1. This judgment is rendered by the Tribunal in plenary session with the participation of Judges Stephen M. Schwebel (President), Florentino P. Feliciano (Vice-President), Mónica Pinto (Vice-President), Zia Mody, Francis M. Ssekandi, and Ahmed El-Kosheri.
2. The Applications were received on 1 June and 28 July 2010. The Applicant was represented by Thad M. Guyer and Stephani L. Ayers, T.M. Guyer and Ayers & Friends PC. The Bank was represented by David R. Rivero, Chief Counsel (Institutional Administration), Legal Vice Presidency. By an order dated 19 January 2011, the Tribunal decided to consolidate the two cases. Oral proceedings were held in this case on 23 May 2011.
3. The Applicant challenges the Bank’s decision to terminate his employment for committing misconduct, and alleges that his due process rights were violated in the context of the Bank’s investigations into the allegations that he committed misconduct.
4. At all times relevant to the present Applications, the Applicant was a level GF Information Officer with the Bank’s Information Solutions Group (“ISG”). The Applicant’s employment was terminated by the Bank on 23 December 2009, following the outcome of an investigation by the Department of Institutional Integrity (“INT”) into allegations that he committed misconduct.
5. It is not in dispute that, in January 2007, the Applicant leaked extracts from the draft minutes of a meeting of the Bank’s Board of Executive Directors to an investigative journalist, Mr. Richard Behar. In an affidavit to the Tribunal, the journalist stated that he wrote an article on the basis of information gleaned from “several Bank sources” entitled “Wolfowitz vs. the World Bank Board: It’s Trench Warfare,” which was published on FoxNews.com on 31 January 2007. The journalist stated that the “article also references internal bank documents [he] had obtained beyond the raw and sanitized minutes of the Bank Board’s budget and ‘development-effectiveness’ committees.” The report included a link through which readers could download and read the draft and formal minutes in full.
6. On 10 October 2008, the same journalist published another article entitled “World Bank Under Cyber Siege in ‘Unprecedented Crisis’” on FoxNews.com. The article similarly included links to three confidential Bank documents. ISG reviewed the electronic properties of the documents, and noted that the Applicant’s Universal Personal Identifier (“UPI”), i.e. an identification number assigned by the Bank to each of its staff members, was on one of the documents, suggesting that he was the source of the files in the journalist’s possession.
7. INT started investigating the source of the October 2008 leak. On 10 October 2008, INT obtained authorization from a Bank Managing Director and the Bank’s Senior Vice President and General Counsel to undertake a search of the Bank’s electronic systems, to ascertain who, in the period from 10 July to 10 October 2008: (a) sent, or attempted to send, the three Bank documents hyperlinked in the 10 October 2008 FoxNews.com article outside the Bank; (b) sent any related electronic messages to the journalist; and (c) telephoned the journalist. In view of the fact that the Applicant’s UPI number was found on one of the documents, INT also requested and received specific authorization “to examine information on the desktop computer, laptop computer, Lotus Notes accounts, USB devices, telephone records and other information sources used by [the Applicant] as a result of [his] employment within the World Bank Group.”
8. On 23 October 2008, using forensic software, INT found evidence on the Applicant’s Bank-owned computer indicating that he had corresponded with Mr. Behar on numerous occasions in January 2007 from his personal “AOL” e-mail account.
9. On the same day, the Applicant was placed on administrative leave with pay, under Staff Rule 6.06, paragraph 9.09. His administrative leave was extended until 31 August 2009, pending the outcome of INT’s investigation.
10. On 27 October 2008, the Applicant received an e-mail message from an INT investigator informing him that INT had been conducting a preliminary inquiry into allegations of possible misconduct on his part and had determined that further investigation was warranted. The Applicant was invited to an interview to be conducted on 29 October 2008, the purpose of which was “to address the allegations that have been raised against you and afford you an opportunity to respond.” The Applicant was given a copy of Staff Rule 8.01, and was provided with information on INT’s procedures. The next day, the INT investigator sent another e-mail message to the Applicant clarifying that the preliminary inquiry related to the “alleged disclosure of non-public information outside the Bank, which was published on FoxNews.com.”
11. On 29 October 2008, the Applicant was interviewed by two INT investigators. At the start of this interview, he was given the Notice of Alleged Misconduct. The Notice advised the Applicant of the following:
During the course of conducting a preliminary inquiry into this allegation, INT uncovered evidence which indicated that you may have also engaged in misconduct by making unauthorized disclosures outside the Bank Group of confidential and/or non-public Bank documents in connection with the publication of a January 31, 2007 article on FoxNews.com regarding the relationship between the former Bank President … and the Bank’s Board of Directors.
Should additional allegations emerge during the course of this investigation, you will be provided with a supplemental written notice.
