Furthermore, a simple difference in treatment as between the claimant and his comparators and a difference in protected characteristic will not suffice to shift the burden; see Madarassy v Nomura

[2007] IRLR 246

CA.

[235]The burden of proof provisions will add little in a case where the ET can make clear findings of a fact as to why an act or omission was done or not; see Martin v Devonshires Solicitors

[2011] IRLR 352

EAT, per Underhill P: 39. This submission betrays a misconception which has become all too common about the role of the burden of proof provisions in discrimination cases. Those provisions are important in circumstances where there is room for doubt as to the facts necessary to establish discrimination generally, that is, facts about the respondent’s motivation (in the sense defined above) because of the notorious difficulty of knowing what goes on inside someone else’s head “the devil himself knoweth not the mind of man” (per Brian CJ, YB 17 Ed IV f.1, pl. 2). But they have no bearing where the tribunal is in a position to make positive findings on the evidence one way or the other, and still less where there is no real dispute about the respondent’s motivation and what is in issue is its correct characterisation in law […] Conclusion – First Claimant Reason for Dismissal

[236]The reason for Mr Crowley’s dismissal was that the Respondent, having recently increased the number of Application Engineers from two to three, decided to reduce the number back to two. To that extent, the need of the Respondent for employees to carryout the work of Application Engineers had diminished. This amounted to a redundancy situation. Warning and Consultation

[237]Mr Crowley was warned of the restructuring and the prospect of redundancy dismissals, by way of a group briefing. Subsequently, he was warned that his own position was at risk.

[238]As far as consultation is concerned, there were three meetings between Mr Crowley and his line manager, in which his matrix scores were discussed. To that extent, he had an opportunity to ask questions and make representations. The efficacy of the consultation was, however, undermined by the lack of any clear scoring guidelines. The Claimant did not know what he had to show in order to achieve a higher band with respect to his skill scores. Furthermore, the basis upon which the skills were scored appeared to change during the consultation process. In this way, the goalposts were moved. Whether or not the consultation was such that at least some reasonable employers would consider it sufficient, is not a matter to be measured merely in terms of the amount of time that was spent in meetings with the employee. The quality of the consultation is also important. Whilst the Respondent is not obliged to accede to the representations made, the Claimant was entitled to clarity about how his scores had been arrived at so he might contest the same where appropriate. Furthermore, if details of specific jobs were expected of him in order to make the case for a higher score, then it would be unfair to require this without also giving him access to necessary workplace records. Whilst these factors represent obvious deficiencies, they might not on their own take the Respondent’s consultation exercise outwith the band in which some reasonable employers would consider what was done sufficient. Selection Process

[239]The scoring matrix drawn-up was, ostensibly, a satisfactory way for the Respondent to proceed. Whilst Mr Crowley argued the selection ought to have been based on the Application Engineers job description, the Respondent was entitled to make a decision in this exercise about the skills it wished to retain and prioritise. Similarly, whilst the scoring system for attendance may appear harsh, we remind ourselves that it is not for the Tribunal to decide upon the criteria it would have used. We cannot say that no reasonable employer would have chosen the criteria as did the Respondent in this case.

[240]We do, however, have a considerable concern over the way in which the matrix scoring exercise was carried out. We have already touched upon this under the heading of consultation. Having identified selection criteria, the Respondent then had to decide upon what basis employees would achieve one of the 5 available ratings (zero, 2, 4, 6 and 8). Descriptors such as some basic, half competent, fully competent and expert are extremely vague. No reasonable employer would embark upon scoring, without first having established the basis upon which the scores would be awarded. In the present case, not only was the basis of scoring not explained to the Claimant at the outset, Mr Zeoli had not turned his mind to it otherwise than superficially. The scoring method was developed during the consultation process, in a reactive way as a result of the Claimant’s objections. This brings us to the central problem with the Respondent’s scoring of the Application Engineers, namely that the outcome was predetermined. For the reasons we have set out, Mr Zeoli had decided at the beginning of this process that he wished to retain Mr Kuen and Mr Siddiqui and, therefore, dispense with the Claimant. Thereafter, as a result of the Claimant’s representations, the scores were varied but this was done on each occasion with a view to maintaining the end result, namely the redundancy dismissal of the Claimant. No reasonable employer would decide on redundancy selection before undertaking the matrix scoring and then tinker with the scores in the face of reasonable objections, whilst making sure to keep the chosen employee in last place. This factor on its own takes the scoring exercise outside of the band in which different reasonable employers might have dealt with matters. The unfairness of predetermination is, however, here compounded by the deficiencies in consultation to which we have already referred.

[241]We went on to consider whether the appeal was capable of remedying the unfairness in the original selection. Our conclusion is it did not. The focus of the appeal was on the procedure followed and in particular whether the decisionmakers were themselves satisfied Mr Zeoli had approached the exercise in a fair way. The appeal did not involve Mrs Warner or Mr Allman revisiting and engaging in detail with the skill scores, before awarding their own figures in this regard. If the appeal had comprised a second scoring and this had been done fairly, without predetermination and goalpost moving, that might have provided a remedy. That was not, however, what transpired. The appeal was more in the nature of a review rather than a rehearing

[242]Accordingly, Mr Crowley’s dismissal was unfair.

[243]The detriment alleged by each of the Claimants, namely dismissal, occurred. The question then is whether the reason for this treatment or at least a material factor was age.

[244]We were provided with table showing the ages of the employees dismissed as part of Project Romeo or at about the same time for other reasons. A significant proportion of these individuals were over 60. This might support an inference that the Respondent was looking to dismiss older employees. On the other hand, we noted that all three of the Claimants were only employed by the Respondent when they were already in their 60s and none were included in the first round of furlough. This might tend to suggest the Respondent welcomed older employees. We noted the age profile of the workforce was not much altered by the redundancy dismissals, Mrs Warner’s unchallenged evidence was the average age went from 49.83 to 48.36. Overall, we came to the conclusion we could not derive much assistance from evidence of a general nature about the ages of dismissed employees. It was necessary for us to look closely at how each of the Claimants was dealt with.

[245]Part of the reason for the dismissal of Mr Crowley was the belief by Mr Zeoli that he might retire in the near future. Whilst this was a material factor in the decision-making process, it was not discussed with the Claimant. Mr Zeoli did not ask the Claimant about his retirement plans because he feared that to do so would be age discrimination. It follows, therefore, that in Mr Zeoli’s mind the prospect of the Claimant retiring was directly linked to his protected characteristic of age. This age-related factor contributed to the decision to dismiss. We have considered how a hypothetical comparator would have been treated, namely a younger employee who it was thought might be leaving the business to pursue other interests. Mr Zeoli would have asked such a person about their intentions. He would not, simply, have assumed the individual was likely to go. This would have allowed the person to speak for themselves and say what they intended to do, perhaps putting Mr Zeoli’s mind at rest by assuring him they saw their future with the Respondent rather than just in the short-term. In the present case Mr Zeoli accepted at face value what he was told about the Claimant retiring because of his age. It seemed entirely plausible to Mr Zeoli that the Claimant would leave because he was so near to retirement age.

[246]We have, therefore, made a finding of fact that age was a material factor in the decision to dismiss Mr Crowley. Whilst we do not need to resort to the shifting burden of proof, we would have arrived at the same conclusion by that route. The matters set out in the previous paragraph are facts from which we could decide in the absence of any other explanation that the Claimant’s dismissal was because of age (i.e. that age was a material factor in the decision) and the Respondent had not shown that it did not dismiss him because of age (i.e. shown that age was not a material factor.

[247]Accordingly, therefore, Mr Crowley’s claim of direct discrimination because of age succeeds. Conclusion – Second Claimant Reason for Dismissal

[248]We find the reason for dismissal was that Mr Göztürk and Mrs Warner believed Mr Witney as at fault in failing to take sufficient steps to protect the Respondent from the cyber attack which took place in July 2020 and having a backup solution that did not allow the IT system to be restored. This is a reason relating to conduct. The decision had been made prior to the commencement of the disciplinary investigation. The process carried out by Peninsula / Face2Face was intended by the Respondent to facilitate the Claimant’s dismissal. Mr Göztürk and Mrs Warner were confident the reports obtained would support this course. If they had not done so, then a termination by other means would have been pursued. Whilst Mr Kiernan’s report was considered by the Respondent to be necessary from a procedural point of view, in order to defend against an unfair dismissal claim, the true grounds for the Respondent’s belief and decision to dismiss are not found in its 81 pages. The report was window dressing. Investigation & Grounds

[249]Mr Göztürk, Mrs Warner and Mr Woodman did not have reasonable grounds for their belief Mr Witney was guilty of misconduct. Mr Göztürk and Mrs Warner reached their conclusion at an early-stage. This involved a highly superficial approach to the evidence received. They had conducted no investigation nor given the Claimant any chance to respond. In the case of Mr Göztürk, his conclusion was also self-serving, in that if the IT manager could not be blamed for what transpired then the wisdom of having furloughed him in the first place would have been called into doubt. In the case of Mr Woodman, he largely operated as a rubberstamp. He did not subject the report prepared by Mr Kiernan to any scrutiny. The analysis set out by Mr Woodman in his witness statement is, plainly, something worked-up after the event for the purposes of defending the Claimant’s claim.

[250]Whilst our primary finding is that the Respondent’s senior managers did not base their decision to dismiss on the reports received from Peninsula/Face2Face (that process was merely the means to a predetermined end) in case we are wrong in our approach we have gone on to consider the reasonableness of the investigation and disciplinary carried out by the Respondent’s employment law advisors.

[251]We will look at the investigation carried out by Mr Rutter and then the disciplinary hearing conducted by Mr Kiernan, although we note that the former also appeared to make findings and the latter also took some investigatory steps. As we conduct this exercise, we remind ourselves the relevant questions are whether the investigation fell within the band comprising that which some reasonable employers might consider sufficient and whether the findings made were, reasonably, open on the evidence obtained. The questions are not what investigation would we have carried out or what findings would we have made. Mr Rutter’s Investigation Report Incident 1 — System audit carried out identified a weak password set up

[252]Mr Rutter said the IT audit identified that the password set up for the IT system was ‘weak’. Putting this word in quotation marks suggested that Mr Rutter was quoting from the report. The audit document did not, however, describe the password set up as ‘weak’. On the contrary, the report said “this is a good basic password policy” before going on to suggest a number of ways in which it could and should be improved, including by enabling (i.e. not setting to 0) ALT. Mr Rutter did not comment upon the ALT setting under this heading. Mr Rutter addressed the password banana14. He began by saying the Respondent believed this was “readily given out by EW to new starters and other employees around the business”. We do not know where this information has come from and cannot see a source for it in or attached to Mr Rutter’s report. When this proposition was put to the Claimant during the interview he denied it was true. Furthermore, Mr Rutter appeared to misrepresent the evidence he had on this point, as when interviewing the Claimant not only did he say he had evidence banana14 was “readily handed out” to “new starters”, which he did not, he also said “Emrah says that he was given that password […] when he got his new laptop?” when what Mr Göztürk actually wrote was the Claimant gave him the banana14 password so that he might have admin access to install software on a local machine. Evidence of the Claimant giving an admin password to the CEO of the company for the purpose of installing software onto a local machine cannot sustain the conclusion reached about a general approach to new starters. We were not in a position to ask Mr Rutter to explain his reasoning. Mr Rutter says Mr Witney recognised the password banana14 was weak and had said that resetting it caused other difficulties but did not explain the problem. This is not a fair representation of what the Claimant said during interview. There was a lengthy question and answer session on this point. The Claimant explained that the password had been retained on certain domains, where it was necessary to run old DOS programs upon which the company still depended, where the password banana14 was part of the coding (i.e. the relevant part of the software code would have to be rewritten to change the password). Whilst Mr Rutter may not have understood this point, he could not say Mr Witney did not give an explanation.

[253]Mr Rutter sums up incident one as follows: DR finds that as the IT Manager EW was solely responsible for IT security within STT. He was aware the current password system was ‘weak’ but failed to put in place a tighter system, neither did he identify this risk with the current MD or FD. Therefore, DR finds that there is a potential EW has negligently undertaken his duties with regard to system passwords and the security of IT which may represent a serious breach of mutual trust and confidence. As before, Connect System did not say the password system was weak. Rather, they said it was a good basic policy but recommended improvements. To the extent that Mr Rutter was referring to the banana14 password used on the legacy server running the DOS programs, whilst the Claimant had been responsible for IT security up until June 2020, since that time Mr Bryant had been in charge. Despite the passage of several months, no change had been made to the relevant password. The CEO had been made aware of the password when it was provided to him in order to install software. The current FD was not appointed until months after the Claimant left the business. Mr Rutter’s analysis and conclusions with respect to this incident are wholly unsatisfactory. Incident 2 —System audit carried out identified that there were no ‘maximum attempt’ measures put in place

[254]Mr Rutter begins by saying the: The ‘Connect Systems’ audit identified that there was no maximum attempt restrictions in place at the time of the attack. The Connect Systems audit does not make findings about ALT at the time of the cyber attack. Rather, this report addresses the state of the Respondent’s IT systems in November 2020, many months after the cyber attack and following a system rebuild. The forensic report addressed the position at the time of the attack and this says nothing about ALT, which is surprisingly since if the value had been zero at this time it might be expected that NCC would have commented upon it. Connect Systems were not tasked with investigating the attack or any failings by the Claimant. Unsurprisingly, therefore, Connect System did not look at the change logs or say anything about when ALT was set to 0.

