Mr A Shonpal v The Charles Kalms, Henry Ronson Immanuel College: 3312140/2020 and 3312151/2020
EMPLOYMENT TRIBUNALS
Case No 3312140/2020, 3312151/2020
Between
Mr A ShonpalClaimantThe Charles Kalms, Henry Ronson Immanuel CollegeRespondent
Before
Employment Judge MaxwellIn person for claimantDate 26 September 2023
JUDGMENT
[1]The Claimant’s claim for a redundancy payment is dismissed on withdrawal. Date 10 September 2021 ……………………………. ……...…………………….. PHCM Order (NEW August 2020) 1 of 1 August 2020[3]The Claimant’s claims of discrimination, victimisation, protected disclosure detriment and dismissal are all struck out under rule 37(1)(b) for non-compliance with Tribunal orders.
REASONS
[1]The Claimant presented two claim forms, which were assigned the case numbers set out above. At a telephone case management hearing on 9 September 2021, there was a discussion with the Claimant about the claims he wished to bring, which appeared to be for religious discrimination, victimisation, protected disclosure detriment and dismissal. His claims did not, however, emerge clearly from the information he provided on the claim forms. Nor was he able, at the case management hearing, to clarify these matters in a proper way. In order to give the Claimant a fair opportunity to better explain his complaints, I made an order for him to provide the various necessary particulars in writing. The order was sent to the parties on 9 November 2021. The date for compliance by the Claimant in this regard was 3 December 2021.[2]The Claimant did not comply with the order for further information.[3]On 17 February 2022, the Respondent applied for a strike out because of the Claimant’s non-compliance.[4]On 14 March 2022, the Claimant still not having supplied the required information, I caused a letter to be sent to the Claimant warning him that I was considering striking out his claims for discrimination, victimisation and protected disclosure detriment because he had not complied with the order to provide information by 3 December 2021.[5]On 22 March 2022, the Claimant wrote to the Tribunal explaining that: he was unwell, both physically and mentally; he had been in contact with his GP and a PHCM Order (NEW August 2020) 1 of 3 August 2020 surgeon; he had supporting medical documentation; he would be attending his GP and was arranging with the GP a detailed summary, which would be sent through the following day. This medical documentation and GP summary was not received.[6]On 6 May 2022, I caused a further letter to be sent to the Claimant warning him that I was still considering striking out his claims for the reasons given previously. I directed that if his position was he could not provide the information he had been ordered to because of his health, he had to provide certain specified information from his GP to confirm this was so and advise when it was likely the Claimant would be well enough to comply.[7]On 10 May 2022, the Claimant emailed the Tribunal say “I have received the emails and will reply in due course”. The Claimant sent another email on 27 May 2022 saying that he had received all the medical data except for UCLH, he had a GP consultation on 24 May, he was aware of what was required; he had a follow-up with UCLH on 31 May; and “aim[ed] to submit a concise, specific, fact checked medical summary document by the end of next week.”[8]On 13 May 2022, the Respondent wrote to the Tribunal again seeking strikeout.[9]Today, 23 June 2022, the Claimant still has not provided either the specific information from his GP, as directed by the Tribunal’s letter of 6 May 2022, or the information about his claims ordered at the case management hearing on 9 September 2021.[10]As matters stand, there cannot be a fair trial of the Claimant’s claims of discrimination, victimisation, protected disclosure detriment and dismissal. The Claimant has not provided the information required about the alleged acts of discrimination, victimisation or detriment, nor the matters said to be protected disclosures. These claims cannot be understood or sensibly responded to. Repeated attempts have been made to clarify the Claimant’s claims, both at a hearing and subsequently in correspondence, without any success. Whilst the Claimant has suggested it is his health which has prevented him from doing this, he has failed to properly evidence this, despite having been given a very considerable opportunity to do so. There is no reason to suppose that a further delay will bring about either clarification of the Claimant’s claims or appropriate evidence to show there is a medical reason which prevents him from complying at present but holds out the prospect he is likely to be able to do so within a reasonable period of time in the future. In these circumstances, a fair trial is not possible and it is in the interest of justice to strike out the identified claims for non-compliance by the Claimant with Tribunal orders.[11]The Claimant’s claims of ordinary unfair dismissal, wrongful dismissal and holiday pay will, however, still proceed to a final hearing. The parties are invited to agree a time estimate for the final hearing and timetable for:11.1 the Claimant to provide a schedule of loss;11.2 disclosure of relevant documents; PHCM Order (NEW August 2020) 2 of 3 August 202011.3 the agreement of a file of documents for use at the final hearing (which the Respondent will prepare);11.4 exchange of witness statements.[12]In default of agreement on these matters, the parties may submit their own suggestions.[1]By an ET1s presented on 1 October 2020 and 2 October 2020, the Claimant ticked boxes indicating that he was claiming unfair dismissal, religion, or belief discrimination, he was owed notice pay, holiday pay and arrears of pay, and other payments (namely redundancy), and was making other claims. He enclosed a document entitled “Grounds of Complaint” with the latter ET1 (the earlier one just having ticked boxes it appeared from the Tribunal file) and the claims were ‘joined’ by the Tribunal (p.60). The Respondent filed an ET3 defending all the claims.[2]Prior to this Tribunal dealing with the claim the matters had narrowed considerably. This was because after identification of claims and amendments made at an earlier Preliminary Hearing, the only remaining jurisdictions (claims) became unfair dismissal, wrongful dismissal (notice pay) and outstanding holiday pay upon termination. This was due to the dismissal of the redundancy pay claim following its withdrawal (p.46) and striking out of all discriminationbased claims (including victimisation) and whistleblowing detriment claims for non-compliance with Tribunal orders (p.89).[3]At the hearing before this Tribunal on 4-8 September 2023, the Claimant was representing himself and Mr Gareth Price of Counsel represented by the Respondent. The Tribunal was provided with the following documents: 3.1. an agreed hearing bundle, which was originally 2214 pages of documents and a separate index. This was provided at the commencement of the hearing. During the hearing further documents were added to the bundle, namely: the Record of The Preliminary Hearing of 3 March 2023 (which became pp.2215-2224 but transpired was already included in the bundle at pp.1190-1199 and pp.2018-2027), email chain that ended on 20 November 2019 under the subject “Immanuel College outstanding account” and “Immanuel College” (pp.2225-2231) which were part of document already included in the bundle and should have been found in its Appendix 10. All page references in these Reasons relate to this bundle; 3.2. an interim report of Mr Ryan Rubin dated December 2019 (which was provided on the morning of 6 September 2023 as part of the Respondent’s ongoing duty of disclosure). This was not added to the bundle, but all had a copy, and the Respondent indicated its case was the last version of the report was found in pp.503-520 and dated January 2020 on it; 3.3. witness statements on behalf of the Claimant, Annette Koslover, Hannah Boyden, Lucy Marks; 3.4. written closing submissions for the Respondent (which were supplemented by brief oral submissions). Both of these presented on 8 September 2023; 3.5. written closing submissions for the Claimant (received on 13 September 2023 by the Tribunal.[4]In terms of witness evidence, the Tribunal heard from a total of five witnesses, namely all those who had provided witness statements and Ms Elaine Draddy who attended in compliance with a witness order (so gave live evidence only and provided no witness statement). Those who provided witness statements all confirmed these as being true to the best of the respective witnesses’ knowledge and belief having taken an oath or affirmation.[5]The Tribunal confirms that it considered all the documents referred to in the witness statements, live evidence and in closing submissions. B) Procedurally matters and issues[6]At the commencement of the hearing on 4 September 2023, the issues and respective parties’ positions in brief was discussed. A Record of Preliminary Hearing of 3 March 2023 set out the issues and parties’ positions (pp.1195- 1199, pp.2023-2027, pp.2220-2224), but some of these were no longer in fact pursued and there was further clarification provided. The agreed issues and positions in brief are set out below (the wording in so far as possible mirroring the earlier Preliminary Hearing issues where there was no change): 6.1. It was agreed that the Claimant was dismissed, and the claim was brought in time. Accordingly, the first issue was what was the reason or principal reason for the dismissal? The Respondent says the reason was conduct, a potentially fair reason to dismiss under s.98(2)(b) Employment Rights Act 1996 (“ERA”), namely alleged gross negligence. 6.2. If the Respondent establishes the reason was conduct, the Tribunal will need to consider, did the Respondent act reasonably in all the circumstances in treating that as a sufficient reason to dismiss the Claimant? In approaching this issue, the Tribunal will usually decide, in particular, whether: 6.2.1. there were reasonable grounds for that belief; 6.2.2. at the time the belief was formed the Respondent had carried out a reasonable investigation. The Claimant asserts the investigation was not fair, there were omissions in that witnesses were not (or not thoroughly) interviewed. 6.2.3. the Respondent acted in a procedurally fair manner. The Claimant asserts that in three particular manners it was procedurally unfair, namely(i) he did not have full access to his documents to defend himself as his access had been removed and the information he was provided was partial,(ii) he was not allowed to have his own copy of the ‘expert report’ relied upon,(iii) there was no expert evidence provided to or part of the decision making panels, or ‘vetting’ of the expert report that was relied upon; 6.2.4. dismissal was within the range of reasonable responses. The Claimant asserts that it was not, the sanction should not have been dismissal. 6.3. If the Claimant succeeds in his claim and an unfair dismissal is found, the following remedy issues would be considered at this stage only: 6.3.1. Is there a chance that the Claimant would have been fairly dismissed anyway, and if so, by how much should the Claimant’s compensation be reduced to reflect this? 6.3.2. Did the Claimant cause or contribute to his dismissal, and if so, would it be just and equitable to reduce the Claimant’s compensatory award? If so, by what proportion? 6.4. It was agreed that the Claimant was dismissed without any notice pay and that if there was no repudiatory breach (the gross misconduct or gross negligence alleged) he should have received 12 weeks’ notice pay under his contract. It was equally agreed that the claim had been brought in time. The sole issue to determine is therefore whether the Respondent was entitled to dismiss the Claimant without notice? 