In the Notice of Alleged Misconduct, INT identified the standards applicable to the investigation as including Staff Rule 8.01, paragraphs 2.01(a) to (c); Principle 3, paragraphs 3.1 and 3.1(d), of the Principles of Staff Employment; Staff Rule 3.01, paragraph 5.01; and the World Bank Policy on Disclosure of Information, Chapter IV (“Constraints”), para. 83.
12. During the course of this investigation, the Applicant admitted that he disclosed information contained in documents of the Board to the journalist in 2007. In describing the circumstances in which he leaked the documents to the journalist, the Applicant stated:
13. On 12 December 2008, the Applicant provided his written response to the Notice of Alleged Misconduct. In his response, the Applicant admitted that he did leak the information contained in the Board minutes in January 2007, but denied any involvement with respect to the article which was published in October 2008. On 8 May 2009, the Applicant was provided the draft Final Report of Investigation. On 2 June 2009, the Applicant provided his comments on the draft Report.
14. By memorandum dated 10 July 2009, INT issued its Final Report of Investigation to the Vice President of Human Resources (“HRSVP”). In the Final Report, INT stated that the investigation determined that
(b) While there is significant circumstantial evidence to support the allegations that [the Applicant] was also the source for the confidential and non-public documents hyperlinked in the FoxNews.com article dated October 10, 2008, based on the totality of the investigative record, the evidence overall is insufficient to substantiate or refute the allegation.
15. On 23 December 2009, HRSVP notified the Applicant that he had concluded that there was not sufficient evidence that the Applicant engaged in misconduct in connection with the publication of the 10 October 2008 article. HRSVP, however, stated, with regard to allegations that the Applicant made unauthorized disclosures outside the Bank Group of confidential and or non-public Bank documents in connection with the publication of the 31 January 2007 article:
In deciding on the appropriate sanction I considered your comments and your career at the Bank. I find that your characterization of your activities as whistleblowing lacks merit. The evidence does not demonstrate that you would have met the requirements applicable to protection with respect to whistleblowing activities.
Furthermore, I find that you actively and willfully disclosed confidential information to persons outside the Bank with the knowledge that this might affect the reputation of the Bank Group. The information you disclosed included confidential Board documents, which members of the Board should be able to trust to remain confidential in order to operate effectively. This included documents which were not part of information available to you in the course of your normal duties and which you should thus have handled with extra care and caution. And you made an unauthorized disclosure of information while working in a position in which the Bank should be able to rely on you to maintain confidentiality with respect to sensitive and/or confidential information. Thus, your behavior has created an irreparable breach in trust between the Bank Group and yourself.
16. As a consequence, HRSVP decided that (i) the Applicant’s employment with the Bank would be terminated with effect from 9 January 2010; (ii) this decision would be retained in his personnel record for an indefinite duration; (iii) the Applicant would be “restricted” from future employment with the Bank; and (iv) the Applicant’s access to the Bank would be restricted as of 30 December 2009.
17. On 16 February 2010, the Applicant challenged HRSVP’s decision before the Peer Review Services (“PRS”). By letter dated 2 March 2010, the Applicant was informed that his Request for Review could not be accepted because PRS did not have jurisdiction to review his claims. The Applicant was informed that, further to Staff Rule 9.03, paragraph 6.04(d), PRS did not have the authority to review “actions, inactions, or decisions taken in connection with staff member misconduct investigations.”
18. The Applicant filed an Application with the Tribunal on 1 June 2010 in which he challenges the Bank’s decision to terminate his employment. As relief, the Applicant seeks: (i) compensation in the amount of $165,000 for lost wages and $41,300 as moral damages; (ii) reinstatement to his former position; (iii) removal from his record of all references to disciplinary action in respect of this matter; and (iv) costs in the amount of $35,200.
19. On 28 July 2010, the Applicant filed with the Tribunal a second Application in which he challenged the decision of PRS to deny his request for lack of jurisdiction. As relief, the Applicant seeks: (i) moral damages in the amount of $120,000; (ii) “remand [of] the Applicant’s Peer Review application back to the Bank with the requirement that Peer Review Services allow the Applicant a hearing on the facts and merits, at which he may call witnesses and introduce evidence and … that the Peer Review panel selected require the presence of appropriate witnesses he requests, and to require the production of appropriate documentary evidence that he requests”; and (iii) costs in the amount of $15,000.
SUMMARY OF THE CONTENTIONS OF THE PARTIES ON THE PRELIMINARY OBJECTION
20. The Bank raises a jurisdictional objection with regard to the timeliness of the Application filed on 1 June 2010 (i.e. Kim (No. 1)). The Bank argues that the Applicant has failed to file the Application within 120 days of 23 December 2009, the date upon which he received notice of HRSVP’s decision to terminate his employment.