[255]During the interview, Mr Rutter asked Mr Witney why he had overridden the 3 attempts and then you are blocked (i.e. ALT = 3) system. The Claimant denied having overridden this and said the Respondent had been using the Microsoft default settings. He also said that 2FA had been enabled and in order for the attack to succeed, this must have been disabled. The Claimant referred to Darktrace in this regard but Mr Rutter said they would discuss that later on. In his conclusions Mr Rutter says the Claimant “stated that he didn’t know that there were no maximum attempts in place…”. This is not a fair reflection of what the Claimant actually said during interview, as it assumes ALT was zero when the Claimant was in charge, which is not something he agreed to. Whilst the Claimant said he did not override the Microsoft default, he did not say the default value was zero. Mr Rutter did not investigate what Microsoft default values were.

[256]Mr Rutter also included the following: 33. DR is not an IT specialist and has limited knowledge in this area, however DR finds it strange that MS default position with regards to system attempts is to have nothing in place. Whilst the lack of specialist knowledge on the part of Mr Rutter would not, necessarily, mean he was unable to carry out an appropriate investigation, given the highly technical nature of the subject, he would need to place reliance upon the opinion of others who did know about such matters. Unfortunately, none of the earlier reports prepared by experts in the field, had been concerned with an assessment of what the Claimant had done or failed to. The obvious question to ask here was when did ALT become zero. Mr Rutter did not go back to Connect Systems or NCC with this or any other question.

[257]Mr Rutter concluded: In any case DR finds that given EW responsibility for IT security he was obligated to have at least investigated the security risks and what the MS default settings were and to that extend were additional measures or setting adaptations required. EW did none of this so to that end DR believes there is a potential EW has negligently undertaken his duties with regards to system security of IT which may represent a serious breach of mutual trust and confidence. In getting from Mr Witney failing to interrogate the ALT value to this being a breach of trust and confidence, Mr Rutter relies upon the Claimant failing to take additional measures. This conclusion would appear to contradicted by the Claimant’s implementation of 2FA, which Mr Rutter appears to have ignored, at least under this heading. Incident 3 —EW failed to inform the Managing Director that a security system (Dark Trace) had been purchased and was in place during discussions about IT security and system backup security.

[258]Mr Rutter recited (by way of 10 bullet points) the content of the short witness statement provided by Mr Göztürk on 18 November 2020. He then noted the Claimant categorically denied a discussion with Mr Göztürk about IT security. Rather, the Claimant said he discussed IT security with Mr Strickland (his line manager). Thereafter, Mr Rutter’s reasoning is somewhat confusing. At paragraph 38, he says in light of these conflicting accounts he cannot be “categorical about whether this meeting took place or not”. Then at paragraph 39 continues: 39. DR has a statement from the MD about was discussed at this meeting. The MD is employed in a position of great trust and will always be required to act with the highest levels of integrity. If is for this reason DR finds that it is highly unlikely the MD would make such a statement up if it hadn’t happened. Therefore, on the balance of probabilities DR finds that this meeting did take place. Mr Rutter says he has preferred the evidence of Mr Göztürk because he is in a position of trust and is required to act with integrity. Presumably, the same could have been said of the Claimant. A preference for one witness over another based upon seniority alone is an unsatisfactory way to resolve a dispute of fact. Mr Rutter does not appear to have sought to any corroborative documentary evidence in this regard.

[259]Mr Rutter then goes on to say that if there were a discussion about IT security, then Mr Witney was under an obligation to tell the CEO about Darktrace (incorrectly referred to as “Dark Touch”). Which failure was said to be potentially negligent and may represent a serious breach of trust and confidence.

[260]We can see why, given a finding by Mr Rutter there was a discussion about IT security, it might be expected the Claimant would have mentioned Darktrace. We are less certain as to why this omission is said to be negligent and a breach of trust and confidence. Mr Göztürk was not in post when the acquisition of Darktrace was discussed and approved by the Respondent’s senior management team. A more relevant line of enquiry would have been whether the Claimant’s line manager and the MD at the time had been aware of and approved Darktrace. Given a purchase order signed by Mr Strickland was in the Respondent’s possession, this would have easily been resolved. It does not, however, appear that Mr Rutter made any such enquiries or looked at the purchase order, which was provided in response to the Claimant’s subsequent DSAR. The Claimant identified Mr Strickland as a relevant witness in this regard, yet Mr Rutter made no enquiry of him. Incident 4 —Dark Trace have since identified their system had not been properly set up. It should have been set to ‘auto’ (which means any cyber attacks would be identified centrally) instead it had been overridden and set to ‘human’ meaning alerts would have gone directly to a nominated person.

[261]In support of this, Mr Rutter recites part of an email from Darktrace which states that during the installation and setup of this product the supplier had been pushing to get time with Mr Witney but had been unable to so and he had been allowed to configure this himself. We pause to note, this account does not support the headline allegation, namely that the Claimant had overridden the default settings. Mr Rutter does not say that he sought the Claimant’s response to the information from Darktrace. In the bundle for this hearing there is email traffic in which it can be seen Darktrace was seeking to implement it systems and the Claimant replied explaining that he was busy scaling out remote working. There would seem to be no reason why this information could not be uncovered by Mr Rutter, had he made appropriate enquiries.

[262]Having recited the email, Mr Rutter’s then concludes:45. The above statement confirms that Dark Trace were unable to meet with EW for the setup meetings, despite repeated attempts. EW was therefore allowed to configure the system on his own. Therefore EW was directly responsible for setting the system up to the less secure ‘human’ option. Whether this was done deliberately or by mistake as IT Manager EW had a duty to ensure STT systems were adequately protected and he did not.

46. DR believes there is a potential that EW has negligently undertaken his duties with regards to adequately and robustly set up ‘Dark Trace’ to sufficiently protect the IT systems of STT which may represent a serious breach of mutual trust and confidence.

[263]During the interview, Mr Witney explained that he had been told to “hold off” from the implementation of Darktrace until the new financial year in April 2020. He told Mr Rutter that the reason this service had been acquired was the previous MD’s concern about data theft. There had been previous occasions of people leaving the business, especially in sales, and taking the Respondent’s confidential information with them. Whilst the Claimant explained that the Antigena component of Darktrace could have stopped the cyber attack, he outlined this was a complex setup and something that took many months to get fully operational. The Claimant said he had been working on the implementation of Darktrace where he was placed on furlough and had that not occurred, the setup would have been complete within about two weeks. The Claimant also explained that after the Darktrace hardware device was plugged in there were lots of clashes on the network and furthermore, implementation of this had been delayed because “we were right up to our eyebrows providing access to the home users” the setting up of which had been prioritised.

[264]Mr Rutter’s reference to being uncertain whether the “human” setting was deliberate or a mistake is difficult to understand. The Claimant told him during interview that he had kept Darktrace in the mode where it did not take action automatically during the implementation period, which was complex and lengthy. Mr Rutter’s finding appears to involve a rejection of that account but he gives no reason for so doing.

[265]Mr Rutter did not ask Mr Witney why the setup of Darktrace took so long or what it involved. In his evidence at the Tribunal, the Claimant explained the software and hardware would monitor all the Respondent’s network traffic and build up a picture of this over time. Treating this as a baseline, the system would then flag unusual activity (i.e. that which did not fit the expected picture). The Claimant did not want to risk engaging automated responses too soon, as this might lead to the throttling of network traffic or the isolation of devices, when they were operating legitimately. Mr Rutter did not explore this matter with the Claimant. Had he done so, he would have elicited the same information we received. Furthermore, the need for several months in which Darktrace would build up a picture was not a contentious point. Mr Bryant said much the same in his evidence at the Tribunal and again, this information could easily have been obtained by Mr Rutter had he asked some appropriate questions. Incident 5 - EW went onto furlough on the 10th July 2020 and failed to provide any handover to anyone.

[266]Mr Rutter found that Mr Witney had over 24 hours notice of furlough because he was told about it on the 9 July and it did not happen until 10 July 2020. This conclusion is very puzzling. The Claimant told Mr Rutter that he was learned of his furlough on the afternoon of 9 July 2020 and that was his last day at work. We cannot see any evidence to support a conclusion he was at work on 10 July 2020. No witness before us disputed the position. If Mr Rutter had asked Mrs Warner or Mr Bryant about this he would have received the same information.

[267]Mr Witney told Mr Rutter there was no opportunity to provide a handover given the lack of time and because Mr Bryant did not have the capability to receive the same.

[268]Mr Bryant told Mr Rutter he had received a call from the Claimant on the day of furlough to explain an issue with storage space.

[269]Mr Rutter found:51. DR finds that as EW had overall responsibility of the IT systems for all of STT he was therefore duty bound to ensure appropriate measures were put in place to ensure the integrity of the IT function in his absence from the organistaion.

52. Even if he was advised at lunchtime that he was to be furloughed at the end of the day he should have made a handover a priority and make sure that this was carried out at all costs even if it meant working into the night to ensure the integrity of something solely within his remit of responsibility.

53. If EW believed that the person he was due to hand over to was not competent to do so he should have flagged this with his Line Manager and made alternative arrangements for a handover. He did not.

54. Therefore DR finds that it is improper that the person with complete IT responsibility for all of STT should think it is acceptable to leave the business for a period of at least 3 weeks and not put any handover measures in place. This has the potential to be a gross dereliction of duties and left STT open to many potential IT related problems especially as furloughed staff are not allowed to work or contribute to their normal duties whilst on furlough.

55. DR believes there is a potential that EW has negligently undertaken his duties with regards to adequately making sure arrangements were in place during a planned period of absence from work. This may represent a serious breach of mutual trust and confidence.

[270]Even if the Claimant had 24-hour’s notice of furlough, which he did not, it is difficult to see how he could be expected to put in place measures to “ensure the integrity of the IT function in his absence”. No basis upon which he could have done this was suggested to him by Mr Rutter during the interview.

[271]At paragraph 52, assuming Mr Witney was correct about timing, Mr Rutter asserts the Claimant ought to have worked into the night to ensure the integrity of the IT system. It was the Respondent’s senior managers who decided to dispense with their IT manager with minimal notice and we can see no basis upon which it was the Claimant’s duty to manage the risks they had created by working into the night.

[272]As for paragraph 53, it is difficult to see what alternative arrangements the Claimant could have put in place in the limited time available. None were put to him by Mr Rutter.

[273]Paragraph 54 appears to recognise the inherent risks in dispensing with the IT manager at a moment’s notice and yet Mr Rutter holds Mr Witney responsible for this state of affairs, which we do not understand.

[274]The reference to “a planned period of absence from work” is not understood. It was not something the Claimant had planned or been aware of until it happened. Incident 6 —An independent audit identified that none licensed Microsoft products were being used by Sterling Thermal Technology on the work based IT network.

[275]Mr Rutter sets out the Claimant’s explanation about the acquisition of licences when the Respondent was rolling out Remote Desktop services in March 2020. This included using 120-day trial software. This had expired whilst he was on furlough. Mr Rutter concluded:60. STT have identified via their Purchase Ledger that EW has used a company called HYP TECH for the procurement of unknown IT related products for STT (it is believed that these might have been Microsoft products). This company has since been proved to have be supplying ‘fake’ products.

61. EW stated that he always ensures that when he procures MS related goods and services for STT he makes sure suppliers are MS partners.

62. EW stated that he “was under the impression” the suppliers he had used were MS partners and everything “seemed to be above bored” with them.

63. DR asked EW what diligence he uses to ensure suppliers are legitimate. EW stated that he checks the site name, does a google search, checks then on trust pilot then checks they are not blacklisted.

64. DR finds that the due diligence used by EW to check on the legitimacy of suppliers seems a little primitive and not robust enough considering in is quite easy for an illegitimate company to pose as a legitimate company. In this case that lacks procurement procedures used by EW has lead to STT being compromised which could have led costly litigation and damage to reputation and credibility.

65. DR believes there is a potential that EW has negligently undertaken his duties with regards to the procurement of IT goods and services which may represent a serious breach of mutual trust and confidence.

[276]We note in his email of 14 October 2020, Mr Göztürk refered to servers without software keys and “pirate software”. He went on, however, to say this was something being addressed in the IT audit. The Connect Systems audit itself said nothing about fake or pirated software. It did, however say licences were required for some of the servers and suggested this needed to be addressed.

[277]As to it having been proven that the Claimant acquired software licenses from a proven purveyor of fake products, we can find no such proof in Mr Rutter’s report and nor did Mr Munro refer us to any during the Tribunal hearing.

[278]Even if we were to assume the Claimant purchased licences which were subsequently proven to be unauthorised, he set out the steps he had taken before acquiring software from this new provider and we cannot see why they are objectionable. Furthermore, whilst Mr Rutter describes these measures as primitive, not robust, negligent and breach of trust and confidence, he does not put forward any positive case for what the Claimant ought to done that he did not. Incident 7 — Cyber Essentials Certification audit revealed that EW had completed the certification paperwork certifying that STT had a ‘Password Policy’ written and in operation.