6.5. The only claim was for holiday outstanding upon termination, and it was agreed that the claim had been brought in time. The sole issue was whether the Claimant had been paid all such sums.[7]Before setting out our “Findings of fact”, the Tribunal briefly sets out the procedural matters that occurred during the course of the hearing. Witness statements[8]The Claimant wished to have his witness statement substituted for a version that was fuller and not served at the time of mutual exchange but shortly thereafter. The Respondent’s representative confirmed that this version, which had been served on it, was no longer objected to and accordingly the Tribunal was satisfied that this would be the statement that it would consider. Separately it was realised that a few statements of the Respondent had minor formatting differences which meant that a paragraph number was different from one on the witness table. Following analysis, the content of the statements was the same and neither witness nor parties were prejudice once this was discovered. Accordingly, the hearing was able to continue. Audio files[9]On 4 September 2023, the Claimant made an application that audio files of meetings and conversations should be included in the ‘bundle’ and heard by the Tribunal. He confirmed these had been provided to the Respondent. The Respondent objected to this as there were said to be about 5 hours or so of recording and it was asserted, they would be prejudiced as it was not possible to listen to all of these. The Tribunal clarified with the Claimant the nature of the audio files and the Claimant clarified that these were well before the events that led to his dismissal. In brief, they showed that he was talking active steps he asserts and had been blocked. He stated that IT regularly recorded meetings and that was the reason why he had them and further that he only discovered them late in the day as they were on an old device.[10]The Tribunal refused the application and gave oral reasons at the time. Considering the overriding objective, it determined that the relevance of the documents was tangential. None of these were before the decision makers. Furthermore, given the late stage admitting them or considering them would inevitably lead to a postponement of the hearing as it would not be fair to the parties for such extensive recordings to be now ‘part of the bundle’. However, the Tribunal made clear that the Claimant could renew the application at a later stage if matters changed and if things became more focussed. By way of example the Tribunal explained if the Claimant was asserting, he did or did not do something, and the Respondent disagreed and there was unambiguous evidence by way of the recording to corroborate his evidence that particular section could be admitted. Witness order[11]The Claimant explained that he wanted his Trade Union representative to attend to give evidence but had been told that the union internal policy was to refuse to do so unless ordered by the Tribunal. The Claimant further explained that he understood the Tribunal had made such an order. The Tribunal looked at the documents on file and noted that the Claimant was correct in so far as it appeared than an Employment Judge was minded to grant the order and asked for the details for service to do so. However, technically no order was made. The Tribunal invited observations from the Respondent who did not object to the order, which bizarrely it had been copied into all the correspondence from the Tribunal about (witness orders being one of the exceptions to the general rule of parties all be informed of all correspondence/applications). In the circumstances and given the Tribunal correspondence on file, the Tribunal granted the order which it appeared a previous Employment Judge had indicated was to happen. Given the expediency it was canvassed with the parties whether the witness could attend via Cloud Video Platform (“CVP”), and both stated that seemed sensible. The relevant order was made and Ms Elaine Draddy duly attended by CVP. Order of evidence and timetable[12]Whilst ordinarily the Respondent would give evidence first in an unfair dismissal claim where the ‘reason’ was still in issue owing to the burden of proof and this seemed the main claim (the other claims arguably may lead to the Claimant giving evidence first) the parties agreed for the Claimant to give evidence first. This was thought practical as the Claimant indicated he had not actually prepared all his questions and also because it would give the Claimant a better idea of what cross examination could entail by seeing a professional initially undertake it. Adjustments made to the process[13]The Claimant, as a litigant in person, was undertaking what is understandably a stressful process. On top of this he had various health issues past and present the exact nature of which it is not necessary to record in the judgment although their effects, which are relevant, are problems with his voice sounding quiet and forgetting matters in the sense of repetition or the long questions with different starts and beginnings. Owing to these and other health issues and/or vulnerability raised the Tribunal made adjustments of asking for repetitions if needed, ignoring issues with the formatting of documents, having more breaks in proceedings (when they were asked, or it appeared sensible from the way things were being conducted that one was warranted) and had to break down/relay a lot of the questioning to each witness. These were all necessary adjustments to the proceedings and the Tribunal enquired with the Respondent’s representative whether he had any observations in relation to the Tribunal putting or ‘re-putting’ the Claimant’s questions. He indicated he was satisfied that the Tribunal was not entering the arena but at times objected to the Claimant making ‘asides’ in his questioning and not letting the witness finish. The Tribunal repeated the general rules as to decorum and how the hearing should be undertaking. The Tribunal was content that all witnesses did have an opportunity to give their evidence, even if it required questions to be repeated. CVP[14]In light of the above, there was considerable slippage to the initially agreed timetable. The Respondent asked whether two of its witnesses could give evidence by CVP at the close of the day on 6 September 2023. They had previously attended Tribunal but owing to professional commitments and travel asked for the manner to proceed via CVP. The Claimant initially did not object to the course and the Tribunal in all the circumstances was satisfied that this could happen, as had occurred for Ms Draddy earlier. However, the Claimant later emailed saying in effect he had changed his mind and he needed to see the people he was cross examining. He said he needed to be able to see ‘credibility’ and also indicated that previously he had difficulty in other proceedings via CVP as the judge could not hear him. The Tribunal refused the Claimant’s application on 7 September 2023 for the witnesses to now attend as that was not within the overriding objective. In terms of the judge understanding or not understanding the Claimant on previous occasions, on this occasion the Tribunal and the Claimant were in the same room so that concern did not appear well founded. In terms of credibility issues, it was for the Tribunal to judge credibility and if the Claimant’s change of position was acceded to it would mean the hearing would have to be postponed as the witnesses could not travel to the hearing centre within sufficient time for the full hearing to occur. Closing Submissions[15]Closing submissions were due to occur on 8 September 2023. The Respondent, having already given prior notice, handed up six-page written submissions and was proposing to be no more than 10-15 minutes in oral submissions. It was agreed that the Respondent would go first so that the Claimant would have an opportunity once more to see how closing submissions can occur, and also allow him to hear the entirety of the Respondent’s closing before replying. Prior to the 8 September 2023 closing, the Tribunal indicated that the Claimant could put in writing only, writing, and oral, oral submissions or even make none. After the conclusion of evidence, the Claimant indicated that he did not think he would be in a position to deliver submissions. After discussions with the parties the following was agreed: 15.1. the Respondent would deliver the oral submissions; 15.2. the Claimant would provide his closing submissions in writing. He was afforded until 4pm on 13 September 2023 to do so (and duly provided them on 13 September 2023). This date was agreed with him as he thought it was realistic, he did indeed adhere to it, and met the Respondent’s concern of equality of arms in the Claimant not having too much extra time. The Tribunal stresses that the Claimant himself indicated his preference was to do his submissions in writing only, he did not want to make oral submissions or be questioned on it. This is why the somewhat unusual approach was adopted; 15.3. the Respondent was afforded a right to reply on any points of law but did not in fact exercise it. C) Findings of fact[16]The Tribunal heard and considered much evidence. It made the following findings of fact on the balance of probabilities of those areas that were material to the decision it had to make.[17]The Respondent is an independent (private) co-educational Jewish day school for children aged 4-18. The Claimant commenced employment with the Respondent on 14 March 2022 (p.95) and it was common ground that he had 12-week notice provision in his contract (p.95). As an aside, whilst there was a dispute as to whether that was the most recent contract during live evidence that 12 weeks was the relevant notice period was agreed (he was saying he was owed this amount of notice pay for his wrongful dismissal claim).[18]Throughout the Claimant’s employment he worked in the IT Team and at the relevant time of the events in question that led to his dismissal had the title ‘IT and Comms Manager’ or ‘IT Manager’. The Claimant stated, and the Tribunal accepts especially as there was no challenge, that he had a clean disciplinary record and was well regarded by the Respondent in general (save for relationship issues which he had with his final line manager which is dealt with below). IT team[19]The IT team at the relevant time consisted of the Claimant and two others (Messrs Karwal and Yordanaov). In addition, there were numerous contractors used. Since 2019, Barney Nemko, Deputy Head, was the Claimant’s line manager. Prior to this the bursar, Antony Berkin, line managed the Claimant. The nature of IT, which has a wide-ranging effect on schooling and the estate, meant the Claimant also had regular contact with Senior Leadership Team, Governors, and Human Resources.