21. The Bank also raises a jurisdictional objection with respect to the Application filed on 28 July 2010 (i.e. Kim (No. 2)). The Bank argues that this Application should be dismissed by the Tribunal for want of subject-matter jurisdiction. It submits that a decision of PRS does not constitute an administrative action by the Bank. The Bank argues that while the Tribunal may, in the past, have reviewed certain jurisdictional findings of the Appeals Committee in accordance with the previous version of Staff Rule 9.03, paragraph 4.03, the new Staff Rule does not provide for review by the Tribunal of this decision of PRS.
22. In response, the Applicant asserts that he had received an extension of time to file the Application in Kim (No. 1). With respect to Kim (No. 2) the Applicant claims that the right to have his case reviewed by PRS is an important procedural right as it allows for the examination of witnesses and documentary evidence, in addition to being judged by peers. He claims that applicants who are now required, under the new Staff Rules, to proceed directly to the Tribunal are “highly unlikely to be able to develop their cases with witnesses or compel documents or to cross-examine managers.”
SUMMARY OF CONTENTIONS OF THE PARTIES ON THE MERITS
23. The Applicant argues that INT failed to respect his due process rights in conducting the investigation. In particular, he states that INT (a) did not give him fair and timely notice of the allegations of misconduct before his interview; and (b) refused to provide proof to the Applicant that it had obtained the required authorizations to conduct the search of his computers and personal e-mail messages. The Applicant also argues that the investigative methods employed by INT were unduly invasive, thereby violating his rights to privacy.
24. The Applicant claims that the decision to terminate his employment was improper and disproportionate. He argues that HRSVP improperly rejected his claims that he was a whistleblower and that he should have been afforded protections under the Staff Rules. Finally, he argues that he was not provided the opportunity to respond to new allegations which were set out in HRSVP’s letter of 23 December 2009, which were not included in the Notice of Alleged Misconduct.
25. The Bank argues that INT’s investigation was procedurally sound and thorough. It states that INT received the required approval from the Managing Director and the Acting Vice President and Group General Counsel to review specific Bank electronic systems to determine the source of the leaked information. It states that OIS used a forensic tool called EnCase to create an exact duplicate image of the Applicant’s computer hard-drive. OIS found cached remnants of e-mail correspondence on the duplicate hard-drive indicating that the Applicant had corresponded with Mr. Behar on numerous occasions in January 2007. The Bank submits that it did not “hack” into the Applicant’s personal e-mail account. In any event, the Bank argues that the Bank’s Information Security Policy for Information Users clearly states that it does not guarantee privacy for anyone using its infrastructure and that the Bank has the right to “screen, monitor or examine the content of computer files, electronic mail messages … or similar stored electronic activities” where there is reasonable basis to do so.
26. Furthermore, the Bank argued that INT complied with Staff Rule 8.01, Annex A, Section C, paragraph 2(e), when it initially limited its communication with the Applicant to providing him the interview date and information about his rights and obligations under Staff Rule 8.01. INT sent a follow-up email message to the Applicant clarifying the subject matter of the investigation. The Bank argues that the Applicant was provided fair opportunity to defend himself and he received two extensions of time to submit his response.
27. Finally the Bank submits that HRSVP’s decision to terminate the Applicant’s employment was fully supported by the findings of the INT report. It contends that the Applicant’s claims that his actions constituted protected whistleblower activity must fail since he did not, at any point during his INT interview, mention that his disclosure to the journalist was intended to report suspected misconduct or to safeguard the Bank’s operations. It argues that the termination of the Applicant’s employment was an appropriate and proportionate disciplinary sanction given the gravity of the misconduct in this case and the need for the institution to trust staff members in the Applicant’s position.
THE TRIBUNAL’S ANALYSIS AND CONCLUSIONS
28. Regarding the Bank’s preliminary objection to the admissibility of the claims set out in Kim (No. 1), it is sufficient to note that the Tribunal granted an extension of time to the Applicant to file this Application, and the Bank was copied on the correspondence. This preliminary objection is therefore rejected.
29. Regarding the Bank’s objection to the admissibility of Kim (No. 2), the Tribunal notes that PRS wrote to the Applicant on 2 March 2010 stating that it did not have jurisdiction to review his claims. Staff Rule 9.03, relating to cases filed on or after 1 July 2009, applies to the present case. Staff Rule 9.03, paragraph 6.04(d), provides that PRS may not review requests concerning
30. The Applicant’s Request for Review pertained to the Bank’s decision to terminate his employment following the outcome of an investigation into allegations that he committed misconduct, and other actions taken in connection with that investigation. The Tribunal finds that the decision of PRS to deny jurisdiction to consider his request was a correct application of Staff Rule 9.03, paragraph 6.04(d). Accordingly, the Bank’s preliminary objection to the admissibility of Kim (No. 2) is upheld and the Application in that case is dismissed.
