Transport Appeal Boards New South Wales Medium Neutral Citation: David Ryan v RailCorp [2012] NSWTAB 21 Hearing dates: 16, 17, 18 April, 10 May 2012 Decision date: 31 July 2012 Before: Bishop C (Board) Decision: Appeal disallowed Catchwords: PUBLIC SERVICE - discipline - rail employee - breaches of Code of Conduct - accessing, printing and distributing inappropriate material using RailCorp resources to other staff members - allegations denied - plea of not guilty - procedural fairness issues raised - issues as to evidence raised - material not inappropriate to warrant dismissal - reinstatement sought HELD - no procedural unfairness - material manifestly inappropriate - only evidence before Board sufficient to find allegations sustained on balance of probabilities - dismissal appropriate penalty for distribution of material - appeal disallowed. Legislation Cited: Industrial Relations Act 1996 Public Sector Employment and Management Act 2002 Transport Appeals Board Act 1980 Transport Administration (Staff) Regulation 2005 Workplace Surveillance Act 2005. Cases Cited: Briginshaw v Briginshaw (1938) 60 CLR 336 Commissioner of the ACT Revenue v Alphaone Pty Ltd [1994] FCA 1074 Cockayne v Hurstville City Council [2009] NSWIRComm 1013 D & R Flood Commercial Pty Ltd v Flood [2002] NSWIRComm 88 Deuter v Railcorp [2012] NSWTAB11 Dixon v Commonwealth (1981) 61 ALRR 173 Duhbihur v Transport Appeal Board and Anor [2005] NSWSC 811 Jarman v RailCorp [2011] NSWTAB 18 Jarratt v Commissioner of Police for New South Wales and Anor [2005] HCA 50 Neat Holdings Pty Ltd v Karajan Holdings Pty Ltd (1992) 110 ALR New South Wales Nurses' Association (on behalf of Colin Prior) v South Eastern Sydney & Illawarra Area Health Service [2007] NSWIRComm 164 Ryan and RailCorp (2010) TD 443/09 Ryan v RailCorp [2011] NSWTAB18 Category: Principal judgment Parties: David Ryan (Appellant) Rail Corporation of NSW (Respondent) File Number(s): TAB 1514 of 2011 DECISION Introduction 1Mr Ryan commenced employment with RailCorp on 8 September 2003 as a Passenger Attendant at Albury. In April 2004 he was promoted to Passenger Services Supervisor at Dubbo, then in April 2005 he voluntarily regressed to the role of Passenger Attendant at Albury. In July 2006 he was promoted to Passenger Services Supervisor at Albury. 2On 15 December 2009 RailCorp dismissed Mr Ryan for breaches of the Code of Conduct relating to time sheet fraud and failure to comply with a lawful direction. As the result of an appeal to the Transport Appeal Boards (TD43/09), in which the Board only found the allegations to be substantiated in part, Mr Ryan was reinstated to RailCorp, suspended without pay from 15 December 2009 to 15 March 2010 and regressed to the position of Senior Passenger Attendant. 3On 20 January 2011 RailCorp again dismissed Mr Ryan for breaches of the Code of Conduct relating to submitting timesheets that did not show accurate records of work performed. As the result of an appeal to the Transport Appeal Boards (TAB11/21), in which the Board found the allegations to be substantiated in a minor way only, Mr Ryan was reinstated to RailCorp in his position of Senior Passenger Attendant and suspended without pay for one week (from 20 January 2011 to 26 January 2011). 4Mr Ryan remained in the role of Senior Passenger Attendant until 22 December 2011 when he was notified by RailCorp that he was to be again dismissed for breaches of the Code of Conduct arising from the following allegations: Allegation 1: That Mr Ryan breached the RailCorp Code of Conduct by accessing websites that contained inappropriate Material. Particulars of this allegation are: a)that on 29 May 2010, Mr Ryan used two RailCorp computers to access and view the website www.countrylink.biz which contains inappropriate Material; and b)that on 18 June 2010 Mr Ryan used a RailCorp computer to access and view the website www.countrylink.biz which contains inappropriate Material. Allegation 2: That on 29 May 2010, Mr Ryan distributed inappropriate Material from the website www.countrylink.biz to members of the Albury CountryLink office. Allegation 3: It is alleged that Mr Ryan breached the RailCorp Code of Conduct in relation to Misuse of Resources. Particulars of this allegation are: a)That on 29 May 2010 Mr Ryan used a RailCorp computer (source IP address: 10.20.24.6) to attempt to quote and reply to inappropriate Material posted on the web based forum www.countrylink.biz. b)(Allegation 3(b) was not substantiated) c)That on 29 May 2010 Mr Ryan used a RailCorp printer to print the Material contained on the web address www.countrylink.biz which is considered inappropriate as per the particulars of allegation 1 and/or 2. 5On 23 December 2011, Mr Ryan lodged an appeal in respect of his dismissal. On the Notice of Appeal he indicated a plea of "Not Guilty". 6The matter was listed for disciplinary conciliation before Commissioner Ritchie on 20 January 2012 at which time conciliation took place. As no settlement could be reached between the parties, directions were issued as to the filing and exchange of written cases and statements pursuant to Practice Note 22 and the appeal was re-allocated to the Board as currently constituted and set down for hearing on 16,17 and 18 March 2012 in Albury. A further hearing day was also required for submissions on 10 May 2012 in Sydney. 7RailCorp presented its case first in accordance with s.16(1) of the Transport Appeal Boards Act 1980. Issue(s) 8Mr Ryan pleaded not guilty to the allegations and sought that the penalty of dismissal be set aside and that he be reinstated to his position with RailCorp as from the date of his dismissal. It is therefore the Board's task to determine whether the allegations against Mr Ryan are sustained, and if so, the appropriate penalty to be imposed. Background and Chronology 9The following Background and Chronology has been drawn from the evidence and written cases before the Board as filed by the parties. 10On Monday 31 May 2010, Mr James Macklan, Operations Team Leader, Albury, arrived at work to find extracts from a website, www.countrylink.biz printed on blue paper and placed under his office door. He then found copies of the same extracts on blue paper in the Onboard staff's pigeon holes, which he removed. 11Mr Macklan was then contacted by Onboard staff member Mr Tim Bishop, who told him that he had placed the papers under Mr Macklan's door to bring it to his attention. Mr Bishop told him that he had found the blue papers in the Onboarders' pigeon holes and on the table in the Onboarders' room when he arrived at Albury Station at 2300 hours on Saturday 29 May 2010. 12The website www.countrylink.biz ( the CSW) is not a website controlled by or affiliated, with CountryLink. The website, colloquially called "Country Stink", is purported to be a site started by "Max", a disgruntled railway worker, as a place for staff to complain about CountryLink management. RailCorp considered that the CSW contained derogatory remarks and allegations about management, in particular about General Manager, Greg McLeod, and other senior management, and encouraged staff to publicly complain about the organisation with anonymity. 13The extracts placed in the Onboarders' pigeon holes consisted of four "articles" from the website, entitled - "'Take this toast and shove it' by Max", "46 year retired veteran is disgusted with CountryLink management", "Mail Call" and "Job Satisfaction, Morale and Trust of Management the lowest ever: Report Shows". 14On 4 June 2010, Mr Macklan spoke to Senior Customer Attendant, Kevin Dove, who was on duty at Albury Station on the night of 29 May 2010. Mr Dove identified Mr Ryan as the only other staff member at the Station at the relevant time, and stated that he had seen Mr Ryan seated at a computer and with blue paper in his possession during the night. 15Mr Macklan referred the matter to Greg McLeod, General Manager, CountryLink. The matter was then referred to RailCorp's Investigations Unit for investigation. 16An investigation was conducted by Thomas Wood, Investigator, and later finalised by John Kinney, Senior Investigator with RailCorp's Investigations Unit. In the course of the investigation statements were obtained from Mr Dove on 17 June and 18 November 2010 and 26 February 2011, (Exhibit 1-A20 to 22) as well as the relevant rosters for Onboard staff and Albury Station staff for 29 May 2010 (Exhibit 1-2A-I & J 14). They also obtained statements from two of the Onboard staff who were rostered on 29 May 2010, Timothy Bishop (17 June 2010), Peter Bush (11 August 2011),(Exhibits 1-A28-29) who stated that when they arrived at the station that night they saw the extracts on blue paper in the staff pigeon holes. 17A statement (dated 13/10/11) was also obtained from David Corkill, Senior Investigations Specialist-ICT Operations Delivery (Exhibit1-A13). Mr Corkill identified that the CSW was accessed from 2 computers at Albury Station on 29 May 2010. Mr Corkill then proceeded to monitor the 2 computers at Albury Station. On 18 June 2010 the CSW was again accessed from one of the relevant computers. Mr Corkill obtained a video image of the computer screen which identified that immediately prior to the website being accessed, the RailCorp email account of Mr Ryan was accessed using Mr Ryan's personalised obscured password. A chronology of the video evidence (Exhibit 1-F), with an accompanying disc of the video evidence (Exhibit 1-A-G14) was also in evidence before the Board. 18On 5 August 2010, Mr Wood sent a letter to Mr Ryan notifying him of the allegation that he had breached the RailCorp's Code of Conduct and inviting him to respond to the allegations in writing within seven (7) days (Exhibit1-A2). The allegation letter also included allegation 3(b) concerning access to the CSW for which administrator access must have been involved. After further investigation this allegation was not substantiated and not pressed by RailCorp. 19On 10 August 2010, Mr Ryan provided a written response to the allegations (undated and Exhibit 1-A3). In summary Mr Ryan indicated as follows: Allegation 1: He had no knowledge of the allegation against him; all staff at Albury were aware of the website in question; as RTBU Sec of ABx he had access to electronic equipment as per the award; he uses the equipment for union business and to access e-mails; all staff had access to the computer he uses; Mr Macklan removed some material from all their pigeon holes that someone put in; anyone who knew the code to the door had access to the computers at Albury Station; and most staff had viewed the website at one time or another. Allegation 2: His only knowledge of the allegation was that Mr Macklan removed material from their pigeon holes. Allegation 3: He denied all knowledge. 20Mr Wood invited Mr Ryan to attend a disciplinary interview on 29 September 2010 (Exhibit 1-A4), but he declined the interview. 21RailCorp placed the investigation on hold when Mr Ryan was dismissed on 20 January 2011, and when he was reinstated (June 2011) the investigation was recommenced by Mr Wood on 4 July 2011. Mr Kinney took over the investigation in September 2011, supported the conclusions that the allegations were substantiated and finalised the Investigation Report which was forwarded to the Disciplinary Review Panel (DRP) for consideration 21 October 2011 (Exhibit 1-A). 22On 8 November 2011, the DRP reviewed the evidence in relation to the allegations and made a preliminary recommendation that Mr Ryan should be dismissed. On 9 November 2011 Judith Sturman, General Manager CountryLink, wrote to Mr Ryan advising him that, on a preliminary view, it was appropriate that he be dismissed. He was given fourteen days to make submissions in regard to penalty and to submit any further information or material that he wished to have taken into account (Exhibit 1-B). 23On 17 November 2011 Mr Ryan made application to Fair Work Australia (FWA) to attempt to obtain the Investigation Report. A conciliation conference was held on 24 November 2011, at which RailCorp agreed to offer Mr Ryan a second disciplinary interview. Mr Ryan and Mr Edghill of the Rail Tram and Bus Union (RTBU) attended an interview on 8 December 2011 with a record of the interview made (Exhibit 1-2C4). 24As a result of points raised by Mr Ryan at the disciplinary interview, Mr Kinney conducted further investigation. Mr Ryan had stated that he was not in NSW on 18 June 2010 but his roster and timesheet for 18 June 2010, showed him to have worked from 0357 hours to 1215 hours (Exhibit 1-2C8). He also stated that he did not have a secure password to his RailCorp account, and that the staff at Albury depot had his password. Further evidence was obtained from Mr Corkill (Exhibit 1-2C10) that established that Mr Ryan changed his secure password on 14 June 2010 and did not work another shift until 18 June 2010 (Exhibit1-2C8). 