A Department of Defence employee who was sacked for storing images from an internal network on his personal devices was unfairly dismissed, the Fair Work Commission has ruled.
In a decision published last week, the commission sided with Philip Gao, a project manager who was found to be in possession of 39 images of the Defence Restricted Network (DRN), which acts as a kind of secure intranet.
The images were of “DRN screen[s]”, “computer screen[s]”, “printed document[s]” and “an ADF member's PMKeyS ID”, the decision states.
Defence alleged the photos, taken between May 2017 and September 2020, included “sensitive” and “protected” material, as well as the “personal information of defence employees”.
Gao, however, disputed this, arguing “nearly all [of the images] were not sensitive were not photographed from the DRN and could not reasonably [have] resulted in [compromise]”.
Defence argued Gao breached the APS Code, namely the Defence Security Principles Framework (DSPF) and Defence ICT manual, in having the images stored on a personal device.
It suspended him for a year before ultimately terminating his employment.
Gao filed for unfair dismissal, and the claim was upheld by the Fair Work Commission.
In its decision, the commission found Gao had “valid reasons for having the 39 images” and that the breach was towards the “lower end of the spectrum”.
It said that 13 of the 39 images found to be of the DRN were taken when Gao was an army reservist and not an APS employee, meaning no breach of APS rules had occurred.
Some of the remaining 26 images originated in the DRN, including two images marked “sensitive” and “protected” and five images that Gao admitted were taken directly from DRN.
But the commission found a number of the 39 images were “separate pages of single documents”.
“Many [of the images] were addressed to him and were personal records, and that there is no suggestion that any information was compromised or disclosed,” the decision reads.
DRN unreliable, slow and frequently crashed
The commission accepted evidence from Gao and another witness that the “DRN was frequently unreliable, slow and frequently crashed”.
“Whilst not an approved procedure, it was common practice... to copy information from the DRN to personal devices and [Defence] was aware this was happening,” the decision states.
While Gao’s direct supervisor was unaware of the practice, there was no specific direction “not to use personal laptops”.
While employees were required to agree to abide by the terms of the DSPF and ICT manual every time they signed onto the DRN, the commission doubted the usefulness of the measure, believing it "highly unlikely that any employee has actually read all these policies".
Defence was unable to cite any part of its security training that “explicitly provides that taking a photograph of the DRN is not permitted”.
The commission ordered Defence to “reinstate [Gao] to either his previous role, or at its election, to another equivalent and appropriate EL2 role in Defence”.
It also ordered that the department pay Gao for lost income “from the date of termination to the date of his reinstatement, less any money earnt by [Gao] in the intervening period”.
The commission said an appropriate sanction for Gao’s actions would be two percent of his annual salary, amounting to approximately $2300.