31. In Koudogbo, Decision No. 246 , para. 18, the Tribunal stated that
32. The Tribunal has also held that its review in such cases “is not limited to determining whether there has been an abuse of discretion but encompasses a fuller examination of the issues and the circumstances.” (Cissé, Decision No. 242 , para. 25, citing Mustafa, Decision No. 207 , para. 17, and Planthara, Decision No. 143 , para. 24.)
33. In Dambita, Decision No. 243 , para. 21, the Tribunal stated:
34. The Tribunal will review this case in accordance with these standards.
Existence of the facts and whether they legally amount to misconduct
35. It is not in dispute that, in January 2007, the Applicant leaked to a journalist extracts of draft minutes of a meeting of the Bank’s Board of Executive Directors. The journalist affirms to the Tribunal that he wrote an article, on the basis of this information as well as information received from several other Bank sources, which was published together with the full text of the leaked Board documents on FoxNews.com on 31 January 2007. The question is whether the Applicant’s conduct legally amounted to misconduct.
36. Staff Rules applicable to leaking of Bank Board documents. Staff Rule 8.01, paragraph 2.01, provides in relevant part:
a) Failure to observe Principles of Staff Employment, Staff Rules, and other duties of employment. Examples of such failure may include failure to observe Bank Group … public information disclosure policies, information security policies … unauthorized use of Bank Group … equipment, computer resources … or abuse or misuse of … Bank Group property.
b) Reckless failure to identify, or failure to observe, generally applicable norms of prudent professional conduct … gross negligence in the performance of assigned duties; performance of assigned duties in an improper or reckless manner; failure to know, and observe, the legal, policy, budgetary, and administrative standards and restrictions imposed by the Bank Group; undertaking an activity where authority to do so has been denied; or willful misrepresentation of facts intended to be relied upon.
c) Acts or omissions in conflict with the general obligations of staff members set forth in Principle 3 of the Principles of Staff Employment and Staff Rules 3.01 through 3.06.
37. Principle 3.1(d) of the Bank’s Principles of Staff Employment provides:
38. Staff Rule 3.01, paragraph 5.01, provides:
39. The Bank’s Policy on Disclosure of Information (2002), while superseded by the Bank’s Policy on Access to Information on 1 July 2010, applies to the present case. Paragraph 83 of the 2002 Policy provides:
40. The Tribunal notes that the Applicant leaked extracts of draft minutes of a meeting of the Board of Executive Directors. This information pertained to proceedings of the Board which, pursuant to paragraph 83 of the 2002 Policy, are confidential and must be treated as such by all staff members. The Tribunal finds that by leaking this information the Applicant violated Staff Rule 3.01, paragraph 5.01, and Principle 3.1 of the Principles of Employment and thereby committed misconduct.
41. Whistleblower protections. The next question is whether there was any legitimate justification for the disclosure of such information. The Applicant contends that he leaked the documents to the journalist as a whistleblower, and as such is entitled to protection. Staff Rule 8.01, paragraph 2.02, in force at the time when the Applicant leaked the information to the journalist, i.e. January 2007, provided:
42. The Bank adopted a more comprehensive whistleblower policy on 10 June 2008. While it was not applicable at the relevant time, INT applied the new whistleblower policy out of “fairness to [the Applicant]” since draft versions of the new policy had been circulated to staff members in 2007. Staff Rule 8.02, paragraph 4.01, of the 2008 whistleblower policy provided:
43. Staff Rule 8.02, paragraph 4.02, of the 2008 whistleblower policy also made provision for external reporting of suspicions of misconduct:
44. The Tribunal notes that the leaked information related to meeting at which the Board of Executive Directors discussed a paper prepared by Bank management on “Shifts and Trade-Offs to Fund Plans and Priorities.” There appears to have been disagreements between the Board and Bank management over the strategy for the organization’s budget. Members of the Board were seeking further information from Bank management to assist the Board’s consideration of the proposed budget before a final decision was to be taken later in the year. In his affirmation, the journalist opined that his
The Applicant himself admitted that the content of the Board’s discussion did not demonstrate misconduct. The Applicant claims, however, that information about the Board’s deliberations was “proof that somebody was lying to the press – someone close to the President of the World Bank … about the Board and about the Bank,” and that he had sought to correct the record provided by these sources. The Tribunal is unable to discern from these documents anything that might have reasonably led one to suspect that any form of misconduct was being committed. The Applicant’s claims that he was a whistleblower therefore fail.