25As a result of the further investigation, Mr Kinney concluded that Mr Ryan had provided false and misleading information in the disciplinary interview with respect to his claim that he was out of the State on 18 June 2010, his claim that all staff at Albury had his password, and that he did not have a secure password. A supplementary Investigation Report was prepared and forwarded to the DRP on 15 December 2011 (Exhibit1-2C). 26On 20 December 2011 the RTBU responded in writing to the preliminary recommendation on behalf of Mr Ryan which may be summarised as follows: Allegation 1: Mr Ryan had not used any RailCorp computers to access and view the website www.countrylink.biz and was not present at Albury station on 18 June 2010. The computer at Albury station had been removed shortly after 29 May 2010 and before 18 June 2010. Allegation 2: The RTBU noted Mr Ryan's denial of distributing material from the website, and maintained that his only knowledge of the matter was the removal of the material by Mr Macklan. Allegation 3: The RTBU maintained that it was unclear whether the allegation was that Mr Ryan had attempted to quote and reply to inappropriate material on the website, or that he had actually quoted and replied. The RTBU reiterated Mr Ryan's denial that he had accessed the website from a RailCorp computer. 27The RTBU also maintained that the material distributed from the website www.countrylink.biz was not inappropriate and contained concerns about staff cuts and safety for CountryLink workers, as well as complaints or concerns about the way management treated staff. The RTBU maintained that it would not be automatically obvious to an employee that RailCorp would consider the website inappropriate, and noted that RailCorp issued a memorandum to staff informing them not to access the website, but after the dates of the allegations put to Mr Ryan. Procedural fairness issues were also raised concerning Mr Ryan's access to the evidence, and it was alleged that RailCorp was carrying out a vendetta against Mr Ryan by resurfacing old allegations against him. 28The RTBU also attached a letter from Mr John Emmery dated 12 December 2011 (Exhibit 1-D) which stated that he had seen Mr Ryan use RailCorp computers many times to type letters and notices with regard to Union matters and print material on the printer provided by RailCorp. He stated that many employees at Albury Station entered the meal room to check their rosters and use the computer when not on duty, and that these employees may not be seen by platform staff due to the layout of the Station. He also stated that, on occasion, employees would use the RailCorp computer and not log out properly which meant other staff could use the computer. 29On 21 December 2011, the DRP considered Mr Ryan's response and confirmed their recommendation of dismissal. On 22 December 2011 Ms Sturman signed a letter confirming that he was dismissed effective 22 December 2011 which was acknowledged as received by Mr Ryan on 22 December 2011(Exhibit 1-2E). 30Relevant extracts of the following were also in evidence: RailCorp Code of Conduct (Exhibit 1-2A15), RailCorp ICT Service Access and Usage Policy (Exhibit 1-2A16), and RailCorp ICT Service Access and Usage Procedure (Exhibit 1-2A17). Evidence 31There was extensive cross examination of all witnesses. There was also extensive examination of witnesses as to the layout of Albury Station using the map in RailCorp's evidence and accompanying explanatory map marked by Mr Macklan (Exhibit 1-2A11 &12). RailCorp's video evidence was also viewed but in the absence of appropriate equipment at Albury Court House in could only be viewed on a laptop by the respective advocate and witness during oral evidence. Respondent's Evidence 32RailCorp's evidence before the Board was contained in the Investigation Reports (attached to Mr Kinney's statement - Exhibit 1-2A) and other Annexures (D1-33 and E to N) which included, inter alia: the various letters exchanged concerning the Allegations; relevant memos and emails; the record of Mr Ryan's interview; his written responses; Mr Ryan's Ellipse Personal History Report; timesheets; relevant Internet Access Reports; relevant copies of the "countrystink" website; map of Albury Station; correspondence exchanged concerning the outcome of the disciplinary process; relevant extracts from the Code of Conduct, ICT Service Access and Usage Policy and Procedure; a DVD of the computer surveillance/monitoring carried out, and Statements from the following RailCorp employees: Thomas Wood... Forensic Investigator, (Exhibits 1-2A14, 1-2C9 & 2-2) John Kinney........Senior Investigator, (Exhibit 1-2) David Corkill........Senior Investigations Specialist -ICT Operations Delivery (Exhibits 1-2A13 & 1-2C10) James Macklan...Operations Team Leader South, CountryLink (Exhibit 2-3) David Engle........Senior Passenger Attendant CountryLink (Exhibit 2-5) Kevin Dove.........Senior Customer Attendant CountryLink (Exhibits 1-2A20-22) Timothy Bishop.. Senior Passenger Attendant CountryLink (Exhibit 1-2A28) Peter Bush.........Passenger Service Supervisor CountryLink (Exhibit 1-2A29). 33The involvement of Mr Wood, Mr Corkill and Mr Kinney in the disciplinary investigation and various steps they took is set out in the Background and Chronology above. 34Mr Corkhill's evidence concerned the technicalities of the investigation he conducted (at the request of RailCorp Investigations) to ascertain whether a RailCorp employee had accessed the CSW. He gave technical information about what that involved. His investigation concerned the access/use of the only two computers at the Albury Station (in the Travel Centre and the Onboarders' room) on the relevant dates in the Allegations, being 29 May and 18 June 2010. He accessed computer logs for this purpose. Both of the computers have individual and identifiable source IP addresses (10.20.24.5 and 10.20.24.6 respectively). He provided a report listing a series of URLs (and explained what a URL was) and stated that based on that report he was able to obtain the following information: The first URL was on 29 May at 19:50 hours on computer 10.20.24.6 (Onboarders) and the last URL was at 21:21 hours on 10.20.24.5 (Travel Centre). There was also information from 18 June on computer 10.20.24.6 (Onboarders) between 03:41 and 03:43 hours. From reviewing the URLs for the 29 May he could tell that that the CSW was accessed at 19:50 hours from computer 10.20.24.6. The entries showed that this computer accessed a web based forum (bulletin board), viewing topics and accessing a web which would allow the person to post information to the CSW. That computer was on the CSW from 19:50 hours to 20:55 hours. At 20:52 there was a URL which indicated a web forum was accessed which would allow the person using the computer to post information or reply to a comment on the website. This action was done again three times at 20:53 and then at 20:50 and 20:55. From the URLs he could say that the person using the computer attempted to reply to a number of different posts on the site during this time. This could be shown by the variables f=, which is the forum identifier, and p= which is the post identifier. At 21:09, computer 10.20.24.5 accessed the CSW and was logged onto the CSW until 21:21. During that time the computer accessed the home page of the CSW. He could not say from the URLs whether the computer printed anything at that time. 35Mr Corkill said that his investigation indicated that a number of staff had accessed the CSW and related websites, (at least 10) and from the URLs they could tell the ones who just visited or those who participated because it was a forum where information could be posted. The investigation led to Albury because of the ABOperator user name which was linked to Albury. The use of the ABOperator login did not demonstrate that it was Mr Ryan who used the websites. It was only in CountryLink that there was a generic logon. RailCorp had endeavoured to remove generic logons to prevent abuse of their use by employees. 36In cross examination Mr Corkill confirmed that any staff member at Albury could log in under ABOperator and then walk away without logging out and a subsequent user would then be accessing the computer under that login. 37Mr Corkill also indicated that the while the URL could indicate the section of the CSW forum that was being replied to it did not actually show that the any information was posted, as that was put on after the button was clicked, the URL that was seen within their software was prior to that. He did demonstrate what would be shown on the screen (using the video of the 18 June 2010) when there was an attempt to post on a forum. 38Mr Corkill also confirmed that he was asked whether there was any way to determine whether a particular computer had printed anything and he said that at that time RailCorp did not have any auditing or reporting of printing facilities. 39As a result of the information he obtained in that search he was asked by RailCorp Investigations to monitor those two computers at Albury Station to attempt to identify the person who logged onto the ABOperator. On 18 June he identified that the computer 10.20.24.6 (Onboarders) had accessed the site at 03:41 hours. He obtained a video image of the computer for that same computer immediately prior to, and continuing through 03:41 hours. It showed employee David Ryan accessing his RailCorp web based email. His email account was clearly identified and he used a personalised obscured password to enter the email account. There was continuous movement of the cursor and use of the computer until it accessed the CSW which then continued during the access to that site and then he logged off the computer. 40Mr Corkill stated that this continuous activity clearly identified to him that the user at the time was employee David Ryan as people's usernames and passwords were known only to them. This was a condition of the use of the RailCorp computer system. The time the site was accessed and the time displayed on that computer video image were identical. 41Mr Corkill stated that when Mr Ryan accessed the website on 18 June 2010 he did it under the name ABOperator, and not under his own username. ABOperator was the same username as the one who accessed the information on 29 May 2010. Further Mr Ryan entered the website using a link from the browser's history on the computer. This indicated that Mr Ryan knew this computer had previously accessed the CSW and where to find the link. 42Mr Corkill was also taken in cross examination to the video of the computer usage referred to in his statement for 18 June and he explained what was happening at the relevant times. 43He agreed that there was a four second delay between the cursor clicking to close the email and moving to take action to access the CSW. He thought it would be unlikely that Mr Ryan could have closed his emails and someone else taken control of the mouse but agreed it was "possible". He also agreed that the video did not demonstrate directly that Mr Ryan was accessing the CSW directly but that it led him to assume that he was accessing the CSW. 44While it would have been possible to go onto the site and check whether anything new had been posted in reply he was not asked to do that by RailCorp. 45Mr Corkill had also conducted a further investigation in December 2011 (at Mr Wood's request) into Mr Ryan's outlook account with RailCorp (his email account) and provided specific information about password access to RailCorp accounts and specifically the history of Mr Ryan's account since 2009. 46Mr Corkill's information (attached to his statement) indicated that all user accounts in RailCorp are subject to the RailCorp password policy which is automatically enforced by the Authentication server (Active Directory). It is quite a strict policy to ensure that RailCorp staff follow password changing measures and that passwords are complex and near impossible to guess. The RailCorp computer system remembers the last 12 passwords used on an account and when you are required to change your password it will not let you reuse any password that you have used on the 12 last changes. The passwords remembered are unique to each user account. The password changes are set by RailCorp, however it is a physical system set in the computer itself. 