Web surfing at work can get you fired                   

Mark Gravelle worked for the government of Canada as an assistant in the Human Resources Department of the Department of Justice. In January 2010, he accepted a one-year temporary assignment to the staffing fast-track unit. That unit handled simple, non-complex staffing files. As time progressed, his supervisor had not been completely satisfied with Gravelle’s performance or his attention to the job during his hours of work while he worked in the fast-track unit. He had spent a great deal of time web surfing in his search for information with respect to cars. He was subsequently fired. He appealed his firing to the Public Service Labour Relations Board.

Shortly after he began supervising Gravelle, Mr. Ouellette (one of his supervisors) testified that he began to receive messages from clients stating that there were errors in Gravelle’s work. He made more errors than his colleagues did. In addition, Mr. Ouellette testified that Gravelle was late with his work. Gravelle’s work had to be completed within five days but often it wasn’t. He had to take away some of Gravelle’s work and give it to another employee. Mr. Ouellette noticed that Gravelle tended to start his work on the day that it was due. Mr. Ouellette kept Ms. Stethem (Ouelette’s supervisor) aware of the concerns that he had with Gravelle.  

Gravelle’s response to those allegations was that that Mr. Ouellette and Ms. Stethem constantly changed the procedures. It became very confusing for him as he tried to understand the expectations. He also testified that sometimes, he did not have the tools (equipment) to do his work. 

                                                 

His employer provided Gravelle with a detailed letter of expectations in December 2010. In addition, Mr. Ouellette, Ms. Stethem or both of them met often with Gravelle between April and December 2010 to discuss the issues that the employer had with him. At one meeting, on December 8, 2010, they required that Gravelle complete several late files by the end of the day, Friday, December 10, 2010. He did not complete them, and he left work for the weekend without notifying them of the status of his work. On January 10, 2011, Ms. Schubert reprimanded him in writing for that. The same day, she also served him another written reprimand for allegedly having made offensive comments against members of management before the December 8, 2010, meeting and for allegedly spreading false information after that meeting.

         

On November 24, 2010, Gravelle asked that his assignment in the fast-track unit be terminated. On December 1, 2010, Ms. Schubert refused Gravelle’s request for operational reasons. Gravelle testified that those operational reasons were never explained to him.

 In January 2011, Mr. Ouellette and Gravelle switched offices and phone numbers. One day, Mr. Ouellette received a phone call for Gravelle. He gave Gravelle’s new phone number to the caller. Very shortly after that, Gravelle’s phone rang, and he answered. The discussion was related to car repairs. Mr. Ouellette talked to Ms. Stethem about it. He had a feeling that Gravelle was involved in some form of car business. On some occasions, he went to Gravelle’s workstation, where he saw Gravelle consulting “Used Ottawa” or “Kijiji” ads.

However, neither Mr. Ouellette nor Ms. Stethem raised that issue with Gravelle. Gravelle testified that the only remark made to him in that respect came from Ms. Schubert, who told him at the end of a meeting in late January 2011 not to use his Internet access or email account for personal business and to be careful about phone calls about cars. He also testified that he remembered that the phone call to which Mr. Ouellette referred was with his father, who had called to discuss some car repairs.

Ms. Stethem who was appointed to her position in July 2010, said that she  noticed on several occasions that Gravelle was absent. She was not always satisfied with his explanations to justify his absences. In September 2010, she gave him detailed written instructions on what she expected from him with respect to hours of work and absences. However, she took no precise measures with respect to Gravelle’s use of the Internet or to his possible car business. In other words, she didn’t specifically say that he was not to use the Internet for personal use while at work.

Ms. Schubert testified that she made the decision to request that the Information Technology (IT) Security section inquire into Gravelle’s use of the IT network. She had concerns with his productivity and performance, and she was preoccupied by the phone call that Mr. Ouellette received about car parts or repairs. She thought that Gravelle might have been using the employer’s network for personal matters, particularly to conduct an outside business. Some supervisors had reported to her that Gravelle spent a lot of time on the Internet every day. The departmental security officer granted Ms. Schubert’s request.

On January 19, 2011, Mr. Roussel was given the mandate to conduct an IT investigation about Gravelle. In his final report dated February 14, 2011, Mr. Roussel describe the “incident” that he had to inquire into as follows:

“Department of Justice Canada employee Marc Gravelle had been reported by his management for strong suspicion of conducting personal business with the aim of personal financial gain using the computer and network asset privileges entrusted to him for his employment.”

                                           

On January 25, 2011, Mr. Roussel made a copy of Gravelle’s entire email account. On January 28, 2011, he recovered the September 2010 and the October 2010 backups of Mr. Gravelle’s email. At 14:30 that same day, Mr. Roussel took possession of Gravelle’s work computer and replaced it with a different one.