Whether the sanction imposed is provided for in the law of the Bank and the proportionality of that sanction
45. The Applicant claims that the Bank’s decision to terminate his employment was disproportionate to the gravity of his actions. The Applicant submits that his decision to leak information to the journalist was not willful misconduct and that “[s]imply because [he] found himself morally obligated to participate in the broad-based pressure campaign to bring better governance to the Bank in 2007 does not at all suggest that [he] would think the same techniques are necessary or appropriate to solve other problems at the Bank.” He claims that his disclosure did not damage the Bank’s reputation, “but in fact, in many respects enhanced the Bank’s reputation by showing, as the article did, that the Board was very involved in oversight over the [former President’s] administration.”
46. Staff Rule 8.01, paragraph 3.01, provides that
47. Staff Rule 8.01, paragraph 3.03(j), provides for termination of employment as a disciplinary measure which may be taken by the Bank when misconduct is determined to have occurred. Staff Rule 8.01, paragraph 3.03, also provides for a series of lesser sanctions, including oral or written censure, suspension from duty, reassignment and demotion.
48. In Gregorio, Decision No. 14 , para. 47, the Tribunal held that in order for a sanction to be proportionate:
49. The factors considered by HRSVP in determining the appropriate sanction to impose were set out in his letter of 23 December 2009 (see paragraph 15 above). The Applicant was a long-standing member of staff, who had been in the Bank’s employment for 26 years. This was the first finding of misconduct against him. The record before the Tribunal indicates that the information leaked by the Applicant was in wide circulation within the Bank. The Applicant explained in the INT interview that “it was a crazy time” and that “for some reason, in my mind, I can tell you that ethically it didn’t seem like it was a particularly – I mean, people are sending it about by e-mail - you know, to everybody else, right, and I get a copy and I’m not a particularly high-level senior person, right? Then I’m not thinking about confidentiality back in 2007.”
50. The statements of the witnesses for the Applicant and the Bank describe the exceptional circumstances at the Bank at the time in question. The Chair of the Staff Association at the time provided testimony to the Tribunal to the effect that, in late 2006 and 2007, “staff in general were very much afraid of senior management … they felt that senior management did not trust the staff, that senior management felt that staff were, by and large, corrupt, and senior management had made statements to the press to that effect. Staff were afraid that their e-mails were being read, that their offices were being bugged, that their phones were being tapped.” She also testified that there were “numerous leaks” to the press at the time, including from senior management. The Bank conceded that there “was indeed a leadership crisis at that time.”
51. It is clear from the Staff Rules that the deliberations of the Bank’s Board are confidential, and that all staff members have an obligation not to disclose non-public information obtained in the course of Bank Group employment, irrespective of whether they received this information in the normal course of their functions. The fact that other members of staff may have also been involved in sending these documents around the Bank does not relieve the Applicant of his own obligation to keep such information confidential. The Applicant may not have fully appreciated the confidential nature of these documents, but the Staff Rule provides that misconduct does not require malice or guilty purpose. HRSVP must, however, necessarily take into account the intent of the staff member, when he or she committed the act of misconduct, when determining the gravity of the sanction to be imposed.
52. The Tribunal further notes that the Bank has failed to be even-handed in its investigation of the source of the leaks. The Applicant admits that he provided excerpts of text from the draft minutes of the Board meeting, but denies that he was the source of the draft minutes in their entirety. In a declaration to the Tribunal, the journalist stated that he was heavily involved in investigative reporting regarding governance of the World Bank between 2006 to 2008, and “he received extremely sensitive internal bank documents and information from approximately twelve sources, all of whom were current and former employees, contractors, managers and directors of the Bank” and that he “spoke with high and low-level World Bank employees frequently.” With respect to the 31 January 2007 article, for which the Applicant admitted he provided information to the journalist, the journalist stated that the article “references several bank sources.” The representative of INT provided testimony to the Tribunal, however, that no other member of staff had been the subject of an investigation or disciplinary action for such unauthorized disclosure of information. In particular, the Tribunal finds no plausible explanation as to why the staff member identified by the Applicant as having provided him with the excerpts from the Board’s minutes was not even interviewed or requested to respond to this allegation.
53. The Applicant was clearly at fault and admitted as much. Nevertheless his actions must be assessed in the context of the extraordinary circumstances of the time. The Tribunal finds that HRSVP’s decision to impose sanctions upon the Applicant was not unjust, but the decision to terminate his employment was disproportionate in view of the circumstances prevailing in the Bank at the time.
Requirements of due process
54. The Applicant claims that his due process rights were violated in the conduct of the investigation by INT. In particular, he claims that (a) he did not receive fair and timely notice of the allegations against him; (b) INT’s methods of searching his computer were inordinately invasive; (c) INT refused to provide him with proof that it had secured the requisite authorizations to search his computers; (d) restrictions imposed by the Bank on his ability to make paper and electronic copies of the Final Report were overly broad and did not allow him fair opportunity to defend himself; and (e) he was denied the right to respond to new allegations which were set out in HRSVP’s letter of 23 December 2009 as the basis for his decision to terminate the Applicant’s employment.
55. In Kwakwa, Decision No. 300 , para. 29, the Tribunal held:
56. Notice of allegations of misconduct. The Applicant claims that he did not receive fair and timely notice of the allegations against him. The applicable version of the Staff Guide to INT provided at page 17:
57. On 27 October 2008, the Applicant was informed by INT that it had completed a preliminary inquiry into allegations of possible misconduct on his part, and that it determined that further investigation was warranted. The Applicant was requested to attend an interview, to be held two days later, “to address the allegations that have been raised against [him] and afford [him] an opportunity to respond.” On 28 October 2008, the Applicant received another e-mail message from INT clarifying “that INT conducted its preliminary inquiry into alleged disclosure of non-public information outside the Bank, which was published on FoxNews.com.”
58. The Applicant was provided with the Notice of Alleged Misconduct at the start of the interview with INT on 29 October 2008. This notice advised him of the substance of the allegations against him, and the applicable Principles of Staff Employment and provisions of the Staff Rules. INT then proceeded to interview the Applicant and seek his response to the allegations. The Applicant was allowed until 12 December 2008 to provide his written response to the Notice of Alleged Misconduct.
59. The Tribunal finds that INT complied with the Staff Rules in force at the relevant time when it provided the Applicant notice that a misconduct investigation was being conducted, and when it provided the Applicant with the Notice of Alleged Misconduct in the interview. The Tribunal finds that the Applicant was given a fair opportunity, both within the interview and thereafter, to provide his response to the allegations. It was incumbent on HRSVP to consider both the responses provided by the Applicant in the context of the interview and in his written responses thereafter, and the record demonstrates that the Applicant’s responses were considered by HRSVP before he rendered his decision.
60. The Tribunal notes, in this regard, that Staff Rule 8.01, Annex A (Conduct of Disciplinary Hearings), paragraph C(2)(e), which came into force on 24 March 2009, now provides for the investigator to notify the subject staff member in writing with at least twenty-four hours notice that he or she intends to conduct an interview. This written advanced notice should provide: (i) notice of the nature of the alleged misconduct, unless such notice would jeopardize the investigation, such as by leading to tampering with witnesses or evidence; (ii) the list of standards relevant to allegations of misconduct; (iii) an overview of the investigative and decision-making process; and (iv) the staff member’s rights and obligations, including the right to be accompanied by another staff member to the interview. This version of the Staff Rule had not been introduced when INT was carrying out its investigation of the Applicant. Nevertheless, he was advised two days prior to the interview that INT had been conducting a preliminary inquiry. The Applicant was also advised of the standards and procedure of the investigation. The day before the interview, the Applicant was informed of the subject-matter of the investigation. The Applicant was therefore accorded the benefit of the more generous Staff Rule even though that Rule had not come into effect.
61. The search of Applicant’s Bank-owned computer. The Applicant claims that the Bank’s methods of searching his computer were unduly broad. The Applicant argues that the Bank was not authorized to retrieve and rely upon his personal e-mail messages. The Applicant also claims that he had a reasonable expectation of privacy regarding his personal e-mail messages, in particular because some of those messages involved sensitive or confidential communication with the Bank’s Ombudsman and his own attorney.
62. The Bank’s Information Security Policy for Information Users (AMS 6.20A) provides, at paragraph 14:
63. AMS 6.20A provides, at paragraph 9, that “privacy is not guaranteed by the Bank Group for anyone using its infrastructure, specifically the Internet.” Paragraph 11 of the Policy further provides:
64. The Tribunal reviewed comparable clauses in the Bank’s Detailed Information Security Policy (now replaced by AMS 6.20 and its Annexes), and found that these provisions “carefully balance the Bank’s interest in electronic files as employer and property owner with the staff members’ interest in a reasonable measure of privacy.” (D, Decision No. 304 , para. 58.)
65. The Tribunal previously held in Yoon (No. 6 and No. 7), Decision No. 390 , at paras. 110-115:
66. On 10 October 2008, the INT Vice President obtained authorization from the Bank Managing Director, and the Acting Vice President and Group General Counsel to “conduct three queries in an effort to identify any Bank staff member who, in the period from July 10, 2008 … until today, October 10, 2008” contacted the journalist or transmitted outside the Bank those documents that became the object of another article published on FoxNews.com on 10 October 2008. INT also possessed information that the Applicant, identified by his UPI number, on 9 October 2008 created the PDF version of a document linked to the FoxNews.com article published on 10 October 2008. INT accordingly requested, and received, specific authorization “to examine information on the desktop computer, laptop computer, Lotus Notes accounts, USB devices, telephone records and other information sources used by [the Applicant] as a result of [his] employment within the World Bank Group.”