47He went on to state that there was an option not to change your password but Mr Ryan's account did not have this enabled and it was rare for any normal user to have this function enabled. He also indicated that the Railcorp system had an automatic notification requiring changing of the password regularly and if the password was not changed within the required time (seven days) the account was locked and the Service Desk had to be contacted. It also stopped people from using the same password backwards and forwards and using the previous password. 48Mr Corkill stated that Mr Ryan had sent emails under a different username 'dryan1' however in May and June 2010 this account was not able to be accessed as it was disabled on 31 December 2009. 49Mr Corkill also gave details of the actions on the 'dryan' account performed by Fujitsu. The account was commenced on 9 April 2010 and appeared to have been created as a result of an ellipse account creation (such as when a new employee starts with RailCorp) the account was created, enabled and password created on 9 April 2010 and the password was reset by Fujitsu on a further 8 occasions up to 29 August 2010. Up to 14 June 2010 the password had been reset 8 times. There was a call logged to Fujitsu on 14 June 2010 at 22:24 and the password was reset for Mr Ryan's account by a person named Burrages at Fujitsu at Mr Ryan's request. 50Mr Corkill responded to Mr Ryan's claim that he never had a secure password and that he used the password 'rail123' or 'railway123' and stated that this was not possible as the RailCorp system would not allow the use of just two passwords as it remembered the last 12 passwords. 51In response to Mr Ryan's denial of having an account in the name of 'dryan', Mr Corkill had extracted three pages from the RailCorp system which showed the account 'dryan' was listed to Mr David Ryan, a Senior Passenger Attendant, with his manager listed as Mr James Macklan. These were Mr Ryan's details and the account was linked to him. He could be seen in the footage on 18 June 2010 accessing his account and checking an email CC'ed to him. Mr Ryan's denial of this account was not correct. 52Mr Corkill said that the fact that the account was reset by Fujitsu on 8 different occasions might infer that either that Mr Ryan had not been updating his password as required, it was being locked and he had to have it unlocked by Fujitsu, or that he could not remember what the password was because he had changed it so many times. He also said that when a request was logged to Fujitsu they would change the password, set it to something generic and set a flag on the account which said "this password must be changed on the next logon" so Mr Ryan would logon with that generic password but be forced to change it again. 53He also indicated that the password must meet complexity, it could not use part of your name or use the word "password", had to be of at least 7 characters with one an uppercase. It encouraged a really strong password that could not be guessed. Mr Ryan could only have used "rail123" or "railway 123" once, and then only if one of the characters was uppercase. 54Mr Corkill confirmed that while CountryLink owned the computers and the generic accounts, they existed within the RailCorp authentication network and RailCorp's password policies would apply. Even if a generic logon was used by someone, Mr Ryan's personal account could not be accessed as a dialogue box would pop up and say "ABOperator does not have access". Please enter the credentials of the person who has access to this mailbox". 55Mr Wood had made three statements (19 October and 9 December 2011 and 2 April 2012). He deposed as to the disciplinary investigation he commenced in 2010 arising from the complaint by Mr Macklan and the information collected during the course of the investigation (website information and various printouts, rosters of relevant staff, timesheets etc, statements from relevant staff) and the enquiries/investigation concerning the operation of the CSW and essentially who was behind it, including whether or not Mr Ryan had administrator access to the CSW. His checking of time sheets/rosters etc showed that the only persons on duty at Albury Station on 29 May 2010 during the time of access to the CSW were Kevin Dove and Mr Ryan. 56He indicated that RailCorp had become aware of the CSW after 25 May 2010 (when it was accessed by ABOperator at Albury) as ICT had received a standard automatic Google "push" advising of a related site that had "CountryLink" on it. There were then a number of accesses by people who should have been looking at it in order to take some action and that included Mr Tom Forrest, Executive General Manager on 28 May 2010, who emailed to Ms Virginia Wills, General Manager Investigations a copy of the content of the CSW and that content was identical to that which was distributed at the Station on 29 May 2010. At that stage they were trying to identify the owner of the site and the focus did not switch to Mr Ryan until after Mr Macklan spoke to Mr Dove on 4 June 2010 who told him that he had seen Mr Ryan at the computer on 29 May and looking at "Country Stinks Website". 57Mr Wood also had forwarded to him an email from Mr Macklan (as sent to Neil Parsons) on 4 June which detailed how he came across the blue printed material under his office door when he arrived at work the previous Monday (31 May), and his subsequent conversations with Mr Bush and Mr Dove. 58Mr Wood had printed off the information on the CSW that was accessed on the two computers at Albury Station on 29 May and it was the same as the information on the blue pages provided by Mr Macklan and which was placed into the pigeon holes at Albury Station on 29 May with the headings of: "Take this toast and shove it" by Max; 46 year retired veteran is disgusted with Countrylink management; Mail Call; and Job Satisfaction, Morale and Trust of Management the lowest ever: Report shows. 59Mr Wood stated that the material contained derogatory remarks regarding CountryLink senior management, in particular Mr Greg Mcleod, former General Manager CountryLink. In addition to derogatory comments about senior management, the material encouraged staff to publicly complain about the organisation with the benefit of anonymity provided by the website. 60Mr Wood confirmed in extensive cross examination his opinion that the material contained derogatory remarks/comments, what exactly was derogatory etc., and that the purpose behind the dissemination was inappropriate as the CSW incited people to go on and make anonymous postings. He agreed that there were serious allegations made about bullying and harassment within CountryLink but with not a skerrick of evidence provided. If there were issues to raise then there was a lot better language that could be used to raise an issue with management, it did not have to be in this format. He did not consider that a person disseminating this information could not have known it was a serious breach and not have expected some sort of disciplinary action. He confirmed that during the course of his investigation he had also spoken to various staff members who had viewed the material and they also viewed it as inappropriate. 61Mr Wood stated that the records provided by FDS (Forensic Document Services) showed that the times of accessing documents on the Onboarders room computer matched the times of the accesses to the CSW, the implication being that the only use of that computer on that night was by the person responsible for accessing the CSW. The three periods of access were, 7:45pm to 7.50pm; 8:05pm to 8:12pm and 8:47pm to 8:55pm and only related to viewing of the CSW. 62The FDS records showed the opening of the word document and other files from 8.58pm to 9.00pm. The ICT investigator noted the opening of the Zeus file which was a saved web page file relating to Greek mythology on the D drive. Mr Wood maintained that it would not follow that a person who was coming to the office specifically to distribute inappropriate material would then read up on Greek mythology. The report showed the next use was the Travel Centre computer at 9.09pm with the person navigating from the Countrylink homepage to the CSW and that continued until 9.21pm. 63Mr Wood stated that it was clearly evidenced in the internet access reports for both computers at Albury Station that the CSW URL was accessed and therefore the person responsible had access to the material required to be printed out and then distributed. The URLs showed that the "View Forum" was clicked and then the individual forum topics (the subject of the printed sheets) were then accessed. 64Mr Wood agreed that there was no direct evidence showing that any of the other items (as referred to in Mr Wood's statement) on the CSW, apart from the 4 postings in the printed material, had been viewed by Mr Ryan. 65In terms of substantiating the allegations (1 and 2) Mr Wood acknowledged that the computer had been logged onto by the generic ABOperator and that did not establish that it was Mr Ryan who accessed the computers but that it was Mr Dove's evidence of having seen him around that time that did. He also agreed that the IT evidence did not establish that Mr Ryan had posted any comments on the CSW. 66Mr Wood confirmed the use of the generic code of ABOperator in use at Albury for the use of Onboard staff who had to be hopping on and off trains within half an hour to save them shutting down and logging off each time. He was not aware of whether that logon was posted on the wall next to the computer where any other staff could see it. he agreed that the investigation showed the ABOperator was generally left on. 67Mr Wood was not aware of whether there was a specific time period after which the computer automatically went on standby requiring a fresh login. He had not checked that but said that was a standard energy saving practice across RailCorp. 68He also indicated that initially the CSW could be accessed by anyone and information posted/replies made anonymously, but sometime prior to 18 June the CSW changed to require that a person become a member and register before posting information. 69Mr Wood discussed with Mr Corkill how they might determine who was accessing the CSW on the relevant computers and setup an automatic notification of when any person accessed the site. They had intended to then contact someone at the Albury Station to visually check who was accessing the computer at the time of the automatic notification. Their first attempt at such verification was unsuccessful as Mr Macklan was offsite at the time. On their second attempt the employee of whom the request was made to go into the Onboarders' room and carry out the visual sighting refused to get involved. Due to the use of the ABOperator logon without a statement that a person was sitting at the computer at that time, meant that he was unable to do anything. 70Mr Wood deposed that the second strategy he and Mr Corkill came up with was to record what occurred on the computer screen. This was authorised by ICT policies and Mr Ryan also sought legal advice from RailCorp about this. Mr Corkill then arranged the setup which resulted in the information gathered on 18 June. 71Mr Wood was subsequently provided by Mr Corkill with the video of the accesses made by the user of the computer on 18 June 2010 and prepared a documentary chronology comparing the information. He also confirmed that from the information displayed (and as referred to by Mr Corkill) the user was identified as Mr Ryan due to the access to Mr Ryan's personal email and the immediate access to the CSW. 72He went on to state that on 18 June, the user, after accessing the personal RailCorp Webmail of Mr Ryan, then accesses the CSW through the browser history which indicated that the person had used the site before, and clicks on the forum topic "Countrylink Management" and proceeds to run his mouse cursor over a post on the site that is critical of the person(s) who has created the CSW. The video evidence captured the user clicking the quote icon directly relevant to that comment critical of the CSW. This would indicate the user wished to respond directly to that comment. When the quote icon was clicked the user gets the whole statement made by the person to respond to. This was clearly shown at recorded time 3.43.36am (or 1 hr 44 mins and 27 secs of the video). The user then decides to cancel the post and closes down the web browser. 73Mr Wood said that the video showed the person going to the browser history and into the section related to the CSW which indicated the person was aware the web history was in the computer. That indicated a person with prior knowledge of where it sat within the computer. 