[279]Once again, it is unclear where this allegation came from. The fact of the Respondent having a password policy would appear to be supported by the findings of the Connect Systems report, which set out the policy as found and described this as “a good basic password policy” before going on to recommend improvements with respect to ALT, which we have already addressed. The Respondent’s employees with remote access, including senior managers such as Mrs Warner, had been sent emails requiring them to set up a password and setting out the requirements of the policy in that regard. The Claimant referred to emails of this sort but it does not appear that Mr Rutter sought copies. Mr Rutter came to the following conclusion: DR finds that whilst this isn’t a Policy as such, it is evidence enough of a company procedure, and protocol. DR is unable to say whether this would be deemed acceptable by the MoD, however DR finds that EW was acting in good faith (that there was a policy in place around passwords) when completing the Cyber Essentials Certification paperwork. We do not understand the distinction purportedly made between a policy on the one hand and a company procedure or protocol on the other. Mr Rutter goes on to say he does not know if this would be acceptable to the MoD, one of the Respondent’s customers. This incident is not included in the list of matters he recommended proceed to a disciplinary hearing. Incident 8 - Cyber Essentials Certification audit revealed that EW had completed the certification paperwork certifying that STT had ‘Malware’ protection on all of its computers.

[280]The Connect Systems report included “we have found that antivirus was not installed across the entire estate”. During interview, Mr Rutter put a proposition to Mr Witney that in completing the cyber certification process, he had stated that all the Respondent’s computers had malware protection when this was not true. We note the relevant certificate was issued to the Respondent on 10 April 2019. The information provided by the Claimant must have preceded this. Connect Systems carried out their audits in November 2020. Connect Systems did not say anything about the position as far as malware protection was concerned in April 2019 or earlier.

[281]Separately from the evidence in Mr Rutter’s possession not supporting the proposition that he put to the Claimant, in any event during interview the Claimant insisted that every PC in the Respondent had Atlas installed, which included antimalware protection. This was a subscription service for which the Respondent paid a monthly fee. He further explained the Respondent did not use Microsoft anti-malware, rather it was provided as part of Atlas. The Claimant queried how the audit in this regard had been carried out, whether it had detected the replacement anti-malware they had been using.

[282]In his conclusion on this point, Mr Rutter quoted from what he describes as a “Q&A document”. Whilst the source of this information is unstated, since it purports to describe how the IT audit was carried out in technical terms, it may have come from Connect Systems. The relevant passage provides: “The IT audit was compiled by a dedicated audit tool that scans IP addresses and devices from within side of the core network to capture it’s endpoints. While Atlas is regarded as a good all around software deployment & remote management tool for IT personal it requires active agents to be present on the endpoints, if devices have not connected to the network after long periods of time it is unable to update their agents resulting in Atlas unable to connect or retrieve the latest asset information from that endpoint, which would deem the utility Inaccurate for wide scale auditing purposes. Furthermore while Atlas deploys and manages the antivirus (bit defender) to the endpoints, the detection software/engine is suited more as an anti-virus agent against worms, trojans and e-threats, its anti-malware engine is not suitable for aggressive malware protection. A dedicated anti-malware tool/ software would be required for successful malware exclusion ” 283. having cited this passage, Mr Rutter continued:78. Based on the above information DR believes the audit process would have missed PC and equipment that were protected either if it was switched off.

79. On the balance of probability DR believes that the information provided by EW in the certification paperwork was inaccurate in relation to malware protection. This represents a potential misleading statement which could have breached the trust between the STT and one of is key clients the MOD. Therefore, there is a potential that EW has negligently certified in official documentation that all PC’s are Malware protected which may represent a serious breach of mutual trust and confidence.

[284]We do not understand paragraph 78. It occurred to us that “either” may be typo where “even” was intended, but still the meaning is unclear.

[285]We cannot see how the “Q&A” supports the finding at paragraph 79. The quoted text appears to explain how Atlas deploys antimalware software to computers (“endpoints”) on a network where it is installed. If, however, particular machines have not been connected to the network for long periods, then their antimalware components would not be updated and Atlas would be unable to retrieve the latest information from that machine. None of this excludes the existence of Atlas-deployed antimalware on all of the Respondent’s computers. On the contrary, it gives one reason why such software might be present and accurate information not be obtained about this from Atlas. The conclusion arrived at is not supported by the evidence Mr Rutter had. Incident 9 - Cyber Essentials Certification audit revealed that EW had completed the certification paperwork certifying that STT had ‘Firewalls’ set up on all its devices.

[286]Mr Rutter concluded: 81 Following the Cyber Essentials Audit being carried out it was identified that EW had certified that STT had a ‘firewalls’ set upon all company devices. The audit identified that this was not the case as some devices did not have any firewalls.82. EW said the auditors should have used ‘Atlas’ in their audit which would have proven that all devices did have firewalls. Atlas is an all in one tool.

83. As identified above in para 77 this is not the case and therefore.

84. On the balance of probability DR believes that the information provided by EW in the certification paperwork was inaccurate in relation to firewall protection. This represents a potential misleading statement and potentially breaches the trust between the STT and one of is key clients the MOD. Therefore, there is a potential that EW has negligently in certified in official documentation that all PC’s and equipment are firewall protected which may represent a serious breach of mutual trust and confidence.

[287]This conclusion is defective for the same reasons as we have set out in connection with incident 8. The Connect Systems report addressed the position in November 2020 not prior to April 2019. The same evidence given by Mr Rutter in his investigatory interview is relevant in this regard, namely that all devices had firewalls as part of the Atlas installation. The “Q&A” text is no more probative of the absence of firewalls that it was antimalware. Incident 10 —Dark Trace was not active between mid March and end April and Dark Trace themselves were flagging this as a concern to EW.

[288]Having summarised comments made by Mr Witney, Mr Rutter then reached an adverse conclusion expressed in the alternative:92. If EW is correct there is an argument to say that there was a 2 week period in April which left the company exposed but and therefore DR would find that this allegation is a moot point given the system was ultimately set-up and in use roughly 2 weeks after the contract commenced with no damage occurring.

93. However, if the start date of the contract was indeed 28th February 2020 this means that STT were exposed to their systems being subject to potential cyber-attacks for a considerable period of time, which would have posed an unnecessary and serious risk. Based on the evidence presented DR finds in relation to this specific allegation that EW may have exposed SST systems to unnecessary risk of cyber-attack. This potentially represents a serious breach of the trust placed in him as IT Manager.

[289]Mr Witney gave an account during interview of the circumstances which this product was acquired by the Respondent, which included not implementing it until April 2020 so the cost would fall into the next financial year. There was no evidence to contradict what he said in this regard. The relevant senior managers at the time were the former MD Mr Roberts and FD Mr Strickland. Mr Rutter did not approach either of them. Subsequently, Darktrace was “active” albeit the Claimant decided to keep it in human mode for the reasons he explained and we have already discussed. The fact of Mr Bryant being assisted by Darktrace at a later stage (when the system had been running for many months already) to turn Antigena to automatic, does not contradict or undermine the Claimant’s rationale in April. Furthermore, the Claimant explained how busy he was with other matters including setting up homeworking at this time. All of this appears entirely plausible. Mr Rutter had no evidence to contradict the Claimant’s account. His leap to yet another finding of breach of trust is baffling. Recommendation

[290]Mr Rutter recommended there was a case to answer (indeed he appeared to have made findings of fact) on all of these matters save for incident number 7. Our

Conclusion

[291]We have very serious concerns about the report of Mr Rutter. He reached very many unsatisfactory, unreasoned and unsupported conclusions, as we have set out above. Had he attended the hearing as a witness, it may be he could have better explained the position in person than he had done on paper. As matters stand, the report appears poorly reasoned and blatantly one-sided. Mr Kiernan’s Disciplinary Report

[292]At beginning of his disciplinary report, Mr Kiernan set out matters of general approach and these included: 12. PK notes that it is not within the remit of the Face2Face Consultant to investigate whether the evidence provided is genuine but to accept it in good faith, and where no evidence exists, to determine an outcome based on the Balance of Probabilities supported by reasonable justification. We are not sure what Mr Kiernan means when he says he would accept all evidence provided is genuine. When making a determination in disciplinary proceedings, it is frequently necessary to decide whether to accept and prefer the evidence from one witness over that of another, where the two accounts conflict. Plainly that was likely to be the case here, as such conflicts were identified in the report prepared by Mr Rutter. If Mr Kiernan meant he would always prefer the evidence of a management witness over that of the employee subject to disciplinary proceedings, then plainly that is an unfair approach. Nor do we understand what Mr Kiernan means when he says he will make a determination on the balance of probabilities, where no evidence exists. Where there is evidence, a decision-maker must reach a conclusion on balance of probabilities. Where there is “no evidence” it is difficult to see how a conclusion can be reached.

[293]The Respondent did not call Mr Kiernan as a witness at the Tribunal. As a result, where his reasoning appeared unclear or unsatisfactory, as it did in many respects, we had no opportunity to ask him questions about this. Allegation 1 – It is alleged that you have failed in your role as IT Manager, further particulars being:• It is alleged that you set up a “weak” password for the IT System.

• It is alleged that you failed to set a “maximum attempt” measure.

[294]The Claimant’s evidence was that the Microsoft standard for ALT was 5 and that was the policy applied during his time. As far as the banana14 password was concerned, the Claimant explained that there were certain applications which depend upon this to work (i.e. those DOS programs into which the password had been coded) and when he had raised this, one of the directors complained that he could not operate the business without this software.

[295]Mr Kiernan dismissed the Claimant’s explanation on the following basis: 27. Following a review of the information available at the point of writing EW’s statement, “ Without that ‘banana 123’-, that ‘banana14 ’ password, that software doesn’t function. Any of the software” is incorrect as following the data breach all passwords have been changed and no disruption to the system has occurred. Therefore, PK does not accept EW’s statement as mitigation for his actions. Mr Kiernan’s reasoning in this regard plainly erroneous. The banana14 password on the local server referred to had not been changed following the cyber attack. Indeed, many months later, in November 2020 when Connect Systems carried out an audit, the banana14 password was still present. The allegation itself is cast in loose and inaccurate terms. Banana14 was never the password for “the IT system”. Rather, the evidence before Mr Kiernan provided this weak password was used on a Windows Server 2003 virtual machine, which the Claimant explained was used to run old DOS software. Different and more modern server software was used elsewhere in the Respondent’s IT system, including on the RDS server (i.e. the external entry point to the Respondent’s IT system).

[296]We repeat our earlier observation about the need for expertise. Whilst a nonexpert might properly make a decision about allegations of this sort, necessarily, such a person must place reliance upon the expert opinion of others. None of the technical reports obtained previously and included in the pack for the disciplinary hearing had been intended to address any alleged misconduct by the Claimant. Furthermore, great care in digesting such material is necessary on the part of a non-expert. Whilst a fair disciplinary decision can be made within a band of reasonableness, this does not extend so far as to cover superficial reasoning or misconceived understandings.

[297]Mr Kiernan also rejected the Claimant’s explanation that Mr Allman had objected to propose change: PK finds that regardless of MA’s comments, as IT Manager and in accordance with his job description it was EW’s responsibility to ensure the IT system for the company was safe. It is PK’s reasonable belief that EW should not have been influenced by MA (as MA is not EW’s line manager) to not change the password and EW should have raise MA’s concerns with his direct line manager for them to resolve. Therefore, PK does not accept EW’s account of events as mitigation for his actions. The Claimant’s account was that he proposed changing the banana14 password having raised this to the entire board, and one of the Respondent’s directors objected, saying he could not do this because it would prevent the use of essential software. If what the Claimant told Mr Kiernan was true, namely that he had alerted his superiors to a risk associated with this weak password and one of the Respondent’s directors had objected to any change because he needed to run old software, we do not see how this could fail to afford the Claimant mitigation. As IT manager he was a servant of the company, supporting the business as required. At the time of this disciplinary hearing, Mr Allman was still in post as a director. Yet, there is no evidence of Mr Kiernan seeking information from him. This omission is baffling, it was an obviously relevant line of enquiry.

[298]Mr Kiernan rejected Mr Witney’s account of ALT being set at 5 because the brute force attack depended upon repeated password attempts and also made a positive finding this had been set to 0 because the Claimant found employees contacting him to resolve password issues and annoyance. No witness evidence supported the proposition the Claimant had changed ALT to 0 because he found it annoying to have to deal with locked out employees. The forensic report, as discussed in connection with the investigation, says nothing about ALT being zero in July 2020. Only following a complete system rebuild and many months later, in November 2020, when connect Systems audit was carried out, was ALT found to be zero. This highly adverse proposition (Mr Witney deliberately exposed the Respondent to a security risk because he was too lazy to deal with user password problems) was never put to the Claimant by Mr Kiernan, for him to respond to it. This was deeply unfair.

[299]Furthermore, the Claimant had relied upon 2FA as mitigation in this regard Mr Kiernan has not explored or dealt with it.

[300]It appears that Mr Kiernan has adopted a superficial approach to determining a most serious allegation, rather than undertaking a careful analysis of the technical evidence he had been presented with. Allegation 2 – It is alleged that you have failed to inform the Managing Director that you purchased a security system (Dark Trace) a. It is further alleged that you failed to properly inform the MD of risks to the backup system.

[301]In connection with this allegation, Mr Witney provided Mr Kiernan with the photo he took of the whiteboard when he met with Mr Göztürk, along with a copy of the report he had prepared for the Board in May 2020 dressing IT generally and including reference to Darktrace.

[302]Mr Kiernan dismissed the Claimant’s photograph on the basis it was not date stamped and he said it was unsubstantiated as a picture of the noticeboard in Mr Göztürk’s office. This is a superficial approach. Mr Witney offered to show the date and geographical location data associated with this photo, yet Mr Kiernan did not look at that. The simplest step would have been to ask Mr Göztürk about it. Mr Göztürk was shown the photo whilst giving evidence at the Tribunal and readily accepted it was indeed a photograph of the whiteboard in his office taken when he met with the Claimant. Furthermore, Mr Kiernan’s approach to this evidence is contrary to the statement at the beginning of his report that his general approach was to accept evidence as being genuine. In the circumstances, it appears Mr Kiernan would accept evidence from the Respondent as being true but not that given by the Claimant. Once again, whilst there is a reasonable band in which different decision-makers might deal with matters in a different way, it cannot extend to such a superficial and one-sided approach, as demonstrated by Mr Kiernan here.