67. The Applicant argues that INT exceeded its competence, as this authorization did not permit INT to search his personal e-mail messages. In this connection, the Applicant argues that the Bank must have “broken AOL’s encryption and gained access to Applicant’s passwords.” The Applicant claims that he used “AOL’s client-server software” and a “simple examination of similar back-up files in the AOL directory of Applicant’s personal machines would have revealed that the data is encoded to prevent a casual read of personal e-mails. Though this encryption is probably easily broken by an experienced investigator, e-mails within the AOL client software’s subdirectory still must be ‘broken into’ to harvest any useful information.” As evidence, the Applicant submits a report from Mr. Babak Pasdar, who describes himself as a “Certified Ethical Hacker.” Mr. Pasdar states
68. The Bank denies that it searched the Applicant’s private e-mail account. It states that it analyzed information and data contained in the Applicant’s Bank-owned computer hard-drive, where it found copies of e-mail messages sent from the Applicant’s private e-mail account to the journalist. As evidence, the Bank submits a statement from the Information Security Officer in OIS, who conducted the review of the Applicant’s computer. He stated:
69. Before the Tribunal, the representative of INT stated that the searches undertaken by the EnCase software was guided by “keyword and phrase searches” and were not limited to the specific time period in question. The INT representative stated that the managers who authorized the search were not aware that date limits would not be adhered to due to the manner in which the software was employed. He explained: “that’s the nature of how these searches are done, whether or not we are using a standalone computer setting and full text search capability and running through a series of queries and running various permutations or we happen to use a software tool through OIS’s EnCase.” He stated “that is a methodology … to search for the information that, in our justification, we felt was relevant for our review. We were not targeting 2007 because that was not the subject of our review. It came into our possession and, as a consequence, we had an obligation to address it.”
70. In this case, the Tribunal finds that INT secured the necessary authorization to conduct a search of the Applicant’s computer files and electronic messages as it bore a reasonable suspicion that the Applicant engaged in misconduct. On the basis of the record before it, the Tribunal concludes that there is insufficient evidence to support the Applicant’s contentions that the Bank “bypassed password protection” or “hacked” into his personal e-mail account. The Tribunal finds, however, that the Bank’s search methods of the Applicant’s Bank-owned computer were unduly expansive and did not respect the careful balance identified in D. The Tribunal stresses the need for the Bank to undertake targeted searches so that it carefully balances its interest in electronic files as an employer and property owner with the staff members’ interests in a reasonable measure of privacy. This is particularly important given the increasing use of technologies by which staff members use Bank-issued telecommunication devices for professional and personal business.
71. The Bank’s failure to provide the Applicant with proof of the authorization to search his computer. The Applicant also claims that he was not provided a copy of the authorization secured by INT to search his computer records until proceedings commenced before the Tribunal and that he “had no opportunity to challenge them, thus constituting an impendent denial of due process.”
72. The Tribunal finds that the Bank should have provided the Applicant with proof that it had secured the requisite authorization to undertake the search of his Bank-owned computer when initially requested. While the Tribunal is satisfied that, in the context of these proceedings, the Applicant has had the opportunity to question the basis of INT’s authority to search his computer, there is no justifiable reason for the Bank to require staff members to pursue their grievance as far as the Tribunal in order to be provided with a copy of the authorization.
73. Restrictions on ability to copy the INT Final Report. The Applicant claims that the terms of the Non-Disclosure Agreement insisted upon by the Bank with respect to the INT Final Report were oppressive. He claims that by limiting his ability to make an electronic working copy, he was “denied all modern legal preparation tools to work with such a large report, including text and word searches, bookmarking and hyperlinking, and copy and pasting.” Only upon commencement of proceedings before the Tribunal was the Applicant permitted to retain a copy of the report, and to make an electronic copy. He claims that prior to this time he had not been given a fair chance to defend himself.
74. In response, the Bank argues that it provided the Applicant with the draft Final Report on 9 May 2009, and INT reviewed and incorporated his written comments thereon in the Final Report, which was provided to the Applicant in July 2009. The Bank argues that the Applicant has failed to articulate how the Non-Disclosure Agreement restricted his right to seek guidance or counsel during the disciplinary process or in the present case. The Bank further states that it provided a redacted copy of the Final Report to the Applicant’s forensic expert, Mr. Babak Pasdar, on the condition that a Non-Disclosure Agreement was similarly concluded.
75. In AJ, Decision No. 389 , para. 136, the Tribunal stated that “the important question is whether the Applicant was given an adequate opportunity to defend himself.” In this case, the Applicant and his counsel were provided with the full Report. The Applicant therefore had in his possession all documentation relied upon in the investigation and a copy of the Report. While restrictions on the reproduction or electronic copying of the document may have proven inconvenient for the Applicant, such inconvenience does not amount to a denial of the opportunity to defend himself effectively.