[20]The Claimant and Mr Nemko it appears had a difficult working relationship. The Claimant alleged that he was undermined by Mr Nemko who it was alleged removed or overrode a lot of his IT authority and disregarded some of his IT plans. The Tribunal does not need to make findings on these particular factors given what was eventually the cause of the dismissal as set out below but acknowledges that it heard some evidence in relation to this. Auditors[21]In May 2019, auditors of the Respondent had queries in relation to IT including “We are not aware of any progress on IT security, disaster recovery or cloudback-up of data” (p.197). There was email correspondence between the Claimant and Mr Nemko which resulted in the following information being supplied to answer the query (the information being provided from a technical point from the Claimant, p.193), which stated amongst other things “All external ports scanned, no obvious holes….June 2019, Anti-virus being switched from Symantec to E-SET which allows better integration” (pp.201-202). Cyber attack[22]On 28 October 2019, the Respondent’s IT came under a random sophisticated cyber-attack. The attack escalated and progressed to internet facing servers by 9 November 2019. As part of the attack the Respondent lost access to several files, had back-ups deleted and had ransomware installed. As a result of the attack much time was spent and cost (including paying the ransom) by the Respondent. The Tribunal pauses to note that it was not part of the Respondent’s case before it that the Claimant did anything wrong as such following the attack. Indeed, it appeared he worked diligently to remedy the issues. The real issue before the Tribunal was what happened, or what steps appeared to not have occurred, before the random cyber-attack. Investigation[23]The Respondent engaged a cyber security and digital forensic expert, Ryan Rubin, to undertake an investigation into the root cause of the attack. The report was not to do with any individual, such as the Claimant, but rather the technical system causes or flaws. Mr Rubin also assisted with IT post the Cyberattack along with others and it is notable that on 19 November 2019 there was an email from Mr Nemko (although sent from Mr Karwal’s email address) to the Claimant, copying in various others including Mr Rubin, which stated amongst other things “5. We are still chasing the final install with ESSET – apparently the licencing is not right and we want to get 100% of the site covered, so far 80%ish is covered. 6. There is a conversation to have about the Firewall about closing and opening ports (Ryan and Quentin had this discussion”.”[24]Mr Rubin identified a number of fallings and produced a draft report (which is set out in greater detail below). The result of this was that a full investigation was launched, and the Claimant was suspended. A letter informing the Claimant of this of 19 November 2019 noted that “I am aware of a number of serious allegations which have been brought to my attention regarding your conduct and/or serious omissions in respect of virus protection and a cyberattack in the workplace. In my capacity as Head Master, I have a duty to ensure that a full and proper investigation of the matter is conducted”.[25]On 21 November 2019, the Claimant had an initial investigation meeting with Paul Abrahams (pp.433-442, with amendments suggested to the notes at pp.443-448). During this meeting the Claimant was asked if there was “enough protection” to which he answered “Yes. Eset were paid to do an install on all servers, remote access. IC management 01 was not covered but had anti-virus software on it” (p.436). The Claimant was also asked if there was any “business contingency plan…to follow” and answered “no” (p.439).[26]By December 2019, Annette Koslover (Governor) was appointed as the investigator in relation to potential issues of misconduct by the Claimant. Mrs Koslover did not conduct any further interview meeting with the Claimant but did have the benefit of Mr Rubin producing draft reports. She did have interviews with Mr Nemko, Mr Karwal, and attempting to contact some of the third parties (IT consultant from XMA), Harry Boyne (of the contractor Chalkline) and Howard Panas owner of PC Express. The third parties did not all have interview notes but did provide some documentation and responses in writing both before and after Mrs Koslover’s appointment. One of them, T-Tech, provided an email of 20 November 2019 that set out that “All of the networking equipment that was monitored in the past has been removed from monitoring since a network reconfiguration project was initiated and done at IC, but we were never provided the details on the new networking devices, so we could add them back to monitoring” (p.426).[27]Ms Koslover produced a report that recommended the matter progress to a disciplinary hearing (the “Investigation Report”). The Investigation Report consisted of 12 pages (pp.491-501) and numerous appendices. IT quoted from Mr Rubin’s report in part, as well as referring to other documentation that included the above T-Tech email. In summary it concluded “on balance of probabilities there is a case to answer in respect of the allegations set out above” (p.501), with these allegations being (p.491): 27.1. the Claimant did not(a) ensure the installation of an adequate antivirus protection for the whole IT estate or at all and(b) did not actively monitor security logs and firewalls; 27.2. the Claimant did not (a) install or ensure the installation of adequate backups to the whole IT estate or at all (b) monitor the contractors who were assigned the task of backing up and monitoring backups; 27.3. the Claimant did not take timely and appropriate action to mitigate damage and loss and escalate the matter to the appropriate senior staff when he was aware of a problem with the IT system; 27.4. the Claimant did not have an adequate patch management plan and there was a plan to consider whether it was followed; 27.5. the Claimant did not effectively manage third party contractors; 27.6. the Respondent’s IT estate was not eligible for an extension of its PLI insurance by being compliant with the minimum requirements for Cyber Liability insurance as at the date of the attack on 10 November 2019 (allegedly because of the Claimant’s failings).[28]The Tribunal notes that one of the conclusions in the Investigation Report was the inadequate installation of antivirus across the entire IT estate and Ms Koslover was questioned on this aspect in live evidence. She answered that “they may have considered fully installed [by the Claimant]. But the evidence from Mr Rubin was that it wasn’t perfectly installed”.[29]Returning to the Investigation Report, a full copy of it was provided to the Claimant including all its appendices except for Mr Rubin’s report. The Claimant only obtained his own physical copy of this report during the litigation process, and it was found at pp.503-520. In terms of the precise date that the Investigation Report was provided (with all appendices save Mr Rubin’s report) it was suggested in cross examination that it was provided in “January 2020” to which the Claimant answered, “Think so, it was for disciplinary”. The Tribunal finds as a fact that this was provided to the Claimant with the initial invite letter of 15 January 2020. This is because whilst the Tribunal did not see a copy of that letter, it is both standard industrial practice and the later letter of 20 January 2020 which the Tribunal did see (see below) included a reference to this document. That reference only makes sense, and the point that an appendix of the report had not been provided, if all the other documents had been provided with the Investigation Report by the earlier correspondence. Rubin report[30]As noted above, the Investigation Report quoted from Mr Rubin’s report in part. In effect it was relying heavily on Mr Rubin’s report and the Tribunal accepts that Mr Rubin was the only person with technical expertise to deal with the IT issues as at the point of the Cyberattack in relation to the investigation stage. The notable findings contained in the Mr Rubin report in relation to the case the Tribunal was having to deal with were as follows: 30.1. “Anti Virus Management: Ineffective deployment of AV software left an Internet facing Anti Virus server (RDP) and multiple internal servers with partial/ suboptimal AV protection. Lack of AV monitoring activity and more effective use of Threat Detection software could have detected or mitigated the attack earlier” (p.506). The report later noted the attackers “downloaded files including a well known hacking tool…and successfully disabling legacy antivirus software by installing software called “Process Hacker” (p.509) (as an aside the Tribunal notes this point was summarised in the Investigation Report, p.494 [11]) and further that “At the time of the attack, it is clear that not all desktops and servers had full AV agents installed on them and that the AV migration away from Norton Symantec to ESET was not fully effective…during the investigation…[the Respondent] needed to obtain further licences from ESET AV Supplier…in order to provide sufficient coverage of its IT estate” (p.512). The Tribunal notes that this point of needing to obtain further licences was quoted in the Investigation Report (p.493 [3]). In relation to antivirus, Mr Rubin’s report also stated “the attackers proceeded to download [software] onto the ICRD01 server. If the AV software was running effectively, and enabled it may have detected and blocked [the software download]” (p.509). The recommendation was to “Ensure adequate monitoring is in place for AV deployed across the estate with 100% coverage of Workstation and Server endpoints” (p.518); 30.2. “Patch Management: Poor practices identified on the servers left them exposed without critical security updates. The College is also dated systems that will be out of support in Jan 2020. Whilst on the plan this summer, the migration didn't take place which may have refreshed systems to latest security levels” (p.507). It was stated in relation to this that “According to ESET 's initial triage analysis (Antivirus software used by Immanuel College) who were contacted by the College on 11th November 2019, ICRD01 and Management01 servers were missing patches CVE2019-0708 and CVE-2019- 1181. Management01 was also missing patch MS17-010. These missing patches would have enabled an attacker to gain super user access to the ICRD01 server without requiring a username or password creating a strong foothold into the Immanuel College network. ESET also noted that their ESET Anti Virus software alerting agent was not running on ICRD01 (although their scanner was) and other core servers at the time of the attack. It is noted however that some of their software (ESET File Security) was installed on the ICRD01 prior to the attack taking place which identified unusual files being uploaded” (p.508). The Tribunal notes that this passage was quoted in the Investigation Report verbatim (p.492 [2]); 30.3. “Monitoring: Lack of active monitoring of firewall and server security and system logs could have created multiple opportunities to detect and act on unusual activity such as numerous external connections from Russia, server shutdown events (Multiple servers), deletion of audit logs (RDP Server) etc” (p.507). The Tribunal notes that the Investigation Report quotes a similar passage from the Mr Rubin report at p.495 [19] “As the cyber attack incident unfolded it became apparent that there was no active monitoring of security logs on firewalls AV software or underlying windows servers”. 30.4. In relation to backups, it stated “The absence of tests undertaken to check validity of existing backups and poor understanding of what had been backed up and where put the College under extreme risk and undue pressure following the incident. Furthermore, a strategy of storing backups monthly, yearly and also in separate locations i.e. physically and in the Cloud had not been effectively executed resulting in the College relying on one set of Backups (in the Cloud). Unfortunately access to these backups was not well protected” (p.515). One of the recommendations made was “Revise the backup and restoration strategy with a combination of Cloud and onsite back-ups and leverage remote file data storage in the Cloud where it makes sense to do so with appropriate security controls in place.” (p.517). The Tribunal notes that the Investigation Report quotes from a similar passage of the Mr Rubin report (p.496 [21]), as well as concluding that based on the “analysis by CDL [that is the Mr Rubin Report]…it was evident the backup strategy was poorly designed, defined and executed. The failure to check the efficacy of the cloud based back ups before abandoning the hard copy backups left the school vulnerable and constitutes a serious omission by [the Claimant]” (p.497 [27]).[31]In relation to Mr Rubin report, the Claimant was asked in live evidence by the Tribunal if there was anything wrong with it from a “technical standpoint”, given the Claimant’s case was he had not been provided with a copy to take home and had insufficient time with the report, to which he answered, “Nothing wrong technically with it”. He clarified that his case was that if Mr Rubin had seen a document he described as the “Master Audit”, which the Claimant had produced and updated, a version of it being found at pp.104-118 (although it was in issue if that was the most recent one), he “would have appreciated [the Claimant] had identified the issues”.[32]In terms of the failure or rather decision to not provide the Claimant with his own copy of Mr Rubin’s report the evidence provided to the Tribunal at the hearing was: 32.1. Mrs Koslover believed it was “confidential” and not disclosed because Mr Rubin did not want it to be shared. He was concerned apparently of having version control of a document that was part of discussions and could change during the course of his investigation into the causes or failures leading to the attack; 32.2. Mrs Boyden believed it was not disclosed because it was “confidential” in the sense it had sensitive material and there was a concern that the Claimant could disclose it to others which would put the Respondent at more risk. Invitation to disciplinary[33]The Claimant was initially invited to a Disciplinary Hearing on 23 January 2020. However, this was postponed as evident from the letter dated 20 January 2020 that “your email [the Claimant] of Friday 17 January 2020 requesting a postponement of the Disciplinary Hearing scheduled for Thursday 23 January. I am writing to confirm we are able to agree to your request and I have reschedule the Hearing to Tuesday 28 January 2020” (p.522). The Tribunal notes that there was no initial invite letter in the bundle and the Respondent’s representative confirmed that whilst one was sent (the Claimant did not dispute this and merely stated he could not recall whether he did receive it) no copy could be found. The letter of 20 January 2020 also stated as relevant at p.522: In accordance with the revised date and as referred to in my previous letter of 15 January 2020, please can I ask you to confirm the following: 1. if you wish to be accompanied at the Hearing by a trade union representative or a fellow worker, please let Mrs Simone Garfield…know by midday on Thursday 23 January. 2. If you would like to submit any further information prior to the Hearing please ensure this is received by 5 pm on Thursday 23 January. 3. if you wish to call witnesses to support your case, please can you notify Mrs…Garfield no later than midday on Friday 24 January. 4. Item 6 referred to in Appendix 1 of the investigation report (Interim Root Cause Analysis by Cyberian Defences Limited) is strictly confidential and sensitive and we are not able to forward it on. The report will be made available to you from 9.00 am on Tuesday 28 January in a private room at the Hilton Hotel. If you would like to view the document earlier then please get in touch with Mrs Simone Garfield soon as possible to arrange this. Finally, you have requested access to your emails and information. To facilitate your request we are able to export your emails and documents in N drive to an external hard drive / USA. We will arrange for this to be couriered to you as soon as possible.[34]A further request for a postponement by the Claimant was made and granted by letter of 27 January 2020 (p.522). This letter also set out who would be attending the hearing, that if the Claimant wished to submit further information this should be provided by 31 January 2020, that if the Claimant wished to call witnesses, he should notify the Respondent by 3 February 2020. Additionally, it stated I understand you met with Ms Rachelle Hackenbroch [HR Director] on Thursday 23 January to view (Interim Root Analysis Report by Cyberian Defences Limited) [produced by Mr Rubin]. If you wish to view this document again, please contact Mrs Simone Garfield as soon as possible to arrange this.[35]The Tribunal pauses to note that during cross-examination the above passage was drawn to Claimant’s attention, and he was asked if he saw the “document again” to which he responded, “I believe that we would have requested to see it prior to the hearing on the 5th February”. In his witness statement he stated, “we were we were not provided with either copy of the independent cyber security report to view for more than 30 mins prior to hearing 1.” The Tribunal concludes that given the letter, which was not challenged in any documentation, and the Claimant’s answers in cross examination, the Claimant was able to view Mr Rubin’s report twice, namely on 23 January 2020 and on or around the 5 February 2020.[36]Returning to the chronology and invitation to a disciplinary hearing, the hearing intended to take place on 5 February 2020 was postponed owing to the Claimant’s ill health. The Tribunal pauses to note the Claimant following his suspension from work suffered from various health issues. The exact nature of these is not relevant but the Tribunal accepts that these were serious and that whilst medically fit, in the sense of not being ‘signed off’ during the disciplinary and appeal process, he was suffering significant mental stress. Disciplinary hearing[37]On 27 February 2020, a disciplinary hearing occurred. The disciplinary panel, Mr Gary Griffin (Headmaster) and Mrs Hannay Boyden (Governor), were present. Mrs Koslover was present to in effect speak to her report and provide the ‘management case’. Ms Hackenbroch attended in the function of providing HR assistance and there was a separate notetaker. The Claimant was accompanied at this hearing by Ms Draddy (Trade Union representative).[38]Notes of this disciplinary hearing were produced (pp.547-575). The Claimant did not in his witness statements or during live evidence point to material issues with the notes. The Tribunal accordingly accepts and finds the notes to be materially accurate record of what was stated at the disciplinary hearing. The following was stated in that disciplinary hearing: 38.1. the Claimant response following management case was to start “by addressing the 6 points in the report” which included “Point 1 – Installation of antivirus” (p.551). In relation to antivirus, he summarised his position that he had been deployed across the whole site, with him monitoring the deployment and 1 server should have been “killed but no one could find the Symantec password to do this. It was still running updates to clients. Team could not uninstall it” and that “in between the antivrus implementation a number of Chromebooks were bough and there were not enough licenses”. Fundamentally though his position was that “all machines were covered”. The Tribunal pauses to note that the Claimant in cross-examination maintained the same position namely that he disagreed with a conclusion in the Mr Rubin report that not all servers had antivirus, stating that two had an older version of the product which were due to be decommissioned; 38.2. the Claimant stated that he had requested a security audit, but this had been blocked (p.552); 38.3. the Claimant noted that Mr Rubin had excluded 4-5 IT companies such as “Class Link, Salamander, Odessy, Fuse IT, Hayes IT who are suppliers and support contracts” which the Claimant did not sign and are not looking after our main IT infrastructure (p.555); 38.4. the Claimant explained “he felt had lost control over 18 months and had no idea what was going on” (p.555); 38.5. in terms of antivirus, the Claimant’s view was “80% was covered but due to additional machines arriving in the interim, the last 20% were with IT and running Symnatec AV. 100% check compatibility” (p.556); 38.6. the Claimant asserted that there “was active monitoring. The firewall and anti-virus was in place. Monitoring of logs is important” (p.559); 38.7. the Claimant asserted that antivirus is running on “ICD01” (p.559); 38.8. a witness, Mr Karwal, agreed with the Claimant that “IT monitored logs and if the whole system was monitored by TTech” (p.561), although later the Claimant stated he did not “even know” that out of hours monitoring was not taking place and that at points “IC were not being monitored”. On this topic, his union rep asked him “if he was disagreeing with monitoring taking place?” to which he answered “Said it was 50-50. Explained that you do not just buy monitoring, it is a package but no” (p.561). The Tribunal pauses to note that in cross-examination the Claimant disagreed that there was no active monitoring of security logs; 38.9. a witness, Mr Karwal explained that “whoever compromised the systems got into the backups from the cloud servers…there should have been a system in place to halt deletions. This was not in place” but believe that failure was the responsibility of the third-party contractor (p.563); 38.10. the Claimant stated, “Point 4 – Patch Management Plan stated that there was none, and it was part of the Server 2016 updates/upgrades” (p.568), so instead it was done manually but it was part of the summer plan; 38.11. in his concluding points the Claimant stated, “IT had grown so much that it was hard to keep track” (p.569); 38.12. the panel at the disciplinary hearing asked the Claimant if the “role of IT manager is to ensure systems are in good order” to which he agreed and stated “yes, it was all ready but he was prevented from implementing it. Stated that it was flagged up in reports…Asked what are we compliant with. Stated they are not. Informed the panel that he cried out for help when he was not an expert. Stated that he highlighted this but was continually ignored. ASH said that was saying the same thing and no one was listening and that he said this back in 2018. Agreed that 84k to spend was a lot of money and 4k for a security audit would have saved this from happening” (p.573). The Tribunal pauses to note that during cross examination a similar point was made in relation to responsibility, with the Claimant agreeing that the network infrastructure was his responsibility, and that adequate protection against Cyberattacks on an operational day to day level were his responsibility but that strategically he had lost oversight of these matters. Likewise, for “ensuring that the IT estate was adequately protected by AV software and continuous monitoring” and “systems in place to ensure…latest software patches” he agreed that this would ordinarily fall within an IT Manager’s responsibility, and so be his responsibility, but stated he was prevented from doing this. Claimant’s dismissal on 7 May 2020[39]By letter dated 7 May 2020, the Claimant was informed that he was dismissed (pp.600-602). This letter included the following “findings”: 39.1. “several of the servers were missing ESET patches. The presence of Legacy AV software may have compromised the newly installed…AV. There was not enough coverage of ESET AV” (p.600); 39.2. the “responsibility of ensuring that the estate was adequately protected by AV software and its continuous monitoring, ultimately rests with the IT manager” (p.600); 39.3. “It appears no coordinated patch management plan had been instituted between the internal IT department and the school’s external IT suppliers. Fully updated patches across the network would have made the IT estate less vulnerable to an attack” (p.601); 39.4. Whilst the Claimant had stated he was not aware of the insurance Cyber Liability Insurance conditions, it is “reasonable to expect as part of the delivery of School IT provisions that these [underlying] conditions should have been met” (p.601).