Mr. Roussel analyzed all the information that he gathered on Gravelle. He started that analysis on January 25, 2011, and completed it on February 6, 2011. He presented a draft report of his analysis to Ms. Schubert and Mr. Provencher on February 7, 2011. His final report was produced a week later, on February 14, 2011.

In his final report, Mr. Roussel wrote that Gravelle’s Internet usage was abnormally high in comparison to other employees. From September 1, 2010, to January 26, 2011, Gravelle’s user account “ had generated a total sum in excess of 445,208 hits over the production network internet gateway.” Of those hits, 315 864 occurred during Gravelle’s expected working hours, and the rest occurred outside his working hours.

Those hours at work would certainly take up a lot of his time that should have been spent on work-related activities. This would explain why he was so far behind in his work.

According to Mr. Roussel’s report, the greater part of that Internet activity consisted of using Google to find and visit websites in the “Shopping,” “Automobile” or “Vehicles” categories. The highest traffic was with Google, Kijiji and Used Ottawa classified ads. According to Mr. Roussel’s analysis, the main search criteria were searching for used vehicles, yard equipment, engines, engine parts and accessories, tools, and anything of interest that was related to mechanics.

Gravelle adduced in evidence a technical paper entitled, “Managing Internet Usage with Reliable Metrics.” According to that document, there are no universally accepted definitions of the terms “hit” and “visit.” A hit is any browser-related action or data display associated with a website visit activity. It is not necessarily a visit to a website. The document provides an example of a visit to a non-complex web page, which generates 1 hit, and to a more complex page, which generates 23 hits. Mr. Roussel agreed with the document’s interpretation of a “hit.” He testified that even though Gravelle averaged more daily hits than IT employees, who are very big Internet users, he could not say how much time Gravelle spent on the Internet every day. He could say only that the odds are that a person with more hits spends more time on the Internet. Mr. Roussel also testified that if an employee leaves work without logging out and without closing a website, it is possible that hits could continue to come in from the websites that are still open. I doubt that he didn’t close the websites since he wouldn’t want someone walking by his work station and seeing the Internet sites on his computer screen.

Mr. Roussel reviewed Gravelle’s email dating back to summer 2009. He found that Gravelle used his office email to contact sellers or buyers on Kijiji, Used Ottawa and eBay. Mr. Roussel also found three Kijiji postings in Gravelle’s deleted emails. The ads were easily found on Kijiji.

                     

Gravelle used the Department of Justice postal code (K1A 0H8) for the ads, some of which were adduced in evidence. In an email, he invited a seller to meet him at the building where he worked. He also communicated on a regular basis with another employee about buying or selling cars and equipment and making a profit. Between August 2009 and January 2011, that employee and Gravelle exchanged 2633 emails, more than 300 of them on January 19, 20 and 21, 2011. Of those 2633 emails, 394 had the word “Kijiji” in the message body and 391 had the words “Used Ottawa.”

Ms. Schubert testified that she did not know how much time Gravelle spent completing personal business while at work. However, she knew that Gravelle’s productivity was very low when compared to other employees.

Gravelle testified that it was a well-known fact in his division that he had a lot of knowledge about cars, other motor vehicles and mechanical equipment. The employer’s witnesses did not contradict that evidence. Evidence was also adduced that Gravelle’s previous director even consulted him on a boat that her husband had for sale.

Gravelle also testified that his supervisor, his manager and some directors discussed car issues at times with him at work. He testified that he had a strong interest in cars and other motor vehicles. In fact, he has been working full-time at a car dealership since March 21, 2011. He started as a “Level 1 apprentice,” and he is now a licensed mechanic and auto technician.

He also admitted that he often went on the Internet to verify car ads and often exchanged emails with a work colleague about cars or vehicles. He testified that he was not on the Internet for long periods at a time. It was in his words only “one minute here, one minute there.” He denied having run a car business with that colleague while at work. He testified that that was a hobby to escape from work and a form of distraction and excitement when he was at work. He admitted that he had a few items for sale on Kijiji but not that he made a business out of it.

When verifying Gravelle’s email account, Mr. Roussel saw that the “Personal Storage Table” (PST) file size shrunk from 829 MB to 127 MB between October and November 2010. It diminished substantially a second time from 94 MB on January 28, 2011 to 28 MB on February 5, 2011. In computing, a PST file is an open proprietary file format used to store copies of messages, calendar events, and other items within Microsoft Outlook. The employer adduced in evidence a letter signed by Ms. Schubert, dated January 28, 2011, and sent to Gravelle, advising him that it was strictly forbidden for him or another party to change or destroy any files associated with his email account.

   

Mr. Roussel testified that in his investigation he found that Gravelle did not delete or alter those emails but rather archived them. Gravelle testified that he was under the impression that the January 28 directive from Ms. Schubert was only that he could not delete any emails. He also testified that he had the habit of archiving his emails monthly. He thought that that would explain those reductions in the size of his email account when its size was compared over different months.