76. Denial of an opportunity to respond to new allegations in HRSVP’s letter. The Applicant claims that HRSVP appended, in his letter of 23 December 2009, additional justifications for his decision to terminate the Applicant’s employment, which were not included in the Notice of Alleged Misconduct. In particular, the Applicant contends that he was not provided the opportunity to respond to the following findings which were set out in HRSVP’s letter: (a) that he made “unauthorized use of Bank Group computer resources”; (b) that he “willfully disclosed confidential information to persons outside the Bank with the knowledge that this might affect the reputation of the Bank Group”; (c) that he should have handled information which was not available to him in the course of his normal duties “with extra care and caution”; (d) that he had a special trust that was attendant on his particular job position “in which the Bank should be able to rely on [him] to maintain confidentiality”; and (e) that he caused an “irreparable breach of trust.” The Applicant claims that none of these findings were set out in the Notice of Alleged Misconduct, and he was thus not allowed a meaningful opportunity to respond to them in the INT interview and in his written response.
77. The Tribunal has previously held that staff members should be provided with a reasonable opportunity to respond to the allegations against them. (See, Kwakwa, Decision No. 300 , para. 29, and King, Decision No. 131 , paras. 35-37.)
78. With respect to (a) above, the Tribunal notes that the Notice of Alleged Misconduct, as set out in paragraph 11 above, identified Staff Rule 8.01, paragraph 2.01(a), as one of the applicable standards in its investigation. That Staff Rule provides that misconduct includes the “failure to observe Principles of Staff Employment, Staff Rules, and other duties of employment.” The Rule goes on to state that “[e]xamples of such failure may include … unauthorized use of Bank Group … equipment, computer resources.” In his decision of 23 December 2009, HRSVP stated:
79. The Tribunal finds that HRSVP was merely reciting the applicable standards, of which the Applicant had been notified in the Notice of Alleged Misconduct.
80. More importantly, the Tribunal observes that the actual allegation in this case was that the Applicant had contravened the Staff Rules and Principles of Staff Employment by improperly disclosing confidential information. It was established, and the Applicant does not deny, that he did so by using a Bank-owned computer. A fortiori such use of the Bank-owned computer was unauthorized. There is nothing to suggest that the Applicant would have provided further rebuttal to the allegations against him, if he had been notified separately that the allegations against him included a separate and distinct offense of “unauthorized use of Bank Group computer resources,” which were confirmed by his own admission.
81. With respect to (b) to (e) above, the Tribunal recalls that Staff Rule 8.01, paragraph 3.01, provides for HRSVP to take into account a number of factors in order to determine the appropriate disciplinary measure to impose. The Tribunal finds that these findings described by HRSVP were not separate allegations but were related to the factors taken into account in his determination of the appropriate sanction (i.e. the seriousness of the matter, any extenuating circumstances, the situation of the staff member, the interest of the Bank Group and the frequency of conduct.) The Applicant was given the opportunity to provide his comments on the underlying merits of such factors before HRSVP made his decision.
82. By leaking confidential information to the journalist, the Applicant committed a serious breach of the Staff Rules, for which he must be held accountable. Nevertheless, the Tribunal is mindful of the circumstances in which the Applicant committed these acts – a period of turmoil consistently characterized by witnesses and counsel appearing before the Tribunal as an exceptional time in the Bank’s history. Confidential information was being leaked at all levels at the Bank, yet, as far as the Tribunal has been informed, investigations were not undertaken, during that time, into other such leaks of confidential information. In this particular case, INT contented itself with pursuing the Applicant, and did not undertake an investigation into the initial source of the leaked information.
83. In the circumstances, the Tribunal considers that termination of employment, which is the most severe sanction available to HRSVP, is disproportionate. The Tribunal therefore decides that, with effect from the date of this judgment, the Applicant shall be reinstated as a staff member of the Bank. HRSVP may decide to impose a sanction contemplated by Staff Rule 8.01, paragraph 3.03 (other than termination of employment) - for example, reassignment to a position where the Applicant would not be entrusted with confidential or sensitive information, assignment to a lower level position, or demotion without assignment to a lower level position.
(i) with effect from the date of this judgment, the Applicant shall be reinstated as a staff member of the Bank;
(ii) the Bank may impose a disciplinary measure (other than termination of employment) from the list set out in Staff Rule 8.01, paragraph 3.03;
(iii) the Bank shall contribute to the Applicant’s costs in the amount of $36,200; and
(iv) all other claims are dismissed.
/S/ Stephen M. Schwebel
Stephen M. Schwebel
/S/ Olufemi Elias
At Washington, DC, 25 May 2011