[40]The letter concluded that whilst the panel was not able to come to a formal conclusion on all the allegations it found that the following were allegations made out that were “directly attributable to [the Claimant] in his role as IT Manager: 40.1. “lack of effective AV software across the estate”; 40.2. “lack of patches and a system to ensure they were updated”; 40.3. “a lack of adequate monitoring” 40.4. “no recent formal hard drive backups”.[41]The letter acknowledged gaps in governance in the monitoring and supervision of IT, but nevertheless concluded that the Claimant was “guilty of gross negligence”.[42]In terms of the dismissal, Mrs Boyden gave live evidence before the Tribunal. She stated that it was a joint decision between her and Mr Griffin and they were unanimous. The Tribunal accepts that evidence, it was not challenged by the Claimant and there was nothing that contradicted it (indeed she stated as much in her witness statement at [12]). It was confirmed that the reason for the dismissal was solely for the four matters set out in the dismissal letter. These did not precisely match the ‘allegations’ in the Investigation Report, in terms of there phrasing, but the Tribunal accepts that factual evidence. During questioning in live evidence, she explained that each of the matters were “under his control” and were “serious enough to dismiss”. Thus, her evidence was she considered that each on their own were serious enough to dismiss and it was not simply a matter of dismissal for cumulative findings. The Tribunal accepts that this was her genuine belief and thought process. Appeal[43]By email of 15 May 2020, the Claimant appealed his dismissal. This set out the following as being his grounds for the appeal (p.603): I wish to appeal the decision to summarily dismiss me on the following grounds:• The outcome does not reflect the evidence presented and dismissal was an inappropriately harsh sanction• There were serious failings in the way that the investigation was conducted. The investigation was not thorough enough given seriousness of the allegations and there were inconsistencies of approach.• I was not provided with information requested which prevented me from accessing the evidence needed to prepare a robust defence to the allegations. I was not provided with access to my Office 365 account, my one drive, share point, teams, calendar, notes, my written notes and summary info and meeting notes from my Team and myself which are on site. Additionally, access to my own storage in the IT dept. folders on the department NAS drives/ other off network storage.• There was insufficient consideration of my explanation and investigation of the circumstances leading up to the dismissal which were highlighted repeatedly.• There was no information given on how conclusions were reached in light of the additional documentation provided and requested after the hearing[44]The Claimant was duly invited to an appeal hearing by letter of 29 June 2020. The hearing took place on 9 July 2020. The panel for it were Mrs Marks (Governor), who chaired, and Lisa Zimmerman (Chair). Ms Hackenbroch once again attended to provide HR assistance, and the Claimant was accompanied by his union representative (Ms Draddy). A note taker was present, and notes were produced (pp.613-624, and amendments to these by the Claimant were found on pp.628-640 although were difficult to read). Whilst some amendments were made the below were explored in live evidence and agreed as being materially accurate record: 44.1. As one of the grounds of appeal was the Claimant not being provided with relevant information, he was asked at the appeal if “he had all the information requested” to which the Claimant confirmed that “broadly looking most of it is there”; 44.2. Also, during the appeal hearing Ms Zimmerman is noted as stating “The cyber report from Ryan Reuben (RR) mentioned that had the Summer Plan been put in place / completed the cyber-attack would not have happened.” (p.621).[45]The comment made by Ms Zimmerman, set out at paragraph 44.2 above, led to the Claimant to believe before this Tribunal that there was a further version of the Mr Rubin report. Indeed, the Tribunal noted that the report it was taken to had “Draft for discussion” on it. This topic, as to whether there was an unseen final report, was explored with Mrs Koslover in her live evidence and she stated there was only one ‘final version’. Her evidence was that the report that started on p.503 was the final version. Mr Rubin, she said, had done an earlier draft and it got to a stage where the Respondent said the investigation had to conclude which is why it was left with the title “Draft for discussion”. Moreover, as set out at paragraph 3.2, the Respondent’s representative disclosed an earlier draft the Respondent had of the report. The Tribunal finds that the report that started on p.503 was indeed the final version of the report. This is because its content matches the references in the Investigation Report, and it makes little sense for there to be a report produced after the Investigation Report. Furthermore, it found Mrs Koslover’s evidence to be credible in relation to why the confusing words “Draft” were included, and this was the position of the Respondent’s representative when the Tribunal asked it to investigate this aspect. It is understandable that the Claimant would be led to believe there is another version, given the comment Ms Zimmerman made which as noted later did not feature in the report, but that explanation is less likely all things considered and would mean that the Respondent, who at all times has been professionally represented, was deliberately withholding documentation. This finding leads to the inextricable conclusion that Ms Zimmerman’s comments made at the meeting were factually incorrect. In relation to that topic, why Ms Zimmerman would have said something that was not in the report, Mrs Marks stated Mr Rubin’s report had no such reference and that was a mistake by Ms Zimmerman. The Claimant in his written closing submissions suggested that could not be the case as surely Mrs Marks would have corrected such a grave error at the time. The Tribunal however does find that it was just a mistake. Plainly the comment is not there, and it may be understandable why, in the context where the Claimant was not adopting that line (he specifically disagreed that his summer projects could be said to have prevented a sophisticated Cyberattack in the notes), there was no immediate correction. More importantly however there is a part of Mr Rubin’s report that states that, in relation to Patch management, “Whilst on the plan this summer, the migration didn’t take place which may have refreshed systems to the latest security levels” (p.507). Therefore, the more likely explanation for Ms Zimmerman’s mistake as that she read this reference as incorrectly indicating a cyberattacking being prevented had the summer plans occurred as a key ‘flaw’ was the attackers getting access because servers had not been correctly patched.[46]Returning to the Claimant’s appeal, the appeal was dismissed by letter of 6 August 2020 (pp.641-644), it concluded “the decision to terminate your employment with immediate effect for reasons of gross negligence is justified”. This appeal letter dealt with all the grounds in turn. The Tribunal notes it stated: 46.1. the Claimant had been offered times to attend the school to have access to documentation on 9 March 2020 and also again to access things remotely with the assistance of an IT specialist on 8 July 2020 and so the Claimant had sufficient time and ability to amass relevant documentation for his defence / appeal (p.641); 46.2. there was sufficient consideration of the Claimant’s explanation that included his “summer plan” for work and feeling “undermined” but there was ultimately evidence by virtue of Mr Rubin’s report that necessary things had not been “carried out effectively” (pp.643-644). The Tribunal pauses to note that in live evidence Mrs Marks explained that “I believe that regardless of summer work plan the other grounds were still relevant” and so that did not provide a complete explanation for the other failings that would have led to dismissal being the sanction. The Tribunal accepts this as being Mrs Marks honestly held belief at the time of making the decision to refuse the Claimant’s appeal. D) Relevant legal principles[47]The ERA at s.94(1) provides “An employee has the right not to be unfairly dismissed by his employer”. As to the meaning of unfair dismissal this is set out in s.98 ERA: s.98 General(1) In determining for the purposes of this Part whether the dismissal of an employee is fair or unfair, it is for the employer to show— (a) the reason (or, if more than one, the principal reason) for the dismissal, and (b) that it is either a reason falling within subsection (2) or some other substantial reason of a kind such as to justify the dismissal of an employee holding the position which the employee held.(2) A reason falls within this subsection if it— … (b) relates to the conduct of the employee, … (4) [In any other case where] the employer has fulfilled the requirements of subsection (1), the determination of the question whether the dismissal is fair or unfair (having regard to the reason shown by the employer)— (a) depends on whether in the circumstances (including the size and administrative resources of the employer's undertaking) the employer acted reasonably or unreasonably in treating it as a sufficient reason for dismissing the employee, and (b) shall be determined in accordance with equity and the substantial merits of the case.[48]The relevant deductions that the Tribunal at this stage were considering, often referred to by the shorthand Polkey and contributory fault, are set out in s.122(2) ERA, s.123(1) ERA and s.123(6) ERA.[49]In terms of relevant case law, the Tribunal had particular regard to the following: 49.1. in terms of conduct being the reason for dismissal and falling within s.98(2)(b) ERA (or misconduct), conduct can include carelessness, neglect, negligence, and omissions as demonstrated by Burdis v Dorset County Council UKEAT/0084/18 at [45]. Moreover, there is no dividing line between conduct and capability as such and some acts, such as extreme negligence, can be properly classified as either by an employer: Philander v Leonard Cheshire Disability UKEAT/0275/17 at [52]; 49.2. British Home Stores v Burchell [1978] IRLR 379 (EAT) test at [2] which sets out a three-stage test: honest belief, reasonable grounds to sustain it, reasonable investigation in all the circumstances; 49.3. that s.98(4) ERA amounts to a ‘range of reasonable responses’ test and it applies to all elements of this from investigation to sanction: Sainsbury’s Supermarkets Ltd v Hitt [2002] EWCA Civ 1588, [2003] IRLR 23 at [29]-[30]; 49.4. that the Tribunal should not substitute its own view for that of the employer but apply the range of reasonable responses test: British Leyland (UK) Ltd v Swift [1981] IRLR 91at [11]; 49.5. in considering the ‘band of reasonable responses’ in s.98(4) ERA in relation to the procedure applied, the Tribunal should not look at procedure in a vacuum but rather consider the employer’s reason for the dismissal as the two (reason and procedure) impact upon each other; hence minor procedural issues will not necessarily render a dismissal for a serious act of misconduct unfair, and equally an appeal hearing can ‘cure’ any earlier deficiencies: Taylor v OCS Group Ltd [2006] EWCA Civ 702; [2006] IRLR 613 [47]-[48]. 49.6. where there are several charges of misconduct for which an employee is dismissed at a disciplinary, a Tribunal must consider whether the employer treated each as separate (standing alone) or as being cumulative. In the former situation, all charges require separate consideration by the Tribunal and dismissal could result from one only, even if the fairness of another is called into question: Tayeh v Barchester Healthcare Ltd UKEAT/0281/11/LA at [34]-[38] 49.7. if the dismissal for misconduct (whether it be with or without notice) fell within the 'band of reasonable' responses the claim of unfair dismissal must fail - this applies even if the employee was summarily dismissed for gross misconduct in cases where an Employment Tribunal find his dismissal should have been with notice: Weston Recovery Services v Fisher UKEAT/0062/10/ZT at [11]-[16]. Equally, where there are several allegations of misconduct found to have occurred one is concerned with totality of misconduct found in addressing the issue of dismissal being within the reasonable band: Beardwood Humanities College Governors v Ham UKEAT/0379/13 at [11]-[12] and [16]-[17]; 49.8. there is no legal principle that dismissal has to be a last resort before it can fall within the range of reasonable responses: Quadrant Catering Ltd v Smith UKEAT/0362/10 at [16].[50]The Tribunal has jurisdiction to hear wrongful dismissal claims, that is claims for non-payment of notice pay by virtue of art.3 of the Employment Tribunals Extension of Jurisdiction (England and Wales) Order 1994. The claim is in effect a common law claim for breach of contract that would ordinarily be heard in civil courts for which the 1994 Order allows Tribunals to determine. This means the Tribunal is required to determine on the balance of probabilities whether there has been conduct that amounts to a repudiatory breach.[51]As wrongful dismissal is a common law claim the position has long been that if the employee has committed a prior repudiatory breach that has not been affirmed, that can be relied upon to justify the summary dismissal and any wrongful dismissal claim fails (Boston Deep Sea Fishing & Ice Co Ltd v Ansell (1888) 39 ChD 339 at 352 and 358 (CA).[52]In relation to a repudiatory breach there is no limit to the categories and errors of judgment that can amount to repudiatory breaches as evident from Davidson v AAH Ltd [2010] EWCA Civ 183; [2010] IRLR 709, no wrongful dismissal where the employee, finance director, failed to promptly report possible fraudulent activity of others and him reporting matter to line manager was not sufficient. In modern case law the touchstone for a repudiatory breach is whether there has been undermining of the trust and confidence at the heart of the employment contract, see Davidson at [6]-[7], [33], [37], [40] the relevant threads of law are drawn together and applied to the case. The Tribunal notes the case of Adesokan v Sainsbury's Supermarkets Ltd [2017] EWCA Civ 22, [2017] IRLR 346 relied upon by the Respondent’s representative is also a case where there was no dishonesty, and in fact it was a case of inaction, amounting to dereliction of duty, which effectively set out similar principles at [21]-[26].[53]Although the label ‘gross misconduct’, which is a repudiatory breach, often involves a single act it is possible for multiple acts which individually are insufficient to amount to a breach to in totality render a repudiatory breach: Mbubaegbu v Homerton University Hospital NHS Foundation Trust UKEAT/0218/17/JOJ at [32].[54]Regulation 14 Working Time Regulations 1998 provides for payment in lieu of untaken leave following termination. At reg.14(3) it provides a formula for working out this in the event there is no relevant agreement.[55]Claims for outstanding holiday payments in lieu of untaken leave at termination may be brought before a Tribunal by virtue of an unlawful deduction of wages claim (Revenue and Customs Commissioners v Stringer [2009] UKHL 31; [2009] ICR 985 at [29]-[33]) or directly as a breach of Working Time Regulations 1998 under reg.30.[56]In an unlawful deduction of wages context it is the worker who bears the burden of establishing on the balance of probabilities that there has been a ‘deduction’ (see Timbulas v Construction Workers Guild Ltd EAT/0325/13 at [17], a case where the Claimant was unsuccessful in claiming lack of holiday pay as a deduction of wages as he failed to provide evidence to indicate which days holiday was taken and merely pointing to payslips showing some days were not paid was not enough). E) Closing Submissions[57]As already indicated at paragraph 15 above, both parties provided written submissions. These were fully considered by the Tribunal. In addition, the Respondent’s representative made brief oral submissions which can be summarised as follows: 57.1. Paragraph 23 of the Respondent’s Closing Submission had a typographical error, and it should read “Cs case is that these failings should not be levelled solely at him” (the not being missing); 57.2. There was no challenge to the disciplinary procedure that is found at p.183 onwards and that had been followed; 57.3. In terms of any arguments about an ACAS uplift mooted by virtue of paragraphs 5 or 9, given there was no invite letter found that ordinarily would cover these aspects, the Investigation Report is sufficient to discharge that as it sets out sufficient the collation of evidence as against the Claimant and notification of alleged misconduct. This also indicated by virtue of referring to it as gross misconduct by negligence (p.492) that he could be dismissed; 57.4. The standard range of reasonable responses applies and so one has to judge as to what was said at the time rather than any reformulated case before this Tribunal; 57.5. In relation to the need for Mrs Marks to consider getting further or additional experts other than Mr Rubin, something raised on the final day in cross examination, that was(a) never said at the time,(b) does not advance matters as the Claimant has not actually pointed to a technical issue or inconsistency with the report,(c) in fact the Claimant in the appeal said he had all the information needed at the appeal stage; 57.6. in answer to the Tribunal’s questions that there was conflicting evidence on the reason for Mr Rubin’s report not being disclosed, if it was only Mr Rubin saying he wanted version control that would not be ‘reasonable’ to withhold but the Tribunal should accept that in fact it was confidentiality more generally in the sense of broader disclosure. On that point it was argued that if given to the Claimant it would also be seen by his Trade Union representative and that in an employment relationship there are, notwithstanding duties of confidentiality that apply, all sorts of documents that an employer has a right to withhold. That, the reasonableness of withholding documents has to be viewed in its full context. F) Analysis and conclusions[58]The Tribunal sets out its analysis and conclusion on the claims, having regard to the agreed issues which are set out at in the sub-paragraphs to paragraph 6 above. Reason for dismissal[59]The Tribunal will first deal with the reason for dismissal and whether the Respondent has shown it was conduct (the issue at paragraph 6.1 above).[60]The documentary, witness evidence and live evidence all point in the direction that the reason was ‘misconduct’ as seen by: 60.1. the suspension letter of 19 November 2019 which referred to “serious allegations…regarding your conduct” (paragraph 24 above); 60.2. the allegations in the investigation report, see paragraph 27.1-27.5 above in particular, relate to alleged failure of the Claimant to take action and that ordinarily could be viewed as misconduct; 60.3. the letter dismissing which concluded the Claimant was guilty of “gross negligence” (paragraph 3941 above); 60.4. Mrs Boyden’s live evidence, set out at paragraph 42 above, that it was her belief that the matters found and dismissed were things “under his control” that were “serious enough to dismiss”; 60.5. the conclusion in the appeal process with the letter stating that the “decision to terminate your employment with immediate effect for reasons for gross negligence is justified” (paragraph 46 above).[61]Additionally, there was no real other reason put forward for the dismissal or any other competing reason. The Claimant’s earlier allegations of whistleblowing and discrimination were all dismissed (paragraph 2 above). At times the Claimant appeared to seek to suggest that he was merely a ‘scapegoat’ or that Mr Nemko, or others, wanted him out because he had raised various issues. However, there was nothing to substantiate that or challenge that the decision makers (which were not Mr Nemko) had any of this in their mind at the time.[62]Accordingly, the Tribunal concludes that the honest belief of the Respondent at the time was the Claimant had committed misconduct as he failed to do a critical aspect of his role. The Tribunal wishes to make clear that it had regard to the fact that it could be said that this all amounts to inaction to do a part of his job. Inactions or failure to do one’s job is often thought of as a capability issue. However as set out in Burdis and Philander (paragraph49.1 above) acts termed in this case ‘gross negligence’ can properly be found to fall within s.98(2)(b) definition of ‘conduct’. The Tribunal therefore concludes that the classification of the reason as conduct is appropriate and hence the Respondent met its burden of showing a potentially fair reason to dismiss by virtue of it having an honest belief of conduct at the time of dismissing. The first stage of Burchell test is therefore made out (paragraph49.2 ). Reasonable grounds and investigation[63]The Tribunal next goes on to consider whether there were reasonable grounds and it had undertaken a reasonable investigation together (these being the second and third stage of the Burchell test, paragraph 49.2), which is the issues at paragraph 6.2, 6.2.1 and 6.2.2. This is because the elements naturally interrelate. The Tribunal reminds itself that it is at the stage of dismissing that this is to be judged, which in this particular case is relevant as the Claimant during the process was submitting various documents and it is not simply a case of the matter being contained all in the initial investigation.[64]Furthermore, the focus must be in terms of the grounds and the investigation on what the Claimant was actually dismissed for. That is, as found at paragraphs 40 and 41 above: 64.1. “lack of effective AV software across the estate”; 64.2. “lack of patches and a system to ensure they were updated”; 64.3. “a lack of adequate monitoring” 64.4. “no recent formal hard drive backups”.