Mr. Roussel wrote in his report that he was certain that based on the evidence that he reviewed, Gravelle used the employer’s network and Internet access “for personal purposes with the aim of personal financial gain and that there were several other breaches of the ‘Policy on Acceptable Use of the Electronic Network.’” He concluded that Gravelle “was conducting trade and/or business activities using his Departmental of Justice Canada email.”

During his investigation into Gravelle, Mr. Roussel also found that Gravelle “was collecting and storing MP3 files” on the employer’s common drive in a folder in his name and under his control. That folder took 10.36 GB (11,253,634,962 bytes) of storage space on the employer’s network and contained 2,236 music files. Mr. Roussel wrote in his report that those files could have contravened copyright legislation. Gravelle testified that a former employee from the pay and benefit section had created the original folder. He testified that he was told that that employee had received permission to create that folder. He admitted to placing some music files in the folder but stated that many other employees had done the same thing. He also explained that the folder was part of a larger folder under his former supervisor’s name. Some evidence was adduced at the hearing that two senior labour relations advisors had asked Gravelle for access to that music. It would seem that senior staff were complacent in this man’s wrongdoings.

All the documents attached to the November and December emails were adduced in evidence at the hearing. Ms. Schubert testified that the titles of some of them refer to some competitions to which Gravelle had applied. He should not have accessed those files and sent them to his personal email. Furthermore, for Ms. Schubert, the email that he sent himself on November 19, 2009, at 13:50, was to illegally access a document that he could not otherwise access. According to Ms. Schubert, that would have given him an unfair advantage in the competitive process. Mr. Provencher testified that he consulted those documents, which contained copies of the exams, the expected answers and a list of all candidates. Ms. Schubert also testified that Gravelle did not write the exam for the AS-03 competition, which was held on December 17, 2009.

Ms. Stethem testified that Gravelle applied to that competition and that he was screened out because he did not meet two of the basic criteria for the position. She also testified that she met with Gravelle during the week before December 21, 2009, to explain to him why he was screened out.

   

Gravelle adduced in evidence an employer document showing that he was screened out of the AS-03 competition process on December 9, 2009. He also testified that he was not given access to his email after his departure. He could not verify if the documents that the employer accused him of transferring to his home email, including those of November 19 (13:37) and December 17, 2009 (06:52), were the emails that it said were transferred. On that point, Gravelle did not remember sending those documents to his home email. He testified that he might have sent blank or template forms to his home email but not the ones that he was accused of having sent. He testified that he never saw those documents in a completed format.

After Gravelle testified, Mr. Roussel was called back as a witness to clarify whether he had proof that Gravelle had sent to his home address the documents that the employer claimed he had sent. Mr. Roussel testified that after using “EnCase” software, he became convinced that the documents that Gravelle was accused of sending to his home email were in fact sent, not blanks or template forms, as Gravelle claimed he sent. Law enforcement agencies use EnCase for forensic examination.

At the hearing, Mr. Roussel demonstrated using EnCase and the information from backup tapes that the confidential documents that Gravelle was accused of sending to his home email address were sent from his office email account on November 19 and December 17, 2009, respectively. Mr. Roussel carried out the EnCase analysis in early 2014 in preparation for the March 3, 2014, hearing. He testified that all those emails, with attachments, were provided to Gravelle on a CD-ROM after he was suspended indefinitely. Mr. Roussel testified that Gravelle could have found that information on the CD-ROM by using Microsoft Outlook to read the “pst” file and by using Word or Microsoft Excel to read the attachments.

One of the December 17, 2009, files included protected personal information on 108 candidates in a staffing process. That file, like the others mentioned in the last paragraph, were sent to an external (“Yahoo”) unsecured server. Ms. Schubert testified that she had to notify each of the 108 candidates of that security breach. She also reported the incident to the Office of the Privacy Commissioner of Canada. She testified that the incident created an embarrassment to the employer.

                                          

Mr. Roussel also investigated several other issues when he analyzed Gravelle’s emails. Among them, he found that one of Gravelle’s former colleagues contacted him in February, March and April 2010, because that colleague had applied for a job at the Department of Justice and wanted to be screened in via the selection process. He also asked Gravelle for a contact number for feedback on his application.

On April 14, 2010, Gravelle answered his former colleague and gave him the name and the phone number of the female HR advisor responsible for that process. His former colleague asked him how nice she was. Gravelle answered that she was “Very Nice, not too bright though.”

Mr. Roussel also found many emails in which Gravelle used inappropriate terms or profanity, wrote that he disliked his job, and expressed himself on his personal finances.

Gravelle admitted to using improper expressions in some of his communications.

The adjudicator at the hearing reviewed those many emails, and most of them include vulgarities and unacceptable language.

The employer adduced in evidence its policy on the use of its electronic network and the Treasury Board policy on the same topic. According to the employer’s policy, while it is recognized that employees may use its network for limited personal use, they must act reasonably and fairly and incur negligible expense in their use of the system, keeping in mind that it is a corporate resource. In its Appendix “B,” the employer’s policy provides examples of unacceptable activities that can take place on the electronic network, such as sending classified information on unsecured networks, sending abusive or sexist messages, and using the network for private business or personal gain.

In his testimony at the hearing, Mr. Provencher explained his detailed briefing note to Mr. Kirvan. He summarized the evidence presented at the hearing. He wrote that Gravelle unduly overloaded the employer’s network by using it abusively and inappropriately, that he disclosed personal information that he was not authorized to disclose, that he had considerable difficulties following the rules imposed upon him, that he had been disciplined before, and that he violated the employer’s electronic networks policy and its “Code of Ethics and Values” by his action.

The employer also adduced in evidence the banner that appears on the computer screen when an employee accesses its network. By accessing the network, an employee agrees to the principles and conditions of the employer’s policy on the use of its electronic network. Gravelle testified that he never paid attention to that message and that he never read it or the policy.

That reminds me of a similar remark made by Mayor Rob Ford of Toronto about his time as a city counselor. He and all other counselors were given a booklet that explained what they could do and what they couldn't do. He claimed he never read the booklet. Not apprising oneself as to what you can do and not do is not an acceptable excuse.

Ms. Schubert received a draft version of Mr. Roussel’s report on February 7, 2011. After reviewing it, she suspended Gravelle without pay, effective February 8, 2011, pending further investigation.

In the suspension letter, Ms. Schubert wrote that Mr. Roussel’s report was sufficient to raise important concerns about inappropriate and excessive use of the employer’s electronic network. In addition, Ms. Schubert testified that Gravelle had altered hundreds of emails and files in his email account after being formally advised on January 28, 2011, not to delete anything from it. She testified that she could not trust him anymore and could not let him continue to use the employer’s electronic network. In addition, no significant work could be assigned to him that did not involve a computer and access to the employer’s network.

In early February 2011, Gravelle asked for parental leave starting on March 1, 2011. Mr. Provencher testified that Gravelle had previously asked that his parental leave begin on April 1, 2011. The employer’s reaction to his request was to state that he wanted to avoid participating in the investigation process by going on leave for 37 weeks. The employer did not accept or refuse Gravelle’s request since she never replied to it. Gravelle’s new child was born on February 23, 2011. On January 28, 2011, he had asked for one week off for the upcoming birth of his child. Ms. Stethem had denied his request.

On February 18, 2011, Ms. Schubert sent a copy of Mr. Roussel’s final report to Gravelle. She informed him that a meeting would take place on February 24, 2011, to obtain his comments on the allegations against him about the inappropriate and excessive use of the employer’s electronic network. Ms. Schubert testified that Gravelle did not show up for the meeting. The employer decided to postpone the meeting to February 28, 2011. Gravelle advised that he would not be able to attend, and he mandated his bargaining agent representative to attend on his behalf. He testified that he could not make it because freezing rain fell that day, and he would not drive in it for 45 minutes. Ms. Schubert testified that she never had the opportunity to discuss Mr. Roussel’s report with Gravelle, who testified that he was never offered a real opportunity to reply to Mr. Roussel’s investigation and report.

On the basis of Mr. Roussel’s report and of her other facts, Ms. Schubert, in consultation with Mr. Provencher, recommended that Gravelle’s employment be terminated for misconduct. Mr. Provencher wrote a detailed briefing note to Myles Kirvan, the deputy minister, on May 2, 2011, recommending that Gravelle be terminated. Mr. Kirvan officially terminated Gravelle’s employment on July 6, 2011. Even though the termination letter was dated July 6, 2011, Mr. Kirvan wrote that his decision to terminate Gravelle’s employment was effective retroactively to the close of business on February 8, 2011 the day that Gravelle was actually fired.

The adjudicator said in his decision, “By his actions, Gravelle broke the bond of trust. He lacks rehabilitation potential. He did not admit to most of his wrongdoing. He clearly lacks forthrightness.”

He also said, “I dismiss the termination grievance, the indefinite suspension grievance and the grievance related to the revocation of the reliability status but allow the one-day suspension grievance.

There is a lesson to be learned from this article. It is as follows:

Be very careful how you use your employer’s computer. Your employer has the right to search through the computer you are using at work for anything you have put in it that is both involving your work and material not related to your work since it is the company’s computer and not yours. As you can see, savvy computer technicians have the ability to search your computer’s disk thoroughly.

Gravelle foolishly abused his position with his employer and although he is currently working as a licenced auto mechanic, he won’t get the generous pension benefits that federal employees receive for their years of employment with the government.