[303]With respect to the backup solution, Mr Kiernan recited the content of an email of 30 November 2016 from Mr Witney to Sandra Saganowski, his line manager at the time, where he described the backup arrangements then in place, saying these were not ideal and setting out his proposals to implement a new backup regime, using Arcserve. Mr Kiernan also quoted from a note made by a member of the Respondent’s board of a conversation with the Claimant in 2018, when he described the current backup arrangements.

[304]Mr Witney told Mr Kiernan about the discussions he had with the previous MD and FD about off-site, cloud-based storage of the backups and a financial limit had been set in this regard. The Claimant said the position had been reviewed and he had raised the need for an expansion in this regard but have been told the current arrangements would continue until the financial position of the company was improved.

[305]Mr Witney gave a detailed explanation of the time it had taken to install Darktrace, including the various different factors and considerations bearing upon this. Mr Kiernan decided he was “unable to support nor oppose EW’s account of events” because the latter had not provided emails in support of it. Once again, it appears Mr Kiernan was failing to follow his stated approach of accepting evidence as true. Furthermore, given the Claimant had been on furlough since June 2020 without access to his company email account, the Respondent would have been better placed to provide relevant emails. The Claimant had requested this material and it was not provided to him. Mr Kiernan could have taken this up and it appears he did not.

[306]Mr Kiernan upheld allegation 2 in part. Faced with Mr Witney’s May 2020 IT report, Mr Kiernan did not uphold the limb alleging the Claimant had failed to inform Mr Göztürk about Darktrace: 56. Following a review of the information available at the point of writing this report, PK partially upholds this allegation. PK finds in relation to the notification to the Managing Director of the purchase of Dark Trace, PK is unable to substantiate whether the IT Report dated May 2020 was intentionally withheld from EG by EW or his former line manager. Therefore, without any evidence to substantiate the allegation PK does not uphold that EW failed to inform EG regarding the purchase of Dark Trace. Mr Witney did not attend Board meetings. Nor was he responsible for putting together the document packs for those who did. Having prepared an IT report which explained Darktrace, the Claimant said he had given this to his line manager, Mr Strickland. No enquiry was made of Mr Strickland. There was no evidence to contradict the Claimant’s account and yet still, Mr Kiernan did not accept the truth of what the Claimant told him.

[307]With respect to the other limb of this allegation, relating to the backup solution, Mr Kiernan concluded:57. PK finds based on the evidence available that EW failed to ensure the Backup Cloud was setup correctly to enable the company to retrieve data following a cyber-attack.

58. PK finds when reviewing the past communications and reports provided by EW that at no point did EW as the IT Manager highlight the risk with the cloud Backup to the board. Therefore, on the balance of probability EW did not inform EG of the risks either in relation to the vulnerability of the backup system to a cyber-attack.

[308]Paragraph 57 appears to be a finding with respect to an allegation that was not put to the Claimant in the letter requiring him to attend a disciplinary hearing, namely that he had failed to correctly setup the Respondent’s backup solution. What is said to be the correct setup is not identified in the report and nor was that put to Mr Witney during the hearing. The proposition appears to be that whatever system was in place must enable the Respondent to retrieve its data following a cyber attack. This is too simplistic. No backup solution will be perfect or capable of providing guaranteed data restoration whatever might come to pass. A more robust data solution might have encompassed a longer tail of cloud backups and / or air-gapped backups (copies of the data saved to a physical medium which is not connected to the Internet). Such measures do, however, come at a price and it is easy to be wise after the event. The Claimant’s evidence was that following discussions with the Respondent’s senior managers, a backup solution at a particular price point was agreed. There was no evidence to show that at the time this solution was put in place, no competent IT manager would have been a party to it. It is not enough to look back, with the benefit of hindsight, and say that because the backup solution did not withstand the cyber attack the Claimant was guilty of gross misconduct.

[309]Furthermore, we note the Respondent was in possession of a report Claimant had prepared in connection with the backup solution (this was subsequently disclosed in response to his DSAR) which does not appear to have been provided to Mr Kiernan.

[310]The conclusions at paragraph 58 are unsatisfactory. The Claimant is found not to have warned the board of the risks to the cloud backup, when that was not the allegation. The risks it is said he should have told the board about are not identified. The documentary evidence Mr Kiernan was in possession of, showed the Claimant had provided information to the board, on more than one occasion, about the backup solution. The Claimant’s account of the amount of data storage in the cloud being dependent upon and limited by what the board were prepared to pay, is entirely plausible and yet appears to have been rejected without an explanation. Given an existing backup solution agreed by the Respondent’s senior managers, we can see no obvious reason for Mr Witney to have been expected to raise this subject with Mr Göztürk when he joined. The Claimant’s reporting line was to Mr Strickland, who must have been fully aware of the position, given he would have been required to sign off on the expense. As far as the conversation between the Claimant and Mr Göztürk following the latter joining the Respondent was concerned, the photograph was obviously a good source of evidence as to the main topics discussed and was rejected without good reason. Allegation 3 - It is alleged that in your role as IT Manager, you have failed to set up Dark Trace correctly, further particulars being it is alleged that you failed to set it up in “auto mode” and instead set it to “human mode”. This setting resulted in cyber-attacks notifications being sent to a nominated person rather than centrally.

[311]There had been some discussion of Darktrace and its installation in connection with allegation 2. Mr Witney returned to this when Mr Kiernan asked him about allegation 3. Much of the same ground was covered as had been the case at the investigatory stage, albeit the Claimant went into more detail. Once again, he emphasised his concerns about the network being brought to a standstill if Darktrace was set to auto too soon. The Claimant explained he had been busy with other projects, which had delayed Darktrace. During the period from April he was letting it run and looking at the email alerts he received. He believed that if he had not been placed on furlough, the implementation would have taken another 2 weeks. The Claimant said it would have been negligent to have simply switched this to auto on 9 June 2020, when he was put on furlough.

[312]By the time of writing his report, Mr Kiernan had been provided with a copy of the email the Claimant had received from Mr Strickland. Mr Kiernan discounted this as a source of evidence in the following terms: 64. PK notes that he would question the validity of PS’s statement as PS provided no substantiating evidence to refute the disciplinary outcome against him and instead wrote in his statement, “I need to priorities finding a new job and career prospects”. Therefore, PK does not accept PS’s statement as mitigation for EW’s actions of not ensuring Dark Trace was operational and protecting the business from cyber-attack. Mr Kiernan’s reasoning in this regard is inadequate. Unsurprisingly, Mr Strickland does not agree he was guilty of misconduct with respect to the matters for which is own employment was terminated. The potential relevance of his account was not, however, in relation to his own employment, it was instead where Mr Strickland spoke of IT projects being put back because of the Respondent’s financial position and challenging Mr Göztürk’s decision to place the Claimant on furlough in June 2020. This evidence was relevant to the allegations the Claimant faced and in some respects, provided corroboration for his account. We do not see how this can be discounted simply because Mr Strickland did not provide “substantiating evidence to refute the disciplinary outcome against him…”. Once again, Mr Kiernan is not following his declared approach of accepting the evidence provided to him was true, at least not when it supported the Claimant.

[313]Mr Kiernan set out information he had received from Mr Bryant, regarding the occasions on which the Claimant had logged into Darktrace and that following the cyber attack in July 2020, Mr Bryant had received training in Darktrace and then switched the system on (presumably Mr Kiernan means Mr Bryant put Darktrace into automatic mode). The account from Mr Bryant was not provided to the Claimant in order that he might comment upon it. This was unfair, as Mr Kiernan relied upon this information to find against the Claimant.

[314]Mr Kiernan upheld this allegation in the following terms:77. Following a review of the information available at the point of writing due to EW’s actions of not switching Dark Trace from Manual to Auto this left the company open to the Cyber-Attack in July 2020.

78. PK finds that EW’s mitigation that he was testing the system is not consistent with the evidence as according to the logs provided by Dark Trace EW only logged in four times since January 2020.

79. PK finds EW’s explanation that he was furloughed before he finished testing Dark Trace is not mitigation for his actions. EW could have performed a handed over to SB so SB could have continued to conduct tests on Dark Trace, however EW chose not to do so.

[315]The conclusion at paragraph 77 assumes that Darktrace was the only defensive measure in place when the cyber attack occurred, when this was not so. The evidence before Mr Kiernan included password protection, malware protection and 2FA, none of which appears to be taken into account at this stage. Mr Witney had given a detailed explanation, which included other demands on his time and priorities, along with technical considerations (i.e. not switching Anitgena to auto mode too soon and throttling the network.). Separately from being inherently plausible given lockdown and the rapid rollout of homeworking, the Claimant’s account of other projects and priorities during this period was corroborated by the May 2020 IT report and the email from Mr Strickland. There was no expert opinion to contradict the Claimant’s approach of letting Darktrace run and monitoring the reports for a period, before switching to auto. The fact of Mr Bryant, following the July 2020 cyber attack, receiving training in Darktrace and then being assisted to put this in automatic mode after it had been running for many months building up a picture of network traffic, does not undermine the Claimant’s approach at earlier times.

[316]As for paragraph 78, the Claimant was not given any opportunity to comment on the logins reported by Mr Bryant, whether they are agreed on what they relate to. Part of the Claimant’s explanation of his activity, related to testing needed outside the workplace on a Linux installation. The Claimant was also monitoring the alerts he received by email, the reading of which would not require him to be logged in to anything other than his company email account. This again appears to be a superficial approach, without any chance for the Claimant to point out its flaws.

[317]The conclusion at paragraph 79 is unreasonable. Mr Witney had at most circa 3 hours’ notice of his furlough. We do not understand how it is suggested in that short time he could have prepared and delivered a handover to Mr Bryant, even if the latter was capable of receiving the same, which the Claimant did not believe he was. Mr Bryant was not employed or paid by the Respondent as the Claimant’s equal. The fact, as found by Mr Kiernan at paragraph 77, of Mr Bryant requiring training from Darktrace before he could put Antigena into auto mode undermines his finding two paragraphs later that the Claimant could, on the afternoon of 9 June 2020, have handed over the implementation of Darktrace to Mr Bryant.

[318]As we have worked through Mr Kiernan’s’s findings we have become increasingly concerned by his approach. Superficially, the report might appear to be thorough, as it runs to many pages, especially given a verbatim transcript of the disciplinary hearing. When, however, we begin to look at the detail, we are repeatedly struck by the inadequacy of the reasoning adopted. Very frequently, this appears to be blatantly one-sided. Allegation 4 - It is alleged that you have failed to provide a full and complete handover following the start of your Furlough period on 10/07/2020

[319]Mr Kiernan recites evidence from Mr Witney pointing to the difference between his role and that of Mr Bryant, as reflected in their salary levels. He then proceeds to say: PK asserts at this point that EW’s insulting statement regarding SB’s ability and how much EW earns compared to SB has no bearing on this disciplinary process. EW was in a position of responsibility as the IT manager which is the reason EW was paid a higher salary. If Mr Witney and Mr Bryant were at different levels, professionally, then it cannot be insulting to say as much. The enormous difference in their remuneration (Mr Bryant being paid only slightly more 50% of the Claimant’s salary) is quite plainly, corroborative in this regard. The difference in their skill levels had every bearing on the disciplinary process, as it would provide a good reason for the Claimant being unable to hand over his duties to Mr Bryant. There was no evidence this had ever been done on a previous occasion. When the Claimant had taken annual leave in the past, Cloud Systems provided cover.

[320]Mr Kiernan upheld this allegation on following basis:88. PK finds upon review of the evidence as soon as EW was notified of his pending Furlough, EW should have contacted SB to arrange a full handover. EW chose not to do this.

89. PK finds based on EW’s statement during the hearing, “He’s not at that level, I ’m stating a fact. He’s not at that level. To give you an idea, his salary, at this stage, was £25,000. Mine was £48,000” clearly shows that EW had no interest in supporting his only member of staff whilst EW was on furlough.

90. PK finds that had EW conducted a full and complete handover (which was his responsibility as the IT Manager) with SB, Dark Trace had the potential of being up and running and could have easily prevented the cyber-attack in July 2020. However due to EW actions of not completing a handover the company suffered severe financial detriment following the cyber-attack.

[321]At least two good reasons for the lack of handover were put before Mr Kiernan. There was insufficient time or notice and Mr Bryant was not professionally qualified. He did not deal with either, adequately or at all. Allegation 5 – It is alleged that in your role as IT Manager, you have failed to ensure that the Company is using licensed Microsoft Products, further particulars being; a) It is alleged that purchase ledgers were found from a Company called HYP TECH, known for supplying “fake” Microsoft products.

[322]Mr Kiernan begins this section of his report by reciting what the Claimant said during the disciplinary hearing, to the effect he did not know on what basis it was being said this named company was known for supplying fake Microsoft products. The Claimant went on to outline the checks he did make in terms of looking at the website, checking they were not blacklisted and searching for the company name online. He also made the point that only so much “due diligence” should be expected in connection with a modest purchase of up to £30.