[65]In relation to these aspects the main method of investigation was to get an expert, Mr Rubin, to produce a report. He was not tasked with pointing out who was responsible but the underlying technical issues. He duly produced a report. Relevant aspects of that report have been extracted at paragraphs 30.1-30.4 above, and as can be seen from the same they were relied upon in the Investigation Report. The investigation also separately involved interviewing witnesses which included Mr Karwal from IT. Furthermore, the disciplinary hearing, as the Claimant accepted in live evidence, canvassed the four matters for which he was dismissed. Finally, looking at the dismissal letter as extracted at paragraph 39, the main grounds were based on the findings of the Mr Rubin report. On the face of it therefore there appears to have both been reasonable grounds and a reasonable investigation.[66]The Tribunal next moves on to consider the Claimant’s criticisms, namely that is that the investigation was not sufficiently detailed in that there should have been more people interviewed and that the interview questions were not detailed enough with those interviewed. The Tribunal concludes however that there is nothing in the detail of the interviews or selection of interviewees that would make the investigation or grounds for concluding misconduct outside the reasonable band. Mr Karwal was present as a witness in the disciplinary hearing and so the Claimant was able to deal with any evidence as necessary in relation to him that needed to be elicited. Ultimately in this case, for the reasons that the Claimant was dismissed it was reasonable for the investigation in the main to consist of the ‘expert report’ of Mr Rubin. The issue is whether there was antivirus, patching, along with the monitoring and backups. Those things could all reasonably be dealt with by an expert looking at the IT servers/equipment itself, as well as logs, to see what was there (or not there). It did not necessitate interviewing factual witnesses. His selection as an expert also appears to be within the reasonable band, the Claimant after all accepted there was nothing technically wrong with the report as such (although he challenged a conclusion about the anti-virus).[67]In terms of the grounds themselves, the Tribunal also considered what appeared to be the Claimant’s arguments that whilst not technically wrong some of his conclusions were misplaced. In part this was because of his Master Audit. Dealing with each in turn: 67.1. “lack of effective AV software across the estate”, there were reasonable grounds for that conclusion. This was not simply based on the Respondent finding that a cyberattack happened and so there must have been ineffective antivirus. After all, Mr Rubin stated as much in his report, see paragraph30.1 above. On the face of it is reasonable to take this expert’s view over the Claimant’s assertion that there was in fact antivirus across the estate (which appeared his position also at the time of the disciplinary, see paragraph 38.1 and 38.5). But things did not stop there, additionally, there was evidence that more licences were bought as there was only “80%ish” covered (see paragraph 23 above), and that featured in the dismissal letter in relation to “The audit on 25/11 showed only 80% of the Estate covered” (p.600). This further is reasonable grounds to support the conclusion that there was not “effective AV software” which is obviously not the same as saying there was no antivirus (which appeared to be the main conclusion the Claimant disputed). So there appears reasonable grounds for this conclusion, having undertaken a reasonable investigation into it; 67.2. “lack of patches and a system to ensure they were updated”, there were reasonable grounds for that conclusion. Once more Mr Rubin had after a technical investigation found servers had not been properly patched and that allowed ‘entry’ for the attackers, see extracts at paragraph30.2 above). Indeed, in effect the Claimant during the disciplinary admitted there was no patch management plan and that was part of the updates/upgrades (paragraph 38.10). Therefore, there appear reasonable grounds for this conclusion to be reached by the Respondent and which was set out in the dismissal letter (p.601, [4]); 67.3. “a lack of adequate monitoring”, was a conclusion that was challenged by the Claimant before this Tribunal. The evidence on this at the disciplinary hearing that appears relevant is set out at paragraph 38.6 and 38.8. Ultimately, Mr Rubin conclusion was different (paragraph30.3 above), in effect adequate monitoring would have picked these things up sooner, and the Respondent was entitled to prefer this. Additionally, however there was the evidence of T-Tech, the company that the Claimant asserted was monitoring, namely the email of 20 November 2019 (see paragraph 26 above) which was relied upon in the dismissal letter that noted “T-Tech was no longer monitoring all of the network equipment following a network configuration project and they failed to be informed of the newly installed network devices, so were unable to monitor them at the time of the attack” (p.600). Accordingly, there were reasonable grounds to reach such a conclusion after having undertaken a reasonable investigation. 67.4. "no recent formal hard drive backups", was a conclusion that the Claimant challenged. His focus before this Tribunal was that in fact such would be a breach of GDPR, that one is not allowed to have hard drive back ups. However, it appears there were reasonable grounds for reaching such a conclusion, having undertaken a reasonable investigation as this was plainly covered by Mr Rubin’s report (paragraph30.4 above) and was shown as a matter of fact by virtue of not all matters being backed up.[68]Therefore, stepping back and looking at all things in the round, there were reasonable grounds, after having conducted a reasonable investigation, in relation to each of the four separately found acts of ‘misconduct’. Looked at another way the investigation and conclusions reached fell within the reasonable band of responses (Hitt, paragraph 49.3 above making clear that all elements of s.98(4) ERA, this being one, needing to meet the ‘range of reasonable responses’ test).[69]The Tribunal wishes to make clear that even if any one or more of the above were successfully challenged it would make any difference given the point made in Tayeh (paragraph 49.6). This is because the Tribunal has accepted that the Respondent treated each of the above four acts of ‘misconduct’ as individually capable of resulting in dismissal (paragraph 42). Procedural issues[70]The Tribunal moves on to consider whether the Respondent acted in a procedurally fair manner, which are the issues at paragraph 6.2 and 6.2.3.[71]The Respondent’s representatives point that there was no challenge by the Claimant as to the disciplinary policy being followed is valid. In any event the Tribunal notes that all the basic elements of procedure were present in this case: 71.1. the Claimant was informed of the allegations and the need to attend a disciplinary meeting at which the problem was discussed, with the Claimant having an opportunity to respond to the case against him (ACAS Code paras 9-12); 71.2. the Claimant was offered the opportunity to be accompanied at the disciplinary hearing, which he exercised (ACAS Code para 13); 71.3. the Claimant was informed of the decision to dismiss and his right to appeal, which he exercised (ACAS Code para 21).[72]Turning to the procedural issues that the Claimant raised: 72.1. the Claimant alleged that he did not have ‘full access’ to his documents. In effect he wanted to have complete access to the systems to find material to defend himself. The Respondent however did provide him with material (the Claimant said that the information was corrupted). More importantly it offered him the opportunity to attend the offices and access the documents, as noted in the appeal (see paragraph 46.1 above). In all the circumstances the Tribunal concludes there was nothing outside the reasonable band procedurally in this regard: it sent over documents and to the extent some could not be received, or the Claimant wanted others, offered him the opportunity to access these both in person and with the assistance remotely of an IT specialist; 72.2. the Claimant was not provided with his own copy of the Mr Rubin report. This aspect concerned the Tribunal significantly. It was plain that the Mr Rubin report was central to the decision to dismiss, and it was a relatively lengthy and detailed document (running to 18 pages). It would certainly have been reasonable to provide the Claimant with his own copy to properly study, note it and so on, in his own time. It is acknowledged how Mrs Koslover agreed with the Claimant that it would have been fairer to have given him a copy and she did not have an issue with it, and equally at the appeal stage Mrs Marks was happy for this to occur (but it was not a point of the appeal). However, the Tribunal reminds itself that it is not the test and fact that another employer may have acted one way does not mean the Respondent’s actions were ‘unfair’, and of course it should not fall into the danger of substituting its own decision (Swift, paragraph 49.4 above). Fundamentally the issue falls to be determined whether the refusal to give the Claimant a copy (to take away) of the Mr Rubin report fell outside the band of reasonable responses in that no reasonable employer could have made such a decision. Ultimately, it concludes that in all the circumstances the Respondent’s decision, to not provide the Claimant with is own copy of the report, fell within the reasonable band of responses for two separate (independent) reasons. The first was as argued by the Respondent’s representative, there is a balancing exercise given the sensitive nature of the report. The Tribunal concludes that the reason the report was not given to the Claimant was not simply because of Mr Rubin wanting to retain version control but because it did not want more potential disclosure of issues as to the IT cyberattack – in effect preferring Mrs Boyden’s explanation to Mrs Koslover’s (see paragraph 32.1-32.2 above). This is because primarily it would have been an HR type decision and not simply about the wants or needs of Mr Rubin, but additionally the explanation of simply wanting version control does not make much sense – after all Mr Rubin would have the document and was in no way engaged to deal with a report in relation to the Claimant as an individual (it was a general report on the cyberattack and issues with security). In this circumstance offering the Claimant opportunities to view the report and the Claimant having done so twice, paragraphs 35-36, is reasonable. Indeed, he appears to have engaged with the main points in it from what was stated at the disciplinary hearing. The second, which as noted is independent and so would still render it reasonable even if the Tribunal was wrong about the first, is that the matter was covered by the Investigation Report. The Tribunal reminds itself that the focus must be on the reason for the Claimant’s dismissal and how the procedure related to that (see Taylor, paragraph 49.5 above). In this case the four reasons the Claimant and the relevance of Mr Rubin’s report (or evidence) was adequately mentioned in the Investigation Report. This is evident from paragraph 30.1-30.4 above, indeed the Investigation Report event directly quoted Mr Rubin’s report. So, by virtue of having a copy of the Investigation Report meant that in this particular case the Claimant actually had adequate ‘take home’ copy of the key provisions of the Mr Rubin report. 72.3. the Claimant alleged that Mr Rubin report was not ‘vetted’ and there should have been experts as part of the decision-making process. Whilst it may be the case that some employer’s would have concluded that an ‘expert’ should have assisted the panel, simply having a neutral report in this case falls within the reasonable band of responses. It is often the case that decision makers may have to deal with technical subjects and there was an independent third party who provided the report. On that issue, given that there was no challenge to Mr Rubin’s standing as a relevant IT expert in this area (Cybersecurity) and there was nothing about the technical side that was challenged there was no s.98 ERA need as such for any vetting. Once again, the Tribunal concludes that there was no procedural error in this regard.[73]Accordingly, the Tribunal concludes that the procedure fell within the band of reasonable responses. Sanction[74]The Tribunal now turns to the issue of sanction, which is paragraphs 6.2 and 6.2.4 above of the issues. The Tribunal reminds itself that it should not substitute (Swift, paragraph 49.4) and further that all that needs to be shown is that dismissal even if with notice fell within the reasonable band looking at the totality of the misconduct found (Fisher and Ham, paragraph 49.7 above).[75]The first argument in relation to sanction that the Claimant appears to raise was that he was having difficulties with work. That is not just the stress and health, which occurred after the cyber-attack it appears so are not relevant, but also Mr Nemko allegedly being obstructive. The Respondent’s own dismissal letter does acknowledge the gap in governance and also did not find all allegations proven (which included the managing of contracts / relationship with contractors). The Tribunal however finds that ultimately the sanction has to consider the misconduct found and the Claimant’s own view that there was adequate antivirus, monitoring and backups. The fact that he was asking for audits or projects were allegedly obstructive does not alter this. This is something which, as the Claimant accepted, would ordinarily fall within his remit (see paragraph 38.12 above). Thus, not allowing a security audit which would have revealed perhaps some of these issues does not detract from that, as is the other projects and disputes. The issue of patch management may be slightly different as the Claimant acknowledge there was none, and it was part of the upgrades. However, one is looking at the totality and even if that is viewed more charitably because of blockages it does not detract from the overall conclusion of there being things “under his control” that were “serious enough to dismiss”.[76]Second there was the argument the Claimant raised of not considering any other lower sanctions and his clean long service. The Respondent in live evidence disputed this, although the dismissal letter does not record it directly. This does not take things much further given the severity of misconduct, negligence, found. In essence the Respondent finding the Claimant had seriously failed, gross negligent, in doing his role in a material extent. The Tribunal as set out above and below concludes that was a conclusion that was within the reasonable band of responses.[77]Third, there was an argument raised by the Claimant that he should have just remained on furlough or off sick. This cannot render the sanction outside the reasonable band as if one can dismiss an employee for prior misconduct the fact they can remain off ‘cheaper’ does not alter this conclusion.[78]Fourth, there was the argument that there was in fact no Cyber liability insurance in place and the Claimant stated he had not seen any such conditions in any event. The Tribunal agrees with the Respondent’s representative in this regard that in effect that was just a proxy for judging the negligence as one would expect IT systems, which the Claimant was responsible for, to meet at least 50% of the basic conditions (this being the Respondent’s own test). It was reasonable for an employer to take such a view that an IT manager should ensure the network is arguably ‘average’ in working order.[79]Stepping back and looking at matters in the round, the sanction of dismissal does fall within the band of reasonable responses. The issues that were found wanting in the IT system, antivirus, patches, monitoring and backups, were individually serious enough failings that fell within an IT manager’s role and would have led some reasonable employers to lose confidence in an IT manager (in this case the Claimant). They could reasonably be classed as issues of gross negligence which ordinarily would result in dismissal (or at the very least it is reasonable to result in dismissal). The fact that another employer may have been more charitable in terms of sanction does not alter this fact. Overall assessment and consideration of Polkey / Contributory fault / ACAS Code[80]Finally, in so far as unfair dismissal is concerned, the Tribunal reminds itself that the statutory wording is “the determination of the question whether the dismissal is fair or unfair (having regard to the reason shown by the employer)—(a) depends on whether in the circumstances (including the size and administrative resources of the employer's undertaking) the employer acted reasonably or unreasonably in treating it as a sufficient reason for dismissing the employee, and(b) shall be determined in accordance with equity and the substantial merits of the case.” Stepping back and looking at all matters in the round, which includes the Respondent’s significant size and resources, the Respondent did act reasonably in treating the four issues, individually and cumulatively, the Respondent had sufficient reason to dismiss the Claimant having regard to the equity and substantial merits of the case.[81]Although not strictly necessary given the claim fails, given the particular concern the Tribunal had in relation to the failure to provide the Mr Rubin report and conflicting evidence in relation to it, the Tribunal sets out alternative findings as to Polkey. The Claimant could not actually, despite having a long time with the Mr Rubin report as part of the disclosure process, point to anything wrong with it. His evidence before the Tribunal did not materially challenge it beyond what he did at the time. Moreover, his suggestion that the “Master Audit” would have led to a different conclusion is incorrect, Mr Rubin report noted things were in the pipeline and they would not alter the finding of things being lacking. In all these circumstances there would be a 100% Polkey reduction, as even with the provision of the report the same result would have been reached. In a similar vein, even if the Tribunal were incorrect or found the dismissal to be unfair the cause of it was largely the Claimant’s own actions, even if there were difficulties with Mr Nemko and IT management. The matters were relatively basic, and he was responsible for these aspects. The result is blameworthy conduct that caused the dismissal meaning a 75% contributory fault reduction would have been made to both basic and compensatory loss had the claim succeeded. Finally, had the claim succeeded the Tribunal would not have awarded any ACAS Code uplift as it did not find any unreasonable failure to follow the ACAS Code.[82]In terms of the wrongful dismissal claim, the Tribunal commences by acknowledging that the test is not the same as unfair dismissal. The issue is whether the Tribunal concludes on the balance of probability that the Claimant has committed a repudiatory breach that justifies the summary dismissal (Answell, paragraph 51 above).[83]Stepping back the Tribunal concludes that the Claimant has committed a repudiatory breach. He was guilty of gross negligence. Whilst there may have been issues with the relationship between him and Mr Nemko, there was such an undermining of trust and confidence in this employment relationship as the Respondent had suffered a Cyberattack which revealed there were critical aspects of the Claimant’s job that were not being adequately fulfilled. It reaches this conclusion for the following reasons: 83.1. the Claimant had represented shortly before the Cyberattack that there were no “obvious holes” and that the switch to E-Set would be better integration (see paragraph 21 above). This was something to the auditors and at this stage he was not highlighting significant issues with the IT system, that is something that would seriously damage trust and confidence underlying the employment relationship when the later events transpired, and the Claimant alleged that he was being ‘blocked’ from his job. This was a key opportunity to set out the issues that he regarded as important even if he was not being afforded budget to remedy them; 83.2. the installation of E-set did take place but plainly was not correct as evident from the events that followed in November 2019 (see paragraph 23 above). The Claimant states this was just new devices but there is no adequate explanation even on that basis why upon new devices the relevant licensing or changes were not being made/updated; 83.3. the Claimant admitted there was no obvious contingency plan (see paragraph 25 above). Even if there were issues in relation to security or audits this should be something one would have thought that the Claimant would have even if in draft form; 83.4. there were the deficiencies identified in the Mr Rubin report (see paragraph 30 and its sub-paragraphs). These were not all the subject of the Master Audit, after all the Claimant considered the antivirus to be adequate ; 83.5. building upon the above point, the Claimant stated that in fact the server that was in issue so to speak should have been “killed” but was not because the password could not be found (see paragraph 38.1). That is something that has nothing to do with being blocked from duties on the face and is a step that should have been taken, or escalated; 83.6. the Claimant’s admission that things had “grown so much hard to keep track” (see paragraph 38.11 above), which on balance the Tribunal concludes indicates the Claimant was not able to fulfil his role, something going to the heart of the contract. It may well be that the Claimant believes the Respondent was understaffed but the contract was for him to be able to deliver the job in the constraints they had; 83.7. the Claimant’s admission that things were not compliant at the disciplinary hearing stage, although it is acknowledged he was crying out for help on his evidence (see paragraph 38.12 above); 83.8. overall, even accepting the Claimant’s position that he was asking for help and being blocked, it was common ground the matters of concern were part of the Claimant’s job role. They were an essential part of it. In fact, in many ways the situation is analogous to Adesokan and Davidson (see paragraph 52 above) in that it appears that the Claimant did not do enough. Complaints of too much academic oversight, cramped conditions, and no visibility of projects are not the point. The issue was there were serious failings that were found, in this case adequate provision of antivirus, adequate patching, monitoring and it would need to be those specific issues that were flagged. The failure to raise those matters (in fact as set out above it appears the indication was there were no issues) would amount the type of inaction that falls within a repudiatory breach.[84]The claim for holiday pay fails. There was a payment in lieu of holiday made in the final payslip of “£3,896.23” as shown on p.706. The Claimant did not suggest that he never received this. There was no challenge as to this calculation or explanation of what he believed he was owed. In the circumstances the Claimant has not met the burden on him in relation to the claim however it is framed, and he simply made a bare allegation. Employment Judge Caiden 26 September 2023