74Mr Wood was also taken to the video of 18 June at some length and in some detail as well as to his typed narrative chronology. He acknowledged that when the cursor shut down the email there was a 4 second pause when the cursor was not active until it moved across to the browser. He also agreed that a person did not have to be sitting down to control a mouse or a computer. He also agreed that it was possible that someone was standing behind Mr Ryan and wanting to access the computer did so as soon as he clicked to close the email window and placed their hand on the mouse within that 4 second period. He said that had never been raised, but also agreed that to the best of his knowledge Mr Ryan had not been shown this evidence. 75He agreed in re-examination that after closing down the emails the cursor moves straight down and diagonally across and opens the start menu, then the browser menu, and goes from top to bottom searching. He also agreed that there was an attempt, after the item was read, to quote before the site was shut down. He had missed that at the time and if he had picked it up then that would have been part of the third allegation of attempting to quote. 76Mr Wood also confirmed that when the computer first starts up it looked like they were possibly going to open up the CSW before accessing the emails, and agreed the person went in, hovered over the CountryStink website, then opened the 'dryan' email. 77Mr Wood did not think it plausible that the access through the browser could have been made by someone who had not previously used it but seen others do so. That would not be the usual way you would access the CSW. 78He also agreed that the user only accessed the site, did not attempt to post on the site and was looking at a posting that was critical of the CSW. 79Mr Wood agreed that the viewing lasted for around three minutes and while he had agreed that viewing the website in and of itself didn't warrant investigation in others, in Mr Ryan's case he said it was his other conduct of distributing the material from the website and he seemed to have a very close association with the website going on the actions that he took. 80On 25 June 2010 Mr Wood considered that he had sufficient information to commence the investigation on the basis of the evidence of two occasions linking Mr Ryan to the CSW. 81In response to Mr Ryan's claim of never having been given access to the material referred to in the allegations, Mr Wood stated that when he sent the allegation letter to Mr Ryan on 5 August 2010 (by registered post) he attached relevant documents, including a printout of the 4 pages of material posted in the pigeon holes at Albury Station, as well as copies of relevant RailCorp policies. A confirmation receipt was also attached which was required to be signed and sent back to him by Mr Ryan. He did not receive a copy of the confirmation receipt, but did receive the signed registered post receipt Mr Ryan would have been required to sign when he was served with the allegation letter. He subsequently received the undated written response to the allegations from Mr Ryan on 10 August 2010 within the 7 day time frame stipulated. All three allegations were addressed and nothing was mentioned about the attachments referred to in the allegation letter as being missing. 82Mr Wood acknowledged that they had left access to the CSW open to try to help them catch the person responsible for it. They could have shut it down straight away. During a meeting held on 26 July 2010 with senior RailCorp management they determined that access to the CSW should be blocked. Persons who had accessed the site were to be contacted to determine how they come to know about the site, if they were a party to information posted on the site, or had suspicions about who was the person posting. The review yielded no beneficial information. People identified as accessing the site through their login ID were curious rather than culpable, or from RailCorp Media Relations departments or RailCorp executive officers with a direct need to monitor information being posted. As those persons were not attempting to post or reply to content from the site (which could be ascertained from the information from the URLs) and RailCorp could not be certain as to their motives, unless persons were attempting to post information on the site using RailCorp computers could be identified, then investigative action would not be taken. Analysis showed that the only attempts to post information on the site occurred via the Albury Onboarders' computer on 29 May 2010, and for Investigation purposes by Mr Jim Morton, former Senior Solicitor Employment, and Mr Wood. 83Mr Wood said that if Mr Ryan had only accessed the CSW in line with what other staff had done (those doing it out of curiosity etc) then he agreed 100% that he would not have been charged or disciplined. 84In response to claims by Mr Ryan, Mr Wood said that it was reasonable for Mr Macklan to be viewing the website, being the Manager of Albury Station where a lot of the posts were relevant, and given the fact that information from the website had been placed in his staff's pigeon holes, the CSW referred to him personally as well as other members of Albury Station, and there was substantial concern amongst employees in Albury that the person responsible for the website was from Albury; that management might take this opportunity, given the problems occurring at the station, to shut down and close their Station and, as such, force them into redundancy. 85No evidence was ever gathered which identified Mr Bush viewing the website, let alone, attempting to post or reply to content on the website and so he was never given an allegation letter. 86Mr Wood stated that Mr Ryan never raised any issue during the investigation process about disparity of treatment and as such it was never addressed earlier. 87Mr Wood also deposed as to attempts to gather evidence which would identify the owner of the CSW. They then recovered the Albury Onboarders' computer to determine if documents relevant to postings on the CSW were drafted on that computer, or brought in via USB stick and then uploaded onto the website. This was done by FDS who were contracted to have the computer forensically imaged and analysed. 88Mr Wood responded to Mr Ryan's claim that his use of the computer and printer on 29 May related to his drafting of an RTBU resignation and ballot paper and referred to the evidence of Mr Dove that Mr Ryan approached him and told him he needed to use the Travel Centre computer because the printer in the Onboarders' room was broken. If Mr Ryan had drafted the documents he referred to on the Onboarders' room computer there would be a record of this in the analysis performed by FDS. There was no evidence of Mr Ryan drafting a word document relating to his resignation as RTBU Secretary Albury Branch on this computer. The only word document that was opened at the relevant time, and given the proximity of the times, by the person responsible for accessing the CSW, was a RailCorp policy document titled "Corruption and Fraud Lessons.doc". 89Mr Wood also stated that if Mr Ryan had raised this information at an earlier stage of the disciplinary process, rather than in the written submission, it could have been determined whether or not he had drafted any documents on the Travel Centre computer. 90Mr Wood denied that RailCorp expended $1,000,000 in the investigation of the CSW. Having regard to commercial in-confidence information RailCorp Investigations spent less than $15,000 on external resources. 91Mr Wood also stated that whilst the investigation was technically still open as they had failed to identify the person responsible, the CSW had been closed. Should information be provided which allowed action to be taken against the person responsible, then RailCorp would definitely commence disciplinary proceedings, and there would be a number of parties who would like to seek redress for libel/defamation. 92Mr Wood was taken at some length to the three statements of Mr Dove and he indicated how they were taken. He was satisfied that the second statement simply added the detail that Mr Dove didn't see anyone else, that the first statement was sufficiently detailed and had been taken only three weeks after the events and that at that time given he was an employee of only three months, it would not have been appropriate to talk about his routine but what he linked to his memory (such as the football on the television). He was on leave when the third statement was taken by Mr Brian Healey and it was done to obtain more detail. He denied that RailCorp was seeking to have Mr Dove change his evidence to sync with the IT evidence that they had. He maintained that the essential information related by Mr Dove concerning seeing Mr Ryan at the computer etc and accessing the blue paper and the printer etc., did not change. 93Mr Wood agreed that he did not check Mr Dove's movements and where he was between 3.30 and 5.30 or who else might have been at the Station. He said that the Travel Centre could not be accessed internally by members of the public, or staff because it was locked and they had to access the employee entrance with a pin. He agreed it could be possible for someone to access the Travel Centre at a time Mr Dove was cleaning and without him seeing but said that he could hear from the toilets that someone was on the computer so it was equally plausible he would hear someone in the Travel Centre. What they had looked at was when the computer and the CSW was accessed. 94He agreed that other off-duty staff might need to come in and check rosters etc and it was possible someone else came in but Mr Dove said he didn't see anyone else and in the absence of any alternate position given by Mr Ryan that was the evidence they had. He agreed that Mr Emmery and Mr Forbes were off-duty but that it was not likely that they entered as Mr Dove didn't see them and would have known who they were. 95He reiterated the evidence of Mr Dove concerning being approached by Mr Ryan on 29 May because the printer in the Onboarders room was broken and he needed to use the printer in the Travel Centre and that he later asked to use the photocopier in Mr Neal's room and emerged carrying a bundle of blue paper. The only photocopier was in Mr Neal's office. He also indicated that as a result of the investigation the only blue paper in the organisation was found in Mr Neal's office, it was nowhere else at Albury Station. When Mr Macklan went in there on the Monday the blue paper was sort of hanging out as if it had been used for something. The paper had only been used once, a couple of years ago so this was only the second time it had been used. 96He agreed that if anyone else, such as Mr Forbes, Mr Navarro or Mr Emmery had accessed the computer and printed off the material on blue paper and distributed them they could not have used Mr Neal's office as they would have had to have access to that for the blue paper and the photocopier. 97Mr Kinney took over the investigation commenced by Mr Wood in September 2011. Most of the report had been done before he became involved and it came to him almost complete. All of the relevant material was there and the allegations had been substantiated and he supported that and finalised the report on 21 October 2011 and forwarded it to the DRP. During 2011 he had also been in the role of Quality Assurance. As such he had reviewed the Investigation to date as was satisfied that it had been conducted in accordance with RailCorp's Discipline Procedures. 98Mr Kinney said in cross examination that viewing the CSW in and of itself was not serious misconduct but his understanding was that there were extenuating circumstances in relation to Mr Ryan and that there were a series of allegations. They were matters better dealt with by Mr Corkill and Mr Wood. 99Mr Kinney also agreed that the 8 December Interview arose as a consequence of Fair Work proceedings but had not been involved in those. He was aware another interview had been offered and he had material to show to Mr Ryan during the interview (CSW material etc) . There was other material he had available but the interview was unable to be finished because Mr Edghill had another appointment. There were also issues raised with him about Mr Edghill seeking to act as Mr Ryan's representative. Mr Kinney generally said there was no issue with how Mr Edghill sought to do that but the Discipline Policy only provided for him to be there in a support capacity. He agreed that he indicated at the end of the interview that another interview would be arranged and that subsequently a letter was sent advising that there would not be a further interview made available. 