[323]Mr Kiernan does not identify any evidence to show that HYP Tech was known for supplying fake Microsoft products. We found no such evidence in the attachments to his report. Nor does he identify any steps, which he says the Claimant ought to have taken before purchasing licences from this company.

[324]Mr Kiernan upheld the allegation on the following basis:97. Following a review of the information available at the time of writing despite EW’s mitigation that he believed the licenses were legitimate, an independent company has concluded that said licenses were not legitimate and could have left the company at risk of litigation.

98. PK finds that EW has provided no evidence to substantiate his claim that the independent IT report was a true and accurate account of what was discovered during the audit.

[325]In the absence of any explanation on the part of Mr Kiernan in terms of what he was relying upon in this regard, we assume it is again the email from Mr Göztürk on 14 October 2020. We have addressed this in connection with our comments on Mr Rutter’s report. Mr Göztürk purports to set out what he has been told will be included in the Connect Systems report about pirate software. This does not, however, appear in the Connect Systems report. Rather, that report identifies instances (in November 2020) where a Microsoft product was found not to have an activated licence. This does not provide any evidence of the Claimant having purchased fake software. Nor does the report say anything about HYP Tech being known as a purveyor of fake products. Mr Witney’s May 2020 IT report had identified the RDS licences would expire in August 2020 and the business would then have to decide how to proceed. The Claimant had explained during the investigation interview that 120 day licences were acquired and at the end of that period the company would have to decide whether or not to buy the products with ongoing licences. The Claimant left the workplace in June 2020. The purchase of replacement licences was not, therefore, something the Claimant can be criticised for not undertaking.

[326]Yet again, the reasoning is unsatisfactory and unfair. Allegation 6 – It is alleged that you have inaccurately completed official certification paperwork, further particulars being: a) It is alleged that you inaccurately completed certification in relation to malware protection. b) It is alleged that you have inaccurately completed official paperwork in relation to firewall protection.

[327]Our comments on this allegation in Mr Rutter’s report apply equally here. Mr Witney made the relevant declaration at some point before April 2019, whereas the IT audit was carried out in November 2020, several months after a cyber attack and complete rebuild of the system. The Respondent had no evidence to prove the Claimant had made a false declaration when he had completed the Cyber essentials paperwork. Separately, Mr Rutter failed to deal with the point raised that the audit carried out in November 2020 may have failed to detect Atlas installed antimalware on machines, in particular if these had not been connected for a long period.

[328]Mr Kiernan arrived at the following conclusion: 109. Following a review of the information available at the time of writing this report, PK upholds the allegation as it is well founded. PK finds that although EW asserted the audit report was accurate at the time, EW has provided no evidence to substantiate his account of events. Therefore, based on the balance of probability PK finds that it is highly probable that there were computers within the company which were not compliant with the Cyber Essentials Plus Audit which EW completed. At a disciplinary hearing it is for the management side to prove the alleged misconduct. In this case, that required the Respondent to prove the absence of malware at the time the Claimant completed the relevant paperwork, which it did not do (i.e. there were no grounds for such a finding).

[329]Mr Kiernan then went on to suggest that compliance with the cyber essentials standard would have been maintained in his absence, if Mr Witney had briefed Mr Bryant in this regard. This observation is irrelevant to whether or not the Claimant made a false declaration. Furthermore, it appears to involve a recognition that the position found in November 2020 may not have reflected that before April 2019. Allegation 7 - It is alleged that you failed to activate Dark Trace between midMarch 2020 to April 2020. This could have resulted in the Company’s systems being subject to potential cyber-attacks, posing an unnecessary and serious risk to the Business.

[330]Mr Witney explained the position during the disciplinary hearing, with respect to the implementation of Darktrace being delayed for financial reasons. Given the allegation was limited to the period from mid March to April 2020 the Claimant’s explanation, if true, would appear to be a complete answer. Mr Kiernan had no evidence to contradict what the Claimant told him about the instructions he received from Mr Roberts and Mr Strickland. We also repeat our observations as set out in connection with the disciplinary investigation.

[331]Whilst allegation 7 was discussed during the first disciplinary hearing, Mr Kiernan does not set out his conclusions on this in his disciplinary report. On page 20 of 81, he moves from allegation 6 to the two new allegations, which were discussed at the second disciplinary hearing. Nonetheless, he upholds allegation 7, without any rationale. Plainly this was unsatisfactory and unfair.

[332]Whilst discussing allegation 7, Mr Witney brought up the subject of 2-factor authentication. He explained his understanding of the material provided, which was to the effect that the cyber attack first hit the RDS server. This observation appears to be consistent with the email from Mr Strickland to Mr Göztürk, Mrs Warner and his fellow directors of 30 July 2020, in which a PC summarises the findings of the forensic report and includes a diagram showing the point of entry. Mr Strickland’s understanding of the diagram can only, realistically, have come from the NCC report. Relevant information within the body of that report was, however, redacted. It is unclear whether Mr Kiernan was provided with a copy of Mr Strickland’s email. Plainly this was in possession of the Respondent and had been seen by those who instructed Mr Kiernan. At the disciplinary hearing, the Claimant asked what had happened to 2FA, as this should have prevented the initial breach of the RDS server. He suggested that Mr Bryant was the only person who could have turned this off. It appears that, subsequent to the disciplinary hearing, Mr Kiernan asked Mr Bryant about this matter and he denied having turned off 2FA. Mr Kiernan rejected the Claimant’s evidence on this in the section dealing with allegation 6: 120. PK finds that EW has provided no evidence to substantiate that SB turned off the Two-Factor Authentication and finds EW’s statement as vexatious. Therefore, PK does not accept this as mitigation for EW’s actions.

[333]We note Mr Kiernan has not adopted his self-declared approach of accepting the evidence provided was true, rather he has again preferred the evidence of a management witness over that of the Claimant. Mr Kiernan also repeated a formulation he had used a number of times, namely that the Claimant “has provided no evidence to substantiate”. Given the Claimant had been absent from the workplace and without access to his emails or change logs on the Respondent’s IT systems, it is difficult to see how he could provide evidence about the state of or changes to the Respondent’s IT system at different points in time. In these circumstances, it was incumbent upon the Respondent to make appropriate enquiries. Mr Kiernan does not appear to have asked Mr Bryant or anyone else whether, at the point the Claimant was sent home on furlough, 2FA had been implemented on the RDS server. Emails relating to the password requirements for 2FA, which is an indication the system had been put in place before the Claimant’s departure, were discussed in the investigation. We do not understand why he did not ask Mr Bryant or anyone else whether 2FA was operational in June. If it were, then this would tend to support the Claimant’s account. This obvious question was asked at the Tribunal and witnesses for the Respondent confirmed 2FA was indeed up and running before the Claimant left on furlough. In those circumstances, 2FA could only, realistically, not have been running in July if someone turned it off or it crashed and was not restarted, neither of which would have been matters for which the Claimant could be blamed. We are loath to reach adverse conclusions about Mr Kiernan’s approach in his absence but the appearance is given of him only pursuing lines of enquiry where it was anticipated they would support the management case. 2FA was obviously relevant in circumstances where the Claimant faced a number of allegations in which he was, essentially, blamed for the cyber attack. Witnesses for the Respondent at the Tribunal agreed that if 2FA had been operational in July, the cyber attack could not have occurred. Allegation 8 - Taking part in activities that causes the company to lose faith in your integrity, namely alleged serious performance concerns, resulting in an irrevocable breakdown in trust and confidence in your position as IT manager. Further particulars being it is alleged that your performance is not at the level we would expect from a manager with your experience and at your salary level. This has manifested in a number of concerns which have been discussed with you in the investigatory meeting of 18th November 2020. Further particulars being that the amount and seriousness of errors in your work (outlined in allegations 1-7 of the disciplinary invite letter dated 7th December 2020 has resulted in the company’s inability to sufficiently defend itself in the cyber-attack which took place on 11th July 2020 and which resulted in the company's data being stolen

[334]The circumstances in which it was decided to add allegation 8 have not been explained by the Respondent. This looks like a sweeping up exercise and an attempt to strengthen the case for dismissing the Claimant (i.e. to better defend the unfair dismissal claim it was thought he would bring). It may be the Respondent’s advisers were anxious about the distinction between a conduct dismissal and one for poor performance, with this allegation intended to cater for the Tribunal finding the latter. The result of the Claimant’s actions is said to be the Respondent’s data being stolen. There was no evidence whatsoever of the Respondent’s data being stolen. Indeed, the information from the technical reports was to the opposite effect. What had happened was the Respondent’s data was encrypted and could not be accessed, until a ransom was paid. This was, undoubtedly, a very serious incident. The Respondent’s business will have been brought to a halt. A substantial sum of money (the figure appears to vary from document document) had to be paid in order to secure a release. Thereafter, the system had to be completely rebuilt. We do not doubt the importance of all these matters. In those circumstances, where disciplinary proceedings were pursued against the employee with a view to securing his dismissal, there was clearly a need to consider the evidence carefully. This reference to data being “stolen” suggests a misconceived understanding on the part of Mr Kiernan about the evidence he had.

[335]When dealing with this allegation in his report, Mr Kiernan began by looking at information Mr Witney had provided. The Claimant argued there was a pattern by which a large number of other employees over 60 had been identified to be dismissed for redundancy and that he had, at one stage, been part of that cohort. Mr Kiernan spoke to Mrs Warner in this regard and she said the material produced appeared to be an edited extract from a working document she had prepared in connection with restructuring. She said Mr Strickland proposed removing the role of IT manager and outsourcing this work. Later, however, subsequent to the dismissal of Mr Strickland, it was decided that the position of IT manager was still required.

[336]Mr Kiernan then cited part of the second disciplinary hearing, in which the Claimant put forward his account of events, challenging the propriety of the steps taken by the Respondent’s senior managers, in particular Mr Göztürk and Mr Jabri. Mr Kiernan criticised the Claimant for having “cast aspersions” on Mr Göztürk’s character. Where, however, an employee’s defence to disciplinary allegations involves senior managers acting improperly and giving a false account, it will be difficult to advance that without impugning the character of those named. The task of the disciplinary hearing officer is to assess the evidence and determine facts on the balance of probability. This must include in a case such as this, a consideration of whether the employee’s complaints about managers are well-founded or not. A simple preference on each occasion for the management side witnesses is not consistent with a fair hearing.

[337]Mr Kiernan upheld this allegation on the following basis: Following a review of the information available at the time of writing this report, PK upholds this allegation as it is well founded. PK finds that EW has provided no mitigation regarding his actions which resulted in the company being hacked and their data being held to ransom. PK accepts that no data was stolen or removed from the company premises, however the fact remains that the company data was encrypted by the hackers and held to ransom due to EW’s negligence.

[338]This paragraph appears to involve an assertion that it was the Claimant’s “actions” which led to all the adverse consequences cited. The actions are not identified and how they caused the outcome in not explained. Mr Kiernan asserts that no mitigation was provided. If the actions referred to are the subject matter of the earlier allegations, then the Claimant provided lengthy and detailed explanations. This additional allegation sent to the Claimant expressly included the proposition that the Respondent’s data was stolen. Mr Kiernan accepted this was not the case and yet still upheld the allegation. Mr Kiernan found against the Claimant on a different allegation, namely “the company data was encrypted by the hackers and held to ransom due to EW’s negligence”. Changing allegations on the fly, only after a disciplinary hearing has concluded, is scarcely a hallmark of fairness.

[339]At paragraph 136, Mr Kiernan set out that he had been provided with full copies of the documents from which the Claimant was merely sent excerpts. Before taking these into account, he should have provided them to the Claimant so he had an opportunity to comment on them. That said, Mr Kiernan’s observation that if an employee was dismissed for redundancy and their former position was kept within the business that would not be a redundancy situation and would leave the employer open to a claim, is a reasonable one. Save for the procedural failure, with respect to the Claimant’s lack of opportunity to comment on this additional evidence, it was open to Mr Kiernan to accept the evidence he received from Mrs Warner about the Respondent’s intentions with respect to the Claimant’s position at different times. To that extent, he had reasonable grounds.

[340]Similarly, to the extent that Mr Kiernan declined to investigate or uphold a much broader allegation that the Respondent had decided to dismiss all employees over 60 years of age for redundancy, whilst some reasonable decision-makers might have chosen to look into that, we cannot say that in doing otherwise Mr Kiernan strayed outside of the reasonable band. Some other, reasonable disciplinary decision-makers, might also have decided to keep the focus on the position of the individual employee. Allegation 9 – It is further alleged that the aforementioned cyber-attack resulted in a serious financial detriment to the company of £39,600 in ransomware to pay the hackers and to retrieve the data, as well as an additional £47,200 in legal fees and breach reporting. The total identifiable costs of the attack amount to £86,800, as well as associated reputational and operational damage. The company alleges, that if proven, this amounts to a gross breach of trust and a fundamental breach of contract and will be considered as Gross Misconduct.

[341]The Claimant disputed the amount paid, suggesting the loss had been covered by insurance save for an excess of £2,500. The Claimant said he had an email in this regard from Mr Strickland but would not provide it to Mr Kiernan. An employer cannot be criticised for failing to take into account evidence, which an employee declines to provide.

[342]Subsequent to the disciplinary hearing, Mr Kiernan asked Mr Woodman for a breakdown of the expenses. He explained that whilst the sum paid to the hackers was only US$6,000, there had been additional costs incurred in restoring the Respondent’s IT system and the total in that regard was £43,206.64 (including VAT).

[343]Mr Kiernan upheld this allegation on the following basis: 157. Following a review of the evidence available at the time of writing this report, PK upholds this allegation as it is well founded. PK finds that the assertion made by EW that the board of the company at the time told EW to concentrate on remote working and not Dark Trace is not substantiated. It is PK’s belief that regardless of arranging the remote working EW could have instructed SB continue installing Dark Trace or concentrate on remote working but chose not to do so. If EW had followed this course of action the company would have been protected from the data breach and would not have suffered any financial detriment.

[344]The first point we note is that this rationale does not match the allegation. The content of allegation 9 does not allege any particular wrongdoing by the Claimant, rather it describes the alleged consequences of the cyber attack. We would have been open to the proposition that Mr Kiernan had reasonable grounds, based upon what he was told by Mr Woodman, to find that the consequences of the cybersecurity breach included a financial cost of over £43,000. There was, however, no evidence of reputational damage and so it was not open to Mr Kiernan to reach a finding that regard. Instead, Mr Kiernan appears to be putting forward reasons for rejecting the Claimant’s account with respect to delay in the implementation of Darktrace, which is not the subject matter allegation 9. If anything, the matters set out by Mr Kiernan would seem more relevant to allegation 7. We do not understand why Mr Kiernan rejected the Claimant’s account on this. Mr Witney explained he had instructions from Mr Roberts and Mr Strickland to delay Darktrace until the start of the next financial year. Mr Kiernan had no evidence which contradicted what Mr Witney had told him. Mr Kiernan could have sought to ask questions of Mr Roberts or Mr Strickland but chose not to. The same must be true with respect to the prioritisation of other projects, including the rollout of remote working. Given there was a massive rollout of homeworking by the Respondent at this time, the Claimant’s account appears entirely plausible. Mr Kiernan gives no reason for rejecting this. And, again, there was no witness evidence to contradict the Claimant’s account. Mr Göztürk could not speak to this point because he was not even with the Respondent at the time. We have already addressed the unfairness and inadequacy of Mr Kiernan’s finding with respect to the lack of handover and our observations are equally relevant here. We note that Mr Kiernan has dismissed the Claimant’s explanation that he could not have handed this matter over to Mr Bryant, without making any enquiry of the Claimant on the one hand and Mr Bryant on the other, as to their qualifications and previous experience. The fact of Mr Bryant requiring training from Darktrace before he could do anything with the system suggests it would not have been possible for the Claimant to have handed over implementation of this package on 9 June 2020. Recommendation

[345]Unsurprisingly, having upheld all of the allegations (allegation 2 partially) in the original letter requiring the Claimant to attend a disciplinary hearing and both of the new ones added subsequently, along with concluding this amounted to gross misconduct, Mr Kiernan recommended summary dismissal. Our Conclusion

[346]Yet again, we have reminded ourselves that is not the function of the Tribunal to substitute its view for that of the employer. Instead, what we must do is look to see whether Mr Kiernan took such steps by way of making further enquiries that at least some reasonable employers would consider sufficient and made findings that were, reasonably, open to it on the evidence obtained. We recognise, in many circumstances, the evidence gathered by an employer may be such that different reasonable employers might come to different conclusions, including by preferring one witness over another. This is often captured by the expression “the reasonable band”, which applies not only to the sanction imposed but also the manner in which the investigation is carried out and findings of fact made. Only if an employer strays beyond the reasonable band, only if an employer proceeds in a way that no reasonable employer would, will it be open to the Tribunal to find an unfair dismissal. Nonetheless, in working through the evidence obtained and conclusions reached by Mr Kiernan, we have so very frequently been unable to follow his reasoning, noted findings made without any evidence, or seemingly plausible evidence rejected without explanation. Furthermore, the disadvantaged party on every such occasion was the Claimant. Adverse conclusions were reached which were unexplained, where there was no evidence to support it or where the available evidence plainly called for a contrary finding. The Claimant’s account was routinely rejected, either without explanation or on a wholly unsatisfactory basis. The impression we were left with was of a deeply one-sided process. Once again, we are disappointed to find ourselves in the position of making our findings without having heard from Mr Kiernan but that was a choice made by the Respondent. Procedure

[347]The formal requirements of a fair procedure were, largely, satisfied. Mr Witney was given advance notice of meetings. He was reminded of his right to be accompanied. He was warned that dismissal was a possible outcome. He was asked relevant questions during such meetings. He was given an opportunity to explain his position.

[348]There was some procedural deficit insofar as some of the allegations appeared to change between the disciplinary hearing invitation letter and the outcome report prepared by Mr Kiernan. We have, however, addressed this in connection with whether there were reasonable grounds for the conclusion he reached.

[349]There was, however, a more significant procedural failing, namely in the Respondent not providing Mr Witney with the documents he requested. The material sought was, plainly, relevant to the disciplinary allegations he faced. In having been away from the workplace for so long, without any access to correspondence, records or the IT system, the Claimant was at a distinct disadvantage. He did not have direct access to relevant documents. His account of events was, repeatedly, rejected on the basis he had not substantiated it and yet he was denied the opportunity to do so. Sanction

[350]Dismissal for the misconduct found by Mr Kiernan (had such findings been fair) would undoubtedly have been well within the band of reasonable responses. The litany of misconduct upheld and consequences found were of a most serious kind, likely to undermine the trust and confidence necessary and employer relationship. Conclusion

[351]The Claimant’s dismissal was unfair. The decision to dismiss was predetermined. The investigation and disciplinary hearing processes were intended to provide window dressing for a decision that had already been made.

[352]Even if, which is not our finding, the Respondent’s senior managers had kept an open mind and only decided to dismiss in light of and based upon the findings of Mr Kiernan, there were no reasonable grounds for the conclusions he reached and the investigation carried out (by which we mean the steps taken by both Mr Rutter and Mr Kiernan) fell well outside of the reasonable band in which different reasonable employers might have addressed this matter.

[353]Furthermore, the dismissal was procedurally unfair because the Claimant was denied the documentary material necessary to defend himself.

[354]Given the unsatisfactory and one-sided reasoning of both the investigation and disciplinary reports, Mr Witney’s feelings about this and decision not to appeal were entirely understandable. Wrongful Dismissal

[355]We are not satisfied on the balance of probabilities that the Claimant was guilty of any misconduct, whether serious enough to undermine trust and confidence or at all. We rely upon our findings as set out above in connection with the Claimant’s unfair dismissal claim. Whilst the legal tests to be applied are different and rather than merely reviewing the reasonableness of the decisions made by the Respondent, we must instead make our own findings on the balance of probabilities, our observations on the unsatisfactory nature of the evidence relied upon by the Respondent as grounds to support a finding of misconduct, are relevant here. The Respondent has not proven any of the alleged misconduct, let along that which would, objectively, tend to undermine trust and confidence in the employment relationship.

[356]Mr Witney was dismissed. The question under this heading is whether that decision was made because of age, in the sense of it being a material factor.

[357]As set out above, the relationship between Mr Crowley and Mr Göztürk got off to a poor start, for reasons that had nothing to do with age. Thereafter when it came to furlough, Mr Göztürk identified a significant financial saving in sending the Claimant home. He also believed that a combination of Mr Bryant stepping up and external support coming in, would cover the Claimant’s absence. Whilst this approach was somewhat cavalier, it was not influenced by age.

[358]When the cyber attack happened, Mr Göztürk and Mrs Warner were quick to blame the Claimant, in particular because they believed Mr Witney was at fault in failing to take sufficient steps to protect the Respondent and because the backup solution was insufficient. As set out above, an early decision was made to terminate the Claimant’s employment, the only question was whether this would be by redundancy, dismissal for misconduct or a settlement agreement. The investigation and disciplinary proceedings were merely the means of achieving a predetermined end. When the final decision to dismiss was made, Mr Woodman went along with this, believing it was justified for gross misconduct but without subjecting the grounds to any real scrutiny.

[359]Having considered all of the evidence, we are not satisfied there are facts from which in the absence of an explanation we could decide Mr Witney’s age was a factor in the decision to dismiss him. An appropriate hypothetical comparator would be a younger IT Manager, who had managed the Respondent’s IT systems as they had been here, gone into an initial meeting with Mr Göztürk and spoken as the Claimant did (including an argument about the CEO’s access to files) whose relatively high pay meant furlough was financially attractive and following his departure from the workplace the Respondent’s IT systems were encrypted and could not be restored. We have no doubt that such a hypothetical comparator would have been dealt with in the same way as the Claimant was. Conclusion – Third Claimant

[360]The detriment alleged in this case is shown, Mr Rolls was dismissed. We have gone on, therefore, to consider whether this was because of his age (i.e. this was material factor).

[361]We are satisfied there is no evidence of age discrimination in the original decision to place Mr Rolls on furlough. On the contrary, this decision was made despite the Respondent’s management wishing to retain the Claimant in the workplace, as a result of his persistent requests and family circumstances.

[362]Subsequently, Mr Rolls sought to return to work and the Respondent’s management did not allow this. Whilst we did not hear from either Mr Jabri or Mr Normington, it is likely that at least one factor in subsequent decisions was a concern the Claimant might make a similar request to be sent home in the future because of his son’s health. Having been compelled to reallocate duties to accommodate the Claimant, it would be surprising if his managers were in a hurry to reverse that and then run the risk of having to reverse the reversal.

[363]Against that backdrop and the matters set out earlier in our decision with respect to Mr Rolls, we have gone on to consider whether there are facts from which, in the absence of an explanation, we could decide the Claimant’s age was a factor in the decision to dismiss. We find there are such facts, namely:363.1 Mr Normington had spoken on a number of previous occasions of his wish to bring younger employees into the department;

363.2 Mr Normington’s views were sought by Mr Jabri, in connection with not allowing the Claimant to return from furlough, the recruitment of Mr Dunne and the decision on restructuring;

363.3 The recruitment of Mr Dunne at the end of May, served Mr Normington’s wish to bring in younger employees;

363.4 Mr Dunne took over most of that which had comprised the Claimant’s duties, namely final inspections;

363.5 the additional off-site duties identified in February for the Product Quality Inspector role, were not carried out by Mr Dunne after his appointment or in the period up to the Claimant’s dismissal;

363.6 When Mr Jabri first made a proposal to reduce headcount in the Quality Department, this included pooling the Claimant and Mr Dunne, with the need to make a selection from between them;

363.7 Given the considerable overlap between the duties of the Claimant and Mr Dunne this original pooling was an obvious and apparently reasonable step to take;

363.8 Mr Normington must have indicated to Mr Jabri that he wished to maintain the status quo, with Mr Dunne continuing with the duties he then had, otherwise we do not believe Mr Jabri would have proceeded as he did;

363.9 Mr Jabri then changed the proposal, so that Claimant was in a pool of one, with only his role to be deleted;

363.10 Mrs Warner gave evidence which tended to suggest Mr Jabri had no involvement in the original proposal to pool the Claimant with Mr Dunne, when we have found he did;

363.11 the responses given by Mr Jabri and Mrs Warner to the Claimant during the consultation and appeal processes, tended to minimise and obscure the substantial overlap between the duties he had carried out previously and those which were in practice undertaken by Mr Dunne;

363.12 the Respondent relied upon an outdated job description for Mr Dunne which did not reflect the duties he was actually carrying out;

363.13 Whilst some peripheral tasks may have been reallocated to others, the great bulk of what the Claimant had done was taken over by Mr Dunne.

[364]These facts would allow for a conclusion that Mr Jabri made the decision on redundancy pool selection and to dismiss Mr Rolls in consultation with Mr Normington, the latter wishing to continue with what was then the status quo and retain Mr Dunne, in part at least because he thought it would be better for the Department in the longer term to retain a younger employee to carry out the final inspection duties. This led to a decision to place the Claimant in a pool of one, which resulted in his dismissal for redundancy. Hypothetically, had the Claimant been a younger man with many more years of service to offer the Respondent, Mr Normington would have been more likely to have wanted him back, attaching greater weight to his skills and experience as compared with Mr Dunne.

[365]Given we could, in the absence of any other explanation, make the findings set out in the previous paragraph, the burden shifts to the Respondent to show that age was no part whatsoever of the decision to dismiss. The Respondent has not called Mr Jabri or Mr Normington to give evidence at the Tribunal. Although Mr Jabri was nominally the decision-maker, we are satisfied he must have consulted with and relied upon Mr Normington as manager of the Quality Department and it was in substance a joint decision. The Respondent, in seeking merely to rely upon evidence from Mrs Warner and the paper trail, has failed to discharge its burden. RESERVED REASONS Law 4. On well-established principles, a Tribunal may reduce the compensation payable to an unfairly dismissed claimant where there is a prospect they would have been fairly dismissed in any event; see Polkey v AE Dayton Services Limited

[1988] ICR 142

HL. The correct approach to determining whether a Polkey reduction is appropriate and the amount of the same was considered in Software 2000 Limited v Andrews

[2007] ICR 825

EAT; per Elias P, as he then was: 54. The following principles emerge from these cases.(1) In assessing compensation the task of the tribunal is to assess the loss flowing from the dismissal, using its common sense, experience and sense of justice. In the normal case that requires it to assess for how long the employee would have been employed but for the dismissal.

(2) If the employer seeks to contend that the employee would or might have ceased to be employed in any event had fair procedures been followed, or alternatively would not have continued in employment indefinitely, it is for him to adduce any relevant evidence on which he wishes to rely. However, the tribunal must have regard to all the evidence when making that assessment, including any evidence from the employee himself. (He might, for example, have given evidence that he had intended to retire in the near future.)

(3) However, there will be circumstances where the nature of the evidence which the employer wishes to adduce, or on which he seeks to rely, is so unreliable that the tribunal may take the view that the whole exercise of seeking to reconstruct what might have been is so riddled with uncertainty that no sensible prediction based on that evidence can properly be made.

(4) Whether that is the position is a matter of impression and judgment for the tribunal. But in reaching that decision the tribunal must direct itself properly. It must recognise that it should have regard to any material and reliable evidence which might assist it in fixing just compensation, even if there are limits to the extent to which it can confidently predict what might have been; and it must appreciate that a degree of uncertainty is an inevitable feature of the exercise. The mere fact that an element of speculation is involved is not a reason for refusing to have regard to the evidence. […] 5. Similar considerations can arise in discrimination cases. In Abbey National Plc v Chagger,

[2010] ICR 397

the Court of Appeal considered the correct approach to assessing compensation for future loss in a case where the claimant has suffered a discriminatory dismissal; per Elias LJ: 66. […] We would accept that, in many cases, the starting point in the case of a discriminatory dismissal will be the period for which the employee would have been employed by the discriminating employer. For example, if the employer can show that the dismissal would have occurred in any event after a specific period of time, for example because of redundancies or the closing down of the business, then this will normally set the limit to the compensation payable. If there is a chance as opposed to a certainty of this occurring, that should be assessed and factored into the calculation of future loss as the answer to the first question indicates. In such a case, the employee would have been on the labour market in any event once the employment had ceased, and the usual effect of the discriminatory dismissal would simply have been to put him on the labour market earlier than would otherwise have been the case. 67. Similarly, there may be circumstances—although in practice they will be rare—where the evidence is that the employee would voluntarily have left in the near future in any event, whether or not he had another job to go to. This could occur, for example, if the employee is dismissed shortly before he was due to retire, or if he had already given notice of resignation when the discriminatory dismissal occurred. It would be wrong to award compensation beyond the point when he would have left because there would be no loss with respect to any subsequent period of employment. […] 69. […] The task is to put the employee in the position he would have been in had there been no discrimination; that is not necessarily the same as asking what would have happened to the particular employment relationship had there been no discrimination. The reason is that the features of the labour market are not necessarily equivalent in the two cases. The fact that there has been a discriminatory dismissal means that the employee is on the labour market at a time and in circumstances which are not of his own choosing. It does not follow therefore that his prospects of obtaining a new job are the same as they would have been had he stayed at Abbey. For a start, it is generally easier to obtain employment from a current job than from the status of being unemployed. Further, it may be that the labour market is more difficult in one case compared with another. For example, jobs may be particularly difficult to obtain at the time of dismissal and yet by the time they become more plentiful, when in the usual course of events Mr Chagger might have been expected to have changed jobs had he remained with Abbey, he will have been out of a job and out of the industry for such a period that potential employers will be reluctant to employ him. In addition, he may have been stigmatised by taking proceedings, and that may have some effect on his chances of obtaining future employment. First Claimant 6. The only sum sought with respect to unfair dismissal is £350 for loss of statutory rights, which is agreed. The remainder of his losses are claimed and awarded as flowing from his discrimination claim. Prospect of Dismissal 7. If the evidence shows there was a realistic chance of the Claimant having been dismissed anyway, without age discrimination, then that is something which should be factored into the assessment of his compensation with respect to his ongoing losses. 8. We begin by noting there was a genuine redundancy exercise underway. The Respondent was looking to make a substantial reduction in headcount. As part of this, it had been decided the number of Application Engineers would be reduced from 3 to 2. 9. Ms Duane said Mr Crowley would have been dismissed in any event. To this end, she made observations about the effect on the Claimant’s scoring in the redundancy selection exercise, if points he had made during the process were taken into account. There were at least two difficulties with this approach. Firstly, much of the same ground had been covered by Mr Munro during the liability hearing and we had already made findings of fact about it. Secondly, our conclusion with respect to the Respondent’s selection process was not limited to problems with particular scores. On the contrary, we found the entire process had been manipulated so as to ensure Mr Crowley was dismissed. 10. Ms Linford said the Claimant was the most well-qualified Application Engineer and would certainly have been retained. 11. Our conclusion is this selection process would have been a very difficult exercise for Mr Zeoli to carry out. He had only been with the business for a relatively short period of time. He had some direct knowledge of the work done by Mr Kuen and Mr Siddiqui. He had little or no experience of working with Mr Crowley. In assessing the Claimant, Mr Zeoili would have needed to rely to a very large extent on the information he gleaned from others or documentary evidence. 12. Looking at the evidence we received and that would have been available to Mr Zeoli, it is difficult to reach any firm conclusion about the respective merits of the three individuals, as judged against the selection criteria for expertise with respect to the three main products used by the Respondent. This would have been the key determinant. Given our liability findings, absence is likely to have been neutralised as a material factor in a non-discriminatory exercise. Our impression is that the three candidates were all fairly closely matched, being stronger in some areas and weaker in others, but all at a relatively good level. Doing our best, we have come to the conclusion there was a 1/3 risk of the Claimant having been dismissed in any event, fairly and without discrimination. Health 13. Following his dismissal, Mr Crowley suffered with moderate depression and a loss of confidence. He sought advice from his GP and was referred for online cognitive behavioural therapy. The outcome of the treatment was described in a letter of 15 June 2021 from Healthy Minds: You scored in the moderate range on the questionnaires that you completed prior to the start of treatment. After completing treatment, your scores were in the normal range subclinical for depression. 14. In his witness statement, Mr Crowley has described sleep disturbance and violent nightmares, accompanied by physical thrashing of his arms or legs. He says these became ‘night terror attacks’ as his depression deepened and in his witness statement, the Claimant quoted from a book he has read on the subject. 15. Our conclusion is Mr Crowley suffered with moderate depression and a loss of confidence as a result of his dismissal and the manner in which this was carried out. He has also experienced sleep disturbance, nightmares and physical thrashing. Mr Crowley was assisted by undergoing the online CBT course and by June 2021, the frequency and severity of ongoing symptoms was reduced and manageable, without the need for support from his GP or other medical practitioner. 16. Mr Crowley harbours a strong sense of injustice at the treatment he has received. Having worked hard to create financial stability for himself and his family, Mr Crowley believes the Respondent undermined this by taking his employment away and forcing him into early retirement. 17. In re-examination, Ms Linden adduced evidence from Mr Crowley to the effect that he had recently redone one of the online CBT modules. On reflection, we are not sure the question asked on this arose from cross-examination. In any event, we would not be surprised if the Claimant had some anxiety and apprehension at the prospect of a further hearing in the Tribunal. We noted he was tearful at one point when giving his evidence. This is a not unexpected reaction. Succeeding at the Tribunal can prompt both positive and negative feelings, a sense of vindication in the decision made accompanied by renewed anger at the injustice suffered. This is not at all an uncommon reaction. Mr Crowley will no doubt welcome and benefit from being able to put these proceedings behind him. 18. We are not persuaded the Claimant’s health prevented him from applying for employment at any point following his dismissal. There is no medical evidence to suggest this was so. The test, however, is not whether the Claimant has done all that was practicable, rather the Respondent has the burden of proving the Claimant failed to do that which was reasonable in the circumstances. 19. The Claimant was suffering with moderate depression and a loss of confidence following his dismissal. Whilst this did not operate as an absolute bar to him making job applications, we are not persuaded that his immediate failure to commence a search for new employment was unreasonable. Dismissal in these circumstances was a very significant life event, which undoubtedly knocked him back. 20. By June 2021, following the completion of his online CBT course, the Claimant was then suffering with low mood only to a modest extent not requiring intervention. The Claimant did not, however, then or since commence a meaningful search for new employment. Asked by Ms Duane to describe a typical day, Mr Crowley said he fired up his laptop and looked for work. This struck us as most unrealistic. Had Mr Crowley undertaken that activity, at least in any serious way, he would have been able to put forward some fruits of that endeavour, namely evidence of job applications, rejections and correspondence with agencies. There was a complete absence of such material. 21. The Claimant said that many of the job adverts he read referred to a “career” or “career opportunity” and his wife, who works in a job centre, suggested this meant the employer was looking for a much younger person. Whilst the prospect of age-related prejudice against older job applicants is real, we are not satisfied it provides a good reason for the Claimant to refrain from applying for employment. 22. We are satisfied a failure on the part of the Claimant to make a reasonable effort to mitigate his losses has been shown from June 2021. Whilst Mr Crowley’s depression and loss of confidence in the months immediately following his dismissal may have operated as something of a obstacle (not an insurmountable one) to searching for new employment, by 15 June 2021 there was no significant health barrier. He could then have begun to make a concerted effort and to the extent that he seeks to recover ongoing losses from the Respondent, it was an unreasonable failure on his part not to. The Claimant has specialist skills which are transferrable. He does not say there are no job opportunities for those possessing the same. His inactivity is, therefore, very surprising and we are satisfied that he did fail from that point to make reasonable efforts to mitigate his losses. 23. The next relevant questions would be, if Mr Crowley had made a reasonable effort to seek new employment would he have found it, if so when and at what level of remuneration. Having commented on the lack of evidence of Claimant seeking new employment, it is also appropriate to observe the Respondent’s failure to put forward evidence of vacant positions the Claimant might have applied for. The Respondent, as an employer of those with specialist engineering skills, would seem to be well placed to have sourced evidence of relevant vacant positions and put copies of such vacancies in the remedy hearing bundle. That simple action does not, however, appear to have been carried out. This does not assist the Respondent in seeking to show whether and when the Claimant might have been likely to fully mitigate his losses by obtaining a similar job. 24. Whilst we have little to go on with respect to engineering roles, we can say with confidence that if the Claimant had broadened his job search and been willing to consider a reduction in pay, both of which with the passage of time would have been reasonable steps to take, then it is likely he would have found alternative employment. Taking into account his age, this is likely to have taken longer than for a younger person in similar circumstances, Our conclusion is that if the Claimant had undertaken and broadened his job search in this way, then he is likely to have found new employment by the point of 12 months after June 2021 (i.e. 15 June 2022) at no less than 50% of his previous earnings 25. Mr Crowley’s schedule of loss is predicated on him working to the age of 75, which he explained on the basis it would align with his wife’s retirement. In cross-examination the Claimant said he decided upon this when he was aged 65. A lot can, of course, change over a period of 10 years, especially when that spans mid-60s to mid-70s. We take judicial notice of the fact that only a relatively small proportion of the working population continue past age 70. Whilst is not easy to reconstruct the world as it might have been had the Claimant not been dismissed and we take into account the reality that it will often be much easier to continue in existing employment than start something new, we were struck by the Claimant’s inactivity in the job market following his dismissal. This approach appears inconsistent with it being likely the Claimant would, absent dismissal, have continued in the workplace until 75. Had the prospect of the Claimant working for another 7 years been a realistic one, then we think he would have gone back into the job market in a serious way following his dismissal. We note his wife’s retirement is still a long way off but this has not prompted him to apply for new employment himself. 26. The Claimant was still in work at the age of 68, we accept he had no imminent retirement plans. Nor could we say with confidence that he would have chosen to leave at the age of 70, which was a little more than a year away. Doing our best to take into account the inconsistent factors, in particular the Claimant’s intended retirement age on the one hand and failure to seek new employment on the other, we find he would have retired in any event by age 72. The Claimant was dismissed on 28 December 2020, when he was aged 68. His 72nd birthday would have been 4 February 2024. This would have resulted in a further period of employment of 3 year and 3 months. Injury to Feeling 27. What was done to the Claimant was a one-off event. We do, however, accept that it has had ongoing consequences for the Claimant. Furthermore, whilst the Vento guidelines focus on the extent of the wrong done by the Respondent, the correct approach is to assess the Claimant’s injury. The description of how the wrongdoer has behaved in merely intended to indicate the injured feelings that might be expected to have been provoked by conduct of that kind. Different individuals may suffer hurt feelings to a greater or lesser extent in response to similar wrongs. 28. We have set out our findings as to the impact on the Claimant’s health, his sense of injustice and heightened feelings on returning to the Tribunal. All of this appears to call for an award at the lower end of the middle band. This one off act has had ongoing consequences for the Claimant feelings, albeit at a moderate or low level. An award of £12,000 is appropriate in this regard. Loss of Earnings 29. Gross salary £44,808, net salary £31,860. 30. Loss of earnings from EDT 28 December 2020 to 15 June 2022:

30.1 Period 1 year 5 months and 18 days (534 days);

30.2 534/365 x £31,860 = £46,611.62. 31. Loss of earning 16 June 2022 to 4 February 2024:

31.1 Period 1 Year 7 months and 19 days (598 days);

31.2 50% gross earnings £44,808 = £22,404;

31.3 Net income £19,258.92 (based on www.gov.uk tax calculator);

31.4 Net differential £31,860 - £19,258.92 = £12,574.08;

31.5 598/365 x £12,574.08 = £20,600.82. 32. Total loss of earnings £67,212.44 33. Less 1/3 for chance of non-discriminatory dismissal = £44,808.29. Grossing Up 34. The balance of the award over £30,000, namely £14,808.29 is likely to be subject to tax as income in the year. In order to be left with a sum in this amount after deduction of tax and NI, per the www.gov.uk tax calculator he is likely to need to receive a gross income of circa £15,900. 35. £15,900 - £14,808 = £1,092 Interest 36. For his injury to feelings award, the Claimant is entitled to interest at 8% from the date of injury to the date of award:

36.1 Period 28 December 2020 to 23 October 2023;

36.2 2 years 9 months 25 days (1,030 days);

36.3 Interest 1,030/365 x 0.08 x £12,000 = £2,709.04; 37. For his loss of earnings flowing from discrimination, the Claimant is entitled to 8% from the midpoint to today:

37.1 Midpoint (1,030 / 2) = 515 days;

37.2 Loss of earnings to today only:37.2.1 28.12.20-15.06.22 = £46,611.62;

37.2.2 16.06.22-23.10.23 is 494 days - 494/365 x £12,574.08 = £17,018.07;

37.2.3 Sub-total £63,629.69

37.2.4 Less 1/3 = £42,419.79

37.3 Interest 515/365 x 0.08 x £42,419.79 = £4,788.21 38. Total interest £7,497.25 Second Claimant 39. Mr Witney’s losses are all assessed as flowing from his unfair dismissal. 40. The basic award is agreed, in the sum of £4,035. 41. Loss of statutory rights is agreed in the sum of £500. 42. Mr Witney’s employment with the Respondent came to an end on 14 January 2021 and he started in new employment on 10 May 2021. He did, however, have to accept a significant cut in pay. There can be no serious suggestion of an unreasonable failure to mitigate losses in his case. On the contrary, we are satisfied that he made a very good effort, demonstrating considerable flexibility, consistent with an intention to mitigate his losses and despite suffering from symptoms of PTSD at the time. Health 43. Having experienced a most traumatic event and PTSD early in his adult life, Mr Witney was vulnerable to its return. Unfortunately, he did begin to feel unwell in this regard in October 2020 and he sought assistance from his GP. We were referred to an entry in Mr Witney’s GP records referring to PTSD on 29 October 2020, which was the day the Claimant was told of his suspension from work. We pause to note, this resurgence did, therefore, begin prior to the Claimant’s dismissal. 44. Subsequent to his dismissal, Mr Witney made a subject access request. Whilst his claim in the Tribunal may be the reason for that request, it is no part of proceedings in this jurisdiction. The right for data subject to make requests is subject to a separate statutory regime. In replying to his request, the Respondent copied Mr Witney’s data to Mr Rolls, along with the password to decrypt this. Mr Witney was very upset by this data breach and brought separate proceedings against the Respondent, which have been settled. As part of that claim, a medico legal report was obtained from Dr Harvey, Forensic Psychologist, following an assessment on 3 May 2022. This included: INJURY DETAILS Mr. Witney reported that he was previously the IT manager at a company. They put him on furlough during the Covid-19 pandemic. He later discovered they had in fact made him redundant because he was over the age of 60. As part of the tribunal process he put in a subject access request - the information received was incomplete. The remainder of the information was sent to him via an email link. The password to the files was sent in a separate email. The same information was emailed to one of his colleagues. His colleague then had access to all of his personal information. 3 TREATMENT RECEIVED CURRENT SITUATION Cognitive, Emotional, Social, Physical The index incident prompted him to feel vengeful against the company. It has re-triggered symptoms of his existing PTSD diagnosis including vivid nightmares, flashbacks, and disrupted sleep. He considered giving up his new job because he did not feel able to function properly. At the time, he withdrew from social interactions and would become irritable and "blow up" at the slightest inconvenience. 5 CONSEQUENTIAL EFFECTS In my opinion, the above-mentioned symptoms are reasonable and are attributable to the index incident. Dr Harvey recommended CBT and her prognosis was for a recovery within 8-10 months. 45. Separately from PTSD, the Claimant is in good physical health. He told us he can run 5 miles “comfortably” and is keen on DIY, having carried out his own kitchen refit. New Employment 46. Mr Witney continued in his new employment from 10 May 2021 until 28 July 2023, when it terminated on expiry of notice given be him. His witness statement included: The delays in this case have caused me further anxiety and I am again suffering symptoms of PTSD but to a much lesser degree. This has however caused me to give up work with effect from 28th July 2023, as I can no longer function at the level I would expect. Causation 47. Whilst we do not doubt Mr Witney has given an honest account of his own assessment, we are not satisfied his resignation with effect from July 2023 can be attributed to dismissal by the Respondent in January 2021. We note the resurgence of PTSD preceded his dismissal and was, subsequently, not attributed by Dr Harvey to dismissal but rather to the data breach. Her prognosis was for a recovery in 2023 and this is, broadly, consistent with Claimant’s own account of much lesser symptoms at present. There is also some illogicality in his symptoms having improved and yet now causing the Claimant not to be satisfied with his performance at work. The Claimant’s long period of new employment would appear to be a supervening event. Indeed, he was with this new employer long enough to reacquire unfair dismissal protection. 48. Our conclusion is that Mr Witney would have been likely to have retired at the time he did, namely July 2023, in any event. As we have already observed, intentions with respect to retirement can change. The Claimant was 69 in July 2021 and continuing at work past 70 is very much the exception rather than the rule. He is physically fit and has interests outside of work. ACAS Uplift 49. The Respondent substantially departed from the requirements of the ACAS Code. Paragraph 5 with respect to investigations was defaulted upon by reason of the multiple inadequacies and malign intent, to which we referred in our liability decision. The incomplete and/or misleading provision of information contravenes paragraph 9. Paragraph 18 requires, unsurprisingly, that a disciplinary decision be made after the disciplinary hearing, whereas we found this decision had already been made and the process amounted windowdressing. The treatment of Mr Witney was abysmal and his decision not to appeal entirely reasonable. The maximum uplift of 25% is appropriate. Notice Period 50. The Claimant’s employment by the Respondent was subject to a 3 month notice period. Whilst his earlier terms and conditions included only statutory notice, these were subsequently varied both to increase his rate of pay and the period of notice required on both sides. We accepted Mr Witney’s evidence on this point. At this hearing as before, he was entirely straightforward and if anything, a little overeager to answer questions. We noted the Respondent has changed its position on his notice period. In the counter schedule, the 3 month period was agreed. Counsel at the hearing took a different approach. Whilst no revised contractual document was produced in evidence, we did not consider this to be conclusive. The Respondents’ approach to disclosing documents has left much to be desired. It also appears, at least prior to the arrival of Mr Gozturk, that the Claimant was well regarded by the Respondent. It is entirely credible that an important officer of the company, such as the IT manager, should be subject to a notice period of this length. This would not merely be for his benefit but also to ensure the Respondent had a reasonable period of time which to source a replacement, when this became necessary. Pay and Pension 51. Weekly net pay and employer’s pension contrib = £759.92 + £46.85 = £805.85. 52. Annualised figure for net pay and pension (i.e. x 52) = £41,904. Loss of Earnings and Pension 53. Notice period 14 January to 14 April 2021: 53.1 12.8 weeks x £805.86 = £10,326.66. 54. 15 April 2021 to 9 May 2021:

54.1 Period of 3 weeks and 3 days (24 days);

54.2 24/365 x £41,904 = £2,755.34; 55. 10 May 2021 to 28 July 2023:

55.1 Period of 2 years 2 months and 18 days (809 days);

55.2 Lost earnings with the Respondent 809/365 x £41,904 = £92,877.63

55.3 credit new employment 10 May 2021 to 30 April 2022 - £25,767.77;

55.4 credit new employment 1 May 2022 to 6 February 2023 = £23,845.90:

55.5 credit new employment 7 February to 28 July 2023:55.5.1 period 5 months 3 weeks (171 days);

55.5.2 171/365 x £41,904 = £19,631.74.

55.6 £92,877.63 - £25,767.77 - £23,845.90 - £19,631.74 = £23,632.22 56. Total loss of earnings and pension £36,714.22 ACAS Uplift 57. Compensatory award before uplift £36,714.22 + £500 = £37,214.22 58. 25% uplift £9,303.55 Breach of Contract 59. The Claimant was entitled to 3 months’ notice:

59.1 Period from 14 January to 14 April 2021:

59.2 12.8 weeks x £805.86 = £10,326.66. 60. He cannot, however, receive this sum twice and it already accounted for in his compensatory award for unfair dismissal. Third Claimant Prospect of Dismissal 61. Absent age discrimination, the Claimant would have been put in a pool of two with Mr Dunne for redundancy selection. This position was reflected in an earlier iteration of the Respondent’s restructuring document and we find, would have remained the position where it not for age discrimination. 62. The question then is what prospect Mr Rolls had of retaining his employment, if a selection of then being made as between him and Mr Dunne, without any consideration of the Claimant’s age. Mr Rolls rejected the suggestion put to him in cross examination that there would have been a 50% prospect. He said that was an irrelevant statistic. The basis for his position was a belief that he was more qualified than Mr Dunne to carry out the quality inspection role. We noted in our findings at the liability stage, the requirement for someone else to discharge this role was brought about by the Claimant himself, wishing to go on furlough. Reluctantly, the Respondent acceded and Mr Dunne was required to take up this activity. Given, not very long thereafter, the Respondent decided to dispense with the Claimant and retain Mr Dunne, it is difficult to avoid drawing the inference the Respondent was satisfied by Mr Dunne’s performance in this new (for him) role. The evidence does not, therefore, obviously point to the retention of the Claimant by virtue of great experience. The Respondent did not in the other exercises to which we have been referred, rely upon last in first out as a criterion and there is no reason to suppose they would have done so in this instance. There was, therefore, a very real risk the Claimant would have been dismissed in any event and without discrimination. The 50% prospect put to the Claimant reflects the evidence we have seen. 63. Mr Rolls has gone to considerable lengths to mitigate losses. He has taken on employment in a wholly unrelated field, at much reduced pay and subject to a zero hours contract. We are not sure he has gone about this exercise in the wisest manner but that does not enable the Respondent to show a failure on his part to reasonably mitigate his losses. 64. The Claimant say he intended to work until his wife reached retirement age, in September 2026. Given he is still working now and in far less convenient employment, we have accept his account as being realistic. Injury to Feelings 65. Mr Rolls has suffered with low mood, anxiety and sleep disturbance, as a result of his discriminatory dismissal. This continued for many months. His GP record for February 2021 includes a diagnosis of stress-related problem and:  Been on furlough since April 2020 - was told in November 2020 that will be made redundant  Since then has been feeling stressed ++ and occasionally waking in night with panic attack sx- heart racing, sweaty etc. - sx usually last a few minutes and settle if he walks around, has a cup of tea  States feels slightly low in mood but more stress ed/worried for the future 66. The Claimant was referred to Healthy Minds and another local source of mental health support. He saw his GP with the same problem and the end of April 2021, albeit his symptoms appeared to have abated somewhat. 67. In his witness statement the Claimant described a loss of confidence and weight (two stones) having never suffered with poor mental health previously. He has ongoing worries as a result of financial distress. 68. We could not help noting the similarity in the symptoms suffered by Mr Rolls and Mr Crowley. Whilst it was suggested in cross-examination that Mr Rolls had copied the position of Mr Crowley in certain respects (such as retirement age) the answer would appear to be that they have experienced a similar (not identical) reaction to a discriminatory dismissal late in their working lives. We find that an award at the lower of the middle band is appropriate in his case also and consider £12,000 to be the appropriate sum. Loss of Earnings 69. Although the Claimant’s employment terminated on 10 December 2020, he received 1 months’ PILON and so his losses began on 8 January 2021. 70. Period of loss, 8 January 2021 to 1 September 2026 is 5 years 8 months and 22 days (2,091 days). 71. Lost earnings with Respondent 2,091/365 X £19,745.40 = £113,116.80 72. Credit for earnings in new employment:

72.1 Temporary employment 3 January to 28 February 2022 = £3,442

72.2 Ongoing employment:72.2.1 Net monthly pay £1,450 less travel and parking £648 = £802;

72.2.2 Annualised pay less travel and parking £9,624;

72.2.3 Period 1 April 2022 to 1 September 2026 - 4 years 5 months (1,614 days);

72.2.4 1,614/365 x £9,624 = £42,556.54 73. Total loss of earnings £113,116.80 - £42,556.54 = £70,560.26 74. Less 1/2 for chance of non-discriminatory dismissal £35,280.13. Grossing Up 75. The balance of the award over £30,000, namely £5,280.13 is likely to be subject to tax an income in the year. 76. The Claimant is earning £13,050 in his new employment. His taxable income is likely to be £13,050 + £35,280.13 = £48,330.13. 77. Per www.gov,uk the Claimant is likely to need to receive circa £68,000 in order to be left with circa £48,000 after tax and NI. 78. £68,000 - £48,000 = £20,000 Interest 79. For his injury to feelings award, the Claimant is entitled to interest at 8% from the date of injury to the date of award:

79.1 Period 10 December 2020 to 23 October 2023;

79.2 2 years 10 months 13 days (1,048 days);

79.3 1,048/365 x 0.08 x £12,000 = £2,756.38 ; 80. For his loss of earnings, the Claimant is entitled to 8% from the midpoint:

80.1 08.01.21-23.10.23 is 1,018 days and the mid-point is 509 days

80.2 Lost earnings with Respondent 1018/365 X £19,745.40 = £55,070.73

80.3 Credit for earnings in new employment:80.3.1 03.01.22- 28.02.22 = £3,442

80.3.2 01.04.22-23.10.23 (570 days)

80.3.3 570/365 x £9,624 = £15,029.26

80.4 Total loss of earnings to today £55,070.73 - £15,029.26 = £40,041.47

80.5 Less 1/2 for chance of non-discriminatory dismissal £20,020.74

80.6 509/365 x 0.08 x £20,020.74 = £2,233.55 81. Total interest £2,756.38 + £2,233.55 = £4,989.93