100Mr Macklan stated that he was a member of the RTBU and the Albury Branch and would receive correspondence from the Albury RTBU representative by hand, meetings or by reviewing the Union Board. He would normally be given any information relevant as a Union member and he would also see it on the Union Board. He had in the past been asked not to attend some meetings by Mr Ryan due to his position as manager. 101He stated that the Union Board was a key locked wooden cabinet with a glass door for union notices to be posted on for all members to see. There were two keys, with Mr Ryan having one and the other being maintained in a drawer in Mr Macklan's office. The Union Board was in the meal room above the sink and to the right and could be seen any time you went to get coffee. He generally checked it out once a week. Sometimes notices stayed there for days, were taken down in a week or stayed there for months. He never accessed the cabinet himsel. 102He had never received any notification on blue paper of the resignation of Mr Ryan as Secretary of the Albury RTBU Branch or a ballot paper relevant to the voting/replacement of Mr Ryan's position. As an RTBU member voting in the next Union representative would have been one of his rights as a union member. 103In cross examination Mr Macklan agreed that he was aware that Mr Bruce Forbes became the RTBU Albury Secretary and that there were elections around June 2010. 104Mr Macklan also said that inappropriate material had been placed in staff pigeon holes before (but not on blue paper), about six months previously and he had brought it to the attention of management. 105He had never been aware of the CSW until he saw the blue documents that were put under his door and which he found on the Monday (31 May). He went and looked up the site because he couldn't believe it, and to see if it was right, or someone was just making it up. He had visited the site on other occasions and may have done so with other staff members when they came to complain about the blue paper. He agreed that he viewed the material with Mr Bush who came to him, could not recall on which computer, or that he was laughing when he did so. He did not think that he would have laughed about someone attacking the organisation. 106He acknowledged he received an email from Mr Byford which in part said "don't react to the document", he took that to mean not to go and start questioning people or put out a memorandum. He did not put out any memo but said that if people came to him he told them not to go to the site. He could not recall if he said that to Mr Ryan. 107He also subsequently had to view the CSW when he was asked to and did not consider that was a breach of the Code of Conduct as he had a valid reason for looking. Staff were aware of the Code and they would only have had to read so much to also know the site was inappropriate. Under the Code anything against the organisation, or malicious or misrepresenting the organisation was deemed inappropriate. 108Mr Macklan was asked a number of questions about RTBU material on website/publications, he had not really paid attention to those and generally did not think they were against the organisation. 109Mr Maklan said he was aware of the ICT policy and inappropriate usage and it came up on the screen when you opened the computer. All the staff had ICT training. It happened when they first put in the computers at Albury about three and a half years ago. 110He did not think it would be usual for staff to come in on their day off to check rosters etc, and queried why they would do that. They would ring up the site or a free 1800 number. He could not remember ever seeing anyone there on their day off. The Sydney staff would stay at the barracks across the road and might sometimes come in to check their emails because they were away from home or pick up a roster. 111He was asked a number of questions about the Albury Station layout and described access generally through various areas, areas with locked doors and when they were locked and areas with keypad access. He generally confirmed that only Albury staff had access to that part of the building with the meal room and Onboarders room, access was through a locked door, only Station staff had the key and Sydney staff would have to go and physically ask them to unlock the door. There was also a key pad entry only available to Albury staff. Sydney staff could access that area by going through to the meal room from a door in the luggage room. Mr Neal's office was generally left unlocked during business hours, and he locked it when he left to go home. There was access to that office available to enable cash to be put in the safe but the SCA had the key and was always there to enable that access. If a staff member did come in to access the Onboarders room (via the luggage room) they would have to walk past the meal room and would be seen if someone was in there. The Travel Centre doors were always locked after hours and only accessible from the luggage room door if the luggage guy opened it and not to public or staff. The public had no access to the Travel Centre after hours at that time. 112Mr Macklan said both he and Mr Neal had a master key, Mr Neal's 2IC had a key and he was not aware of a spare set of keys being kept in the luggage room. 113He indicated that during the investigation he was asked a number of questions. Mr Emmery's name was mentioned and other staff had mentioned it might be him, but he said he couldn't tell them. He was not sure who did it and did not personally suspect anyone. He could not remember specifics but may have had email exchanges with the investigators and alluded to Mr Ryan, and Mr Emmery as being people who had grudges and said it was no secret that either were unhappy with the organisation. Mr Emmery had an issue with a promotional matter and that would have been the matter he was unhappy with in May 2010 (with reference made to "the great race"). He agreed Mr Emmery had been dismissed by RailCorp and reinstated (after May 2010) but he was now working for CityRail and not in their area, 114He agreed that he had also discussed the possibility of Mr Bruce Forbes being involved. he Said that the two people referred to were on light duties, in the meal room quite often, but worked 9 to 5 and not on weekends. He could recall discussing who would be there on different days but could not recall any email about whether they were the ones distributing. 115Mr Macklan acknowledged that this was the third occasion on which he had appeared for RailCorp and given evidence against Mr Ryan. He had done that in his capacity of being Mr Ryan's direct manager. He had no axe to grind with him, but was not happy with how he affected the team in relation to some of the stuff that had affected the team. He had nothing against him personally and had not had any issue working with him in the past. 116Mr Engle described his position and his responsibilities for handling cash receipts while working in the buffet car on the Sydney to Albury service which then continues on to Melbourne. Usually when he arrived at Albury Station after a verbal handover on the platform to the incoming crew, he would be escorted to the Manager's office by a Station Staff Attendant where he would officially hand over the float and revenue bags to the CSA who co-signed his deposit to the safe. He would either stand on the platform waiting for access because the door would be locked or he would push it open if it was unlocked and there would be a staff member there. That was the only area he was would access as a Sydney crew member. 117Mr Engle was also asked questions about the layout of Albury Station. he indicated there were other areas he could access but if he was going to enter another room he would usually ask whoever was on duty, obtain permission and enter with someone else, an Albury Station staff member. Certain facilities he could access with permission. In relation to the Onboarders' room he asked permission because he understood the room was not designated for Sydney crew use, it was their room. 118Mr Engle stated that he would then sign off in the Barracks opposite the Station as this would normally be where he met his supervisor. He sometimes stayed in Albury after his shift but rarely after 1600 hours, was usually in bed around 2030 hours, as he had usually been up before 0600 to complete ST23. 119He had never printed off material on blue paper on the Albury Station printer and had never accessed the CSW on an Albury Station computer. He could not recall doing so on 22 June 2010 at 8.08.33 as shown on the URLs in RailCorp's material. He could not recall ever being spoken to about not accessing the CSW. 120In his view the majority of Sydney staff would not know where the Albury staff were let alone whether there was a computer for their use. They also could not access the building through any locked doors. Also it would be so unusual for them to be around the Station and that they would stick out obviously to any Albury staff. 121He had been involved in training of CountryLink onboard staff in basic computer skills at this time and had in the past given some limited assistance to Albury staff with in his capacity as a Trainer/Assessor. He had also assisted with network account and connection issues but could not recall when. The Sydney staff did not have a computer at that time but were able to use the computer in the Onboarders' room and he would have encouraged them to do that for practice. When he logged in he used his own personal account. 122Mr Engle said that on 29 May his diary entry confirmed the four other staff with whom he worked with on the ST23 run from Sydney to Albury. They had been invited to dinner by Bill Elms (Albury Passenger Attendant) and his partner. They met at approximately 6 pm, walked to the dinner venue together and returned to the barracks at approximately 9pm. There was one out of the other four crew members that he could not recall being at the dinner (Mr Navarro) and he thought he "did his own thing". 123Mr Bishop was rostered to work the ST22 from Albury to Melbourne on the 29 May 2010 departing around 11.30 pm. He arrived at the Station around 10 pm, went into the corridor entry to the main building (via the platform access) dropped his bags in the crew room and went to the locker room to collect his Senior Passenger Attendant bag, returned to the crew room and then went to the pigeon holes located on the right side of the crew room. (there are roughly 30 pigeon holes for use of Albury based staff). 124He said that he always arrived early for his shift, that had been his practice whilst ever working for CountryLink (13 ½ years) and he did so because when he started he was quite nervous and wanted to have some peaceful time so he could get a handle of what he had to do when he got on the train, fill out his SPA books etc and do some preliminary work and prepared things so he didn't have to do that on a bumpy train. 125When he looked at the pigeon holes he noticed that all the pigeon holes but his and another person's (he could not recall who) had a blue printed document in them. The paper was sticking out a bit. There was also document of the same colour on the nearby table which he picked up and began to read. The first page had a header which stated words to the effect of "take this toast and shove it". This caught his attention because he had recently been involved in confirming to staff particular policies on the use of "Condemned Food". He acknowledged that it was a Railcorp policy and the obligation of all staff to enforce it. 126He went on to describe what was meant by 'Condemned Food' and that notification about policies had arisen after he had sought clarification of procedures from RailCorp's Catering Manager with a memo then being circulated to staff regarding the proper procedure. He understood that some staff resented no being able to have a piece of toast from a condemned loaf. 127Mr Bishop said he read the whole four page document, (referring to some of the other content). Towards the end it said that the writer wanted other CountryLink workers to use the forum as a means to bring to the light the double standards of the organisation. He personally found this hypocritical of the writer. 128After he read the document he continued to get ready for his shift and the other crew began to arrive and pick up copies of the document. He felt annoyed about what someone had done, that the spreading of something like this around was bad for the Depot and CountryLink, could be detrimental to their jobs and therefore decided to do something about it. 129He had wanted to contact Mr MacLeod directly to bring it to his attention, but knowing the chain of command he advised his direct manager Mr Macklan. He took a copy of the document that had been on the table and wrote on the back of it words to the effect of "These have been placed in everyone's pigeon hole except mine (which I find interesting) could this be investigated". He deliberately didn't write his name on the document in case anyone came across it. He then placed a copy of the document under Mr Macklan's door, a step which was regarded as a secure means of communicating with management. He then decided he would contact Mr Macklan at the completion of his shift to let him know that he was the one who left the document for him. 130The train departed the Station at approximately 11:30 pm that evening and he remembered that the majority of the blue documents remained in the individual pigeon holes. During the shift he had conversations regarding the document with other staff on shift who had already collected their copy from the pigeon hole. 131On Monday, 31 May 2010 he called Mr Macklan, left a message on his voicemail and Mr Macklan called him back and they discussed the content of the document. He asked if the contents had been brought to the attention of Mr MacLeod and Mr Macklan said the 'relevant people' had advised. 132Mr Bishop that when he saw the document he was quite concerned that it wasn't going to do any good for the reputation of the Depot. He wasn't aware that it was in any other Depots. He went on to say coming reasonably fresh from Sydney, (he had been at Albury 3 ½ years) Albury was always being spoken negatively about, but he didn't find the rumours to be true. The rumours usually referred to the Depot as a whole, both managers and staff. 133Mr Bishop said he was not aware of the CSW before he saw the blue papers. He first accessed the CSW on 10 June 2010 from his home computer and printed out a copy of the webpage. He had only accessed the site once from RailCorp computer. When he made his statement on 17 June 2010 he provided Mr Wood with a 4 page blue colour document that he removed from the rubbish bin in the crew room which he found when he returned to Albury around 4 am on Monday 31 May. He signed each page of the document. 134Mr Bishop also confirmed the doors that were usually locked and where access was available and when, especially in relation to the luggage room. He was not aware of who had keys or where they were. 135Mr Bishop agreed staff could access various areas in the Albury Station building, considered it was not usual for staff to come in when rostered off but said that he might sometimes come in to get something out of his locker. On such an occasion he would not be questioned on an official basis as to why he was there, but would be casually questioned. 136Mr Bush worked the ST23/22 from which left Albury around 3pm and arrived in Melbourne around 7pm, leaving around the same time and returning to Albury around 11pm. He recalled that when he returned to Albury Station he found the material in the pigeon holes and on the table in the crew room. The material had not been in the pigeon holes when they left at 3pm but was there when he returned at 11pm. They may have been late, but he would only know by looking at his diary and it could have been around 11.15. He had not been aware of the CSW before he saw the material and he considered the content to be inappropriate. 137He agreed that he had subsequently looked at the CSW with Mr Macklan in the Onboarders' room and that at some stage Mr Ryan had come in. He denied that he and Mr Macklan were laughing, it wasn't really a joking matter, it was garbage. He thought that particular viewing could possibly have been on 2 June. He accessed the computer via the ABOperator logon. That was the only way he could access the Intranet. he did not have a personal email account. He was not aware of any other occasions when the CSW was viewed at work. Mr Macklan did say not to look at it. As to any advice not to look at the CSW he was aware that after a period of time that RailCorp sent out an information bulletin in October 2010. 138Mr Bush was also asked a number of questions about the Albury Station layout. 139He did not think it was common practice for off-duty staff to attend the station or use the resources. He was aware there was 24/7 access by a keypad located at the hallway entrance to the Onboarders' room. He also confirmed the Travel Centre was locked 90% of the time unless someone was there, Mr Macklan, the Travel Centre Manager and the CSA had probably had a key and he was not aware of any spare keys. He generally confirmed the access to various areas as described by Mr Macklan and that to go to the Onboarders' room you would either be seen by someone in the meal room or the luggage room. He had never seen either Mr Emmery or Mr Forbes access the resources out of hours. 140Mr Dove made three statements. He had been asked to make each statement, he had not volunteered to do so. The first was made on 17 June 2010, the second on 18 November 2010 and the third on 25 November 2011. 141Mr Dove only joined RailCorp in March 2010, had never before worked for RailCorp and had no relative working for RailCorp. 142In his first statement he indicated that he had worked the 4pm to 12am shift on Saturday 29 May 2010. The following Friday 4 June he was approached in the morning by Mr Macklan who enquired about his health (he had been off sick the previous Friday 28 May), asked if he had been working on Saturday 29 May and if he had seen anyone using the Onboarders room computer. 143At this time Mr Dove was not aware that anything that happened on that night that was going to have an impact. 144Mr Dove told him that during the early part of his shift, while cleaning toilets, he had seen Mr Ryan in the Onboarders' room sitting at the computer and he could see on the computer screen a logo which looked similar to the CountryLink logo and could see mainly in the top right-hand corner that it appeared to say "country links stink" or something similar and that was "to his memory" at that time and he was unable to clarify the issue further. Mr Ryan was in part uniform and told him he was on standby. Mr Dove left and returned to his duties. Mr Dove was standing just inside the door when he saw Mr Ryan and the computer would have been around two metres away. 145Mr Dove had been in the meal room when he saw Mr Ryan but had not seen Mr Ryan around the Station that evening; he had his meal break around 7:30 pm and remembered this because football was on the television. Around 9:30 pm he was sitting in the meal room and Mr Ryan asked if he could print something in the Travel Centre because the printer was broken in the Onboarders' room. Mr Ryan then went into the Travel Centre and there are no locks between the Travel Centre and the meal room. About 10 minutes later Mr Ryan asked if he could use the photocopier in the Travel Centre Manager's office (Mr Neal). Mr Dove unlocked Mr Neal's office so Mr Ryan could enter, he could not recall if he was carrying any documents. It was Mr Dove's practice to unlock the door to allow the Onboarders' access to the photocopier to copy timesheets and other work-related documents as there was no photocopier elsewhere on the station. The reason the door to the office was locked to his knowledge was because a float had been stolen. He said the door was always locked and had a sign on it to that effect. 146Mr Dove return to the meal room and about 10 minutes later Mr Ryan walked past him carrying a small bundle of blue paper heading back in the direction of the Onboarders' room saying he had finished using the photocopier. Mr Dove then locked Mr Neal's office and did not see Mr Ryan again that evening or return to the Onboarders' room due to the arrival of the train, he attended to his duties, finished his shift at approximately 12 am, set the alarms and left the premises. 147Mr Dove had only seen a copy of the blue paper document stating something about 'burnt toast' when it was shown to him by Mr Macklan on Friday 4 June and he only discussed seeing Mr Ryan in the Station subsequently on 29 June with Mr Macklan and Mr Neal. He had never seen bread coming off the train. 148Before he saw Mr Ryan viewing the website that night he had no knowledge of the CSW and had never accessed it himself from a RailCorp computer. 149Mr Dove added clarification in his statement of 18 November 2010 (to the exact wording of the earlier statement) that between 7.30 pm, when he first saw Mr Ryan, and 9.30 pm, when he saw him with the blue paper heading towards the Onboarders' room, he did not see any other staff member on, or around, the Station during this time. 150In Mr Dove's third statement on 25 February 2011 he gave added detail about his normal routine and what he did on 29 May. He started at 4 pm, carried out duties in the Travel Centre till 5.30 pm then cleaned various areas (emptied bins etc) including the toilets and waiting area. When he did this he would lock the doors to the waiting room, walk through the Travel Centre and luggage room and meal room to get to the cleaning room, which was next to the Onboarders' room, finishing about 6.30 pm, then clean the Travel Centre, luggage room and meal room (another half an hour). During all that time he did not see Mr Ryan or know whether or not he was in the Station. 151He said that after looking at his previous statements he may have had his meal break between 7 and 7.30 before cleaning the toilets that were adjacent to the Onboarders' room. It was when he went to clean those toilets that he heard a noise in the Onboarders' room and saw Mr Ryan at the computer and saw the CountryLink logo. He recalled that to the best of his recollection the time that Mr Ryan asked if he could print something in the Travel Centre was around 9.30 pm but he did not pay particular attention or take a note of times. 152Mr Dove said that no one could have entered the Travel Centre without him seeing them and that Mr Ryan was the only person who entered the Travel Centre that evening. 153In cross examination Mr Dove said that between 7.30 and 9.30 he had pretty much been sitting down in the meal room because he had done his cleaning jobs and unless someone came in the luggage room to ask questions or check luggage, they were basically doing customer service. 154 He had later conceded that as he had been sick the night before he basically stayed in the meal room until 10pm except for when he went to clean the toilets next to the Onboarders' room. 155There was a train at 11.15, and around 10 pm he would go into the Travel Centre and sell tickets then go out on the platform, see the train in and out and that was basically the whole shift. 156He said that in relation to the third statement he had been asked if he could answer some more questions. He did not recall that RailCorp told him what times to put down. Between 7 and 7.30 was when he usually had his meal break. He was the only one there at that time. It was a 20 minute crib but it would start sometime between 7 and 7.30 pm. 157Mr Dove denied that he had made a false statement because it meant he would not be accused of distributing the material and denied distributing the material. 158Mr Dove maintained that no-one could enter the Travel Centre internally without walking through the meal room (the area as shown on the map in evidence.) You had to go through the meal room to get to the luggage room and then to the Travel Centre. There was a locked door leading into Mr Neal's office that one could go through without going through the meal room. He agreed they could get into it if they had a key or it was unlocked. When he had worked it was always locked. People could have come in the coded door leading to the Onboard room without his knowledge but unless they had that key they would have had to come past him to enter the Travel Centre. 159He agreed that someone else could have accessed the Onboarders' room and entered when he was cleaning the toilets and that the cubicles had doors and that he might not hear them but that only took five minutes so it was unlikely, but possible. 160He definitely recalled unlocking the office for Mr Ryan. The keys were in his pocket. Everyone had their own set of keys which they took home and he was not aware of any spare keys kept in the luggage room. 161Mr Dove also provided clarification as to the location of various areas on the map including the meal room, Mr Neal's office, toilets and the access required and confirming his earlier evidence. 162Mr Dove could not recall having a subsequent conversation with Mr Ryan (after 4 June) in which he expressed concerns about conversations he had that might get Mr Ryan in to trouble, that was two years ago. Appellant's Evidence 163The evidence on behalf of the appellant, Mr Ryan, was contained in his statement (Exhibit 5) and he also gave oral evidence. 164In oral evidence he corrected his statement indicating there had been a misrepresentation of facts concerning the typing of documents on 29 May 2010. His statement was formally amended and admitted. 165Mr Ryan stated that after returning to work in 2010 (after the first appeal decision of the TAB) he received two separate notices stating that he was under investigation again over a further two issues, one to do with the way that he filled in time sheets and the other relating to the CSW. He was informed by RailCorp that both investigations had been completed and that they were going to make a decision about them. He was dismissed over the timesheet allegations in December 2010 and at that point in time, he heard nothing further about the CSW. After returning to work in June 2011 (following the second appeal decision of TAB) , RailCorp wrote informing him that they were re-activating the investigation relating to the CSW 166Mr Ryan tried through the RTBU to get more information about what was happening with this investigation and exactly what RailCorp was saying he had done wrong. He had already provided a response to these allegations when they were first raised and they related to his alleged use of a computer over two years ago. 167Mr Ryan stated that because of his previous experience with RailCorp, he was very worried about the way the investigation was to be conducted and felt he was being pursued unfairly. He followed the advice of his Union in relation to responding and providing further information. 168He stated that when RailCorp sacked him at 11pm on 22 December 2011, there were then considerable delays in receiving his final payment and notice pay was withheld. 169Mr Ryan denied accessing the CSW on any RailCorp computer either on 29 May or 18 June 2010. He also denied attempting to post or reply on the CSW on either date. He also denied printing off material from the CSW and distributing it to other staff members on 29 May 2010. On this night he used a RailCorp computer for union business (as he understood he was entitled to do) to type out his resignation as a local Union Delegate at Albury and also to type out a ballot paper to be used for an election for a replacement Union Delegate. He printed these two documents on the RailCorp printer. 170He agreed that he was aware of the CSW and but believed that all staff at Albury, and most CountryLink staff, were aware of that site. 171Mr Ryan stated that on the night of 29 May 2010, he was working a standby shift. In his amended statement and supplemented by his oral evidence in clarification, he said that he had typed three pieces of paper that night, two he did on the family shop computer and one he did on the Travel Centre computer. The two documents typed on the family computer (and annexed to his statement on white paper) were dated 29 May 2010, had Mr Ryan's signature and were titled "ATTENTION ABX RTBU MEMBERS" and "RTBU DEPOT ABX ELECTIONS" and concerned his resignation and the elections for his replacement which were to be held on 14 June 2010. The third document (not annexed) concerned the RTBU State and Federal elections and positions for which he was considering applying. He did not have a copy of that as he did not end up running for those positions and misplaced the document when he had to move house due to the circumstances he was put in. 172His oral evidence was that he went into the Travel Centre and used the computer to type up in Microsoft Word the five positions he was applying for that were relevant to the Albury staff. Then with the two other letters behind it, he went into Mr Neal's office to photocopy the ballots but there was no paper in the photocopier so he spoke to Kevin Dove and asked where he could get paper from and there was only blue and he said "can I use blue?" and Mr Dove said "yeah" and Mr Ryan said ""Well that's good cause that's a union colour". He grabbed about 250 or half a ream (and thought there was 500 in a ream) and threw it on the photocopier. 173He stated that he walked out of the photocopy room and said 'Thanks' to Kevin Dove and then put his resignation in the Union Cabinet and put the blue sheets of ballot paper in his bag. He did not distribute the ballot paper to anyone at that point in time. 174He stated that he did not recall that he required Kevin Dove to unlock any doors. It was the usual practice in Albury that these doors were left unlocked and everyone who could access the building could access these rooms. Further, any number of other people could have entered the Travel Centre on 29 May without Mr Dove seeing them. He had done Mr Dove's job in the past, and it required him to do work on different parts of the Station, and there are a number of entrances to the Travel Centre and it was common for people to come and go. The Travel Centre was not left locked during shifts. He maintained that it would not have been possible for Mr Dove to have kept track of everyone who would enter the premises during a shift. 175He maintained that the first time that he saw the blue CSW material was when it was presented to him at the interview of 8 December 2011. He did not recall receiving it when he received the allegation letter in 2010. He did not distribute that material. 176He stated that he believed RailCorp had restricted their investigation by not even considering all of the different people who would have had access to the computers on 29 May such as the five Sydney crew who would have come in at 1512 that day and left at 1147 the next morning as they worked the train to Melbourne. They would have access to those computers as well but did not seem to have been included in RailCorp's investigation. Other people had access to, or were at the Depot that night, but he was the only person RailCorp had made allegations against. 177He stated that soon after 29 May, he became aware, through comments from other staff, that Mr Macklan had removed material from the pigeon holes about the CSW and that people were saying he was being investigated for it. He already felt that he had been targeted by RailCorp in the past; at this point he knew they were after him for allegedly distributing this material and in these circumstances, would not have access the CSW at work. 178Mr Ryan said that when the date of 18 June was put to him in the interview of 8 December 2011, he stated that he believed he was not even in the State on 18 June 2010. He had made this comment from memory and since learned that he was in the State on 18 June, but left Albury at approximately 4:00 am on that day to work a train to Melbourne. That was why his recollection was that he was not in the state that day. He had not been untruthful in any of my dealings with RailCorp about this issue. 179Mr Ryan said he had not been able to view the footage RailCorp said it had showing that he used the computer to access the site because it showed him using his email. He maintained that staff would often wait in the meal room and use the computer one after the other to view emails before commencing work. The computer was not closed down or logged off between people using it. If he was using the computer looking at his emails someone else might want to use it before they got on a train so he would close whatever he was doing and get up and they would sit down at the computer straight away. This was the only thing that could have happened in this case because he did not view the site at work. 180He indicated that on 18 June 2010 the crew were rostered to leave around 4.00 am and that apart from himself there would have been two Passenger Attendants and a Passenger Services Supervisor waiting to leave on that service. He noted that the Passenger Attendants' roster for this day was not provided as part of RailCorp's investigation. 181He also stated that in relation to the allegation of accessing the CSW he had seen other RailCorp employees at Albury view this site at work, including the Manager, Mr Macklan and Peter Bush. He understood that RailCorp had such an issue with people viewing the site that, after the date of the allegations made against him, staff were sent a memo from Andy Byford, the Chief Operating Officer, warning people against viewing the site at work. This memo was not included as part of RailCorp's investigation documents. He was not aware of anyone else being charged for viewing the site. 182Mr Ryan stated that it had been very been very difficult for him to respond throughout this process. The allegations were first raised in 2010, he was told the investigation was completed and then he was sacked over a different matter. When he came back to work in 2011 RailCorp reopened this old investigation. He knew that his Union tried to get more information about the allegations to help him respond but RailCorp did not provide it all. He even attended a recorded interview which the RTBU usually advised against to try to get further information but RailCorp ended up putting a stop to that because he wanted to be represented by his Union union. The lack of information had made it difficult for him to respond throughout the process and he never got to see most of the evidence RailCorp felt they had against him and never got to respond to it. 183Mr Ryan said he had now been investigated by RailCorp four times since 2009 and each time the outcome was for him to be dismissed. Before 2009, he did not have these problems but since then had spent virtually his entire time either under investigation or dismissed awaiting appeal. This had had a hugely damaging affect on himself, his family, his finances and his health. Each time he had been dismissed and reinstated he had tried to get on with his job. After being returned in 2011 RailCorp did not put any allegations to him concerning anything he had done since returning to work and at no time had anyone ever questioned his performance or professionalism in the way he did his job. 184He stated that it was incredibly difficult to get work in Albury and was not able to get employment that supports himself and his family. He sought to be reinstated to my former position at RailCorp so he could support himself and his family. 185In cross examination Mr Ryan was asked if he had read his statement before he had signed it and he said that he had spoken on the phone to Mr Edghill told him what happened, he had typed it and emailed the statement back to him to be signed and he "perused" it but did not read it completely. He agreed that it was an important matter but said that he had faith in his Union representative. 186Mr Ryan was taken to the original wording of his statement prior to correction and asked if he had read the following: "On this night I used a RailCorp computer for union business as I understand I'm entitled to do. I used the computer to type out my resignation as local union delegate at Albury and also type out a ballot paper to be used in an election to replace me as union delegate". 187He said that he had probably not read those sentences as it was two years after the event. He could not recall the exact conversation he had with Mr Edghill but suggested it was along the lines of what he had explained. He initially said he brought it to Mr Edghill's attention in March when he signed it (15 March) but then said he could not give a date and it was probably early April. 188He denied that he had only decided to change his evidence when he realised that RailCorp had evidence that he had not typed out the resignation and ballot paper using a RailCorp computer. 189Mr Ryan clarified conflicting entries on his timesheet and indicated that on 29 May he was taken off shift (due to be 0357 to 1202) and put on a standby shift went from 1530 to 2306. He detailed the reason for a standby shift and said that Mr Macklan usually left him a list of things to do, did not so on this day. He was not required to spend that time at Albury Station and if he was not required to work he could get go and get his lunch at Dean Street. He was there to cover a train that had already gone. Mr Ryan said as a smoker for 70% of the shift he would have spent it outside. 190He confirmed that the Onboarders' room was his meal room. In response to Mr Dove's evidence about being in there around 7 or 7.30 he couldn't tell, it was two years ago, he was at the Depot. He agreed with Mr Dove's 9.30 time as to using the computer in the Travel Centre. He did not use the Onboarders' room computer to type up the document because another staff member was on it. He went on to say that it was John Emmery. 191Mr Ryan agreed that he asked Mr Dove if he could use the Travel Centre computer as it was Mr Dove's computer. He also printed off the one page document in the Travel Centre. He denied that the reason he did not use the Onboarders' computer and print was because the printer was broken and denied saying that to Mr Dove. 192He denied asking Mr Dove to unlock Mr Neal's office and did not agree with the evidence of witnesses that the door was locked after hours and that the person with the key was the CSA, the person in Mr Dove's role. He agreed that was where the photocopier was but said he entered the office through the luggage room which was often left open. 193He did not dispute that when he had the conversation with Mr Dove about photocopying documents, which he said was about where the paper was because there was no white paper, that conversation could have been in the meal room. Mr Ryan said he did not know where Mr Dove was and it was not his place to know whether he was in the meal room from about 7 to 10 pm that night, he thought he was in the Travel Centre. 194Mr Ryan said he photocopied one copy of the document to go in the display case and 10 or 12 each of the other two documents and agreed that was about 25 sheets of paper. He said he could not speak for what Mr Dove thought was "a small bundle of paper" and said 2 sheets could be a small bundle. He maintained that when he walked out of the office he said "Cheers mate" to Mr Dove, and that he was thanking him for using platform staff facilities, he was not thanking him because he had unlocked the office and it was not correct that he had to let him in by a key. 195He said that after he left the office with the blue papers he went out and had a smoke in the breezeway between the two buildings and spoke to John Emmery, Dave Huxtable and Tim Bishop and that John Emmery and Dave Huxtable were off duty. There were also other people at the Station and that was around 9.30-9.35. He came back in to the Onboarders' room, put his resignation in the Union cabinet and the ballot papers in his bag. He had to walk past his bag to get into the meal room. He denied that he could not have spoken to Mr Bishop before 10 pm. 196He did not mention going out and having a cigarette in his statement because he did not think it was relevant. 197He said that for the rest of his shift he spoke to John Emmery, and his Fiancee who was present, Dave Huxtable and talked to the incoming crew for train 22 to Sydney who sign on at 11 pm. He was not still at the Station when Mr Bush arrived, the train arrived about 11.30 that night. 198He said that when he put the notice in the Union cabinet he did not see blue paper in everyone's pigeon hole but did see a couple of blue sheets on the table but did not look at them. 199Mr Ryan agreed that this was the first time he had given names of people who were there and said he had given previously said how many there were. He didn't name names because he didn't think he had to. 200He also denied that the first time he had raised that he had blue paper that he planned to distribute that night was in his statement of 15 March 2012. He thought he had raised it in the interview of 8 December 2011. 201He maintained that because of his past history with RailCorp he did not wish to discuss anything with them. 202When taken to the 8 December interview transcript he agreed that he was given the opportunity to provide the names of anyone he thought was at the Station at the time and also that he was told that if there was something he could raise that might exculpate him from the allegation it was in his interests to tell investigations so that they could investigate it. He went on to say that "history told me it was not of value to me". 203He had read through the CSW material; agreed that "some of it" was inappropriate; that he had viewed the CSW from a computer elsewhere and first became aware of the site in December 2009/January 2010 when he was received a phone call from a friend who told him there was stuff on the website about his case with RailCorp and how much money he'd lost. He had not looked at the CSW then and could not recall when he first did so. 204He did not tell anyone at RailCorp about the CSW because RailCorp had been discussing it prior to the alleged offences and it was all through CountryLink. 205Mr Ryan said he thought his email account was "daryan" because there was another D Ryan in RailCorp, at CityRail, but agreed that he was the only D Ryan in Albury. He did not agree that if someone accessed a computer in Albury using the login 'dryan' it could be assumed to be him because he had a generic password given to him by Fujitsu. He was taken to the evidence of Mr Corkill concerning the password changes but said he didn't understand why the password was changed and that it didn't say that he rang Fujitsu. He did not know whether he worked on 14 June 2010. 206He agreed that if his password was changed without his knowledge then he would not know what his password was. He said he would have to check with Mr Macklan because he did all that stuff, and that if it was out of hours they had a 1800 number they could ring and if it was in working hours Mr Macklan did it. 207He acknowledged that 22.24.07 or 10.24 pm (the contact with Fujitsu) was not within Mr Macklan's normal working hours but it was within Mr Ryan's normal working hours. He then agreed that if he was having trouble it was likely that he called Fujitsu. 208He still believed his password was 'rail123' or 'railway123' and could not remember whether there were upper/lower case letters and did not even get that. He thought it might have been a capital R and maybe a capital W then a dot point then 123. he was given a generic password on numerous occasions because of the trouble they were having with the computer. In relation to Mr Corkill's evidence concerning resetting a password he thought that it was evident he had some sort of exemption. He did not understand Mr Corkill's evidence that it could not have been either of those two words because they did not fit the complexity required. 209He did not recall checking his email on 18 June 2010 and did not agree that if someone used the 'dryan' account that day it would have to be him. He wasn't saying it wasn't him and it could have been but it was a generic password given to everyone because they had problems with the computers. 210Mr Ryan was also taken through the video footage of the computer use on 18 June. He said that if it was him then he had obviously logged out for someone else to take over the computer and stood up. He couldn't remember who that person was, and couldn't remember using the computer on 18 June. 211Mr Ryan had difficulty reading the various items on the video which was being accessed via Mr Edghill's laptop and unable to be greatly enlarged as a result. 212He denied that he was accessing his email and denied that if he was, then he was also the person who accessed the CSW and attempted to quote. 213He was asked a number of questions about the circumstances of the interview on 8 December but generally maintained the position and interpretation he had put forward in his written statement. 214In response to the cross examination Mr Ryan maintained that he had addressed the issue of using the computer on 29 may in his written response where he said "As secretary of Albury I do have access to electronic equipment as per our award and I utilised the available equipment for union business and to access my emails". That was a reference to the fact that he typed out a document that was related to Union business on that computer. 215He knew Mr Dove did not unlock the door because he had worked there for ten years. He thought Mr Dove was in the Travel Centre but he could have been in the meal room and all he did was as a courtesy tell him he was going to the photocopier, but then he had to go back to him, which on reflection was in the Travel Centre, about paper. It did not involve Mr Dove unlocking the door. 216He was aware of where the keys were because the first disciplinary action against him involved him being taken off the trains for three months and he performed those duties, knew where the keys were, the combination to the safe, and performed those duties and it was standard to leave the doors unlocked. 217He did not reveal any of the names when asked as he did not want to get them into trouble. Before the interview he did not have any information about what RailCorp was holding against him and was aware his representative was trying to get that. He could not recall any issue being raised about his representation at the interview. 218He confirmed that one of the articles in the CSW material was about him (his case and the money lost) and that some of the comments about Mr McLeod were over the top, like the Adolf Hitler comment, but it was no secret that he was the problem for Mr Ryan and went on to say "however, the truth is the truth and if there's stuff put in there that's true I can't dispute that". 219He had never accessed a website that was inappropriate under RailCorp's ICT Policy. Submissions on behalf of the Respondent 220Ms Robinson made oral submissions in addition to the written submissions as filed (Exhibits 1 and 2) and in doing so summarised the relevant evidence before the Board upon which RailCorp relied and also refuted submissions made by the RTBU. 221The Board was referred to the RailCorp Code of Conduct and it was submitted that Mr Ryan had breached that section of the Code under the title '2. Acceptable behaviour and responsibilities' which required that: "RailCorp employees .....comply at all times with the behaviours outlined in this Code of Conduct". He was also required to adhere to the following general principles: ... Always act in the best interests of RailCorp Maintain and promote high levels of acceptable behaviour ... As an employee... you are responsible for the way you behave and your actions. All your decisions must be ethical and comply with legislation, awards, policies, procedures, rules and job requirements. In your work at RailCorp you must: Carry out your duties carefully, safely, honestly, courteously and fairly Be aware of possible conflicts of interest and breaches of the Code and notify a General Manager, other senior manager or the Corruption Prevention Line... as appropriate Use your authority and delegation/s in an appropriate and unbiased way for the intended work related purposes Use RailCorp resources properly, efficiently and economically Treat members of the public and colleagues fairly, consistently and with respect Provide fair, accurate and appropriate advice Report unethical and dishonest and/or corrupt conduct Not knowingly make a false statement If you are a manager or supervisor, you have additional responsibilities. You must: Lead by example Promote the highest standards of professional conduct 222Mr Ryan initially attended a RailCorp Code of Conduct briefing on 3 November 2006, was again briefed on the Code on 17 March 2010 and he therefore had full and specific knowledge of his responsibilities under the Code. 223It was submitted that by accessing websites that contained inappropriate material, by using RailCorp resources to attempt to quote and reply to the material and to print the material, by distributing the material to other employees, and by providing false and misleading information during the course of the investigation, Mr Ryan breached the Code in that he: - failed to carry out his duties honestly, courteously and fairly; failed to notify management of possible conflicts of interest; failed to use his authority and delegation/s in an appropriate and unbiased way for the intended work related purposes; failed to treat colleagues fairly and with respect; failed to use RailCorp resources properly, efficiently and economically; knowingly made a false statement; and did not act in the best interests of RailCorp. 224It was submitted that because Mr Ryan had entered a plea of "not guilty" to all three allegations, it was therefore necessary to establish for the Board the evidence upon which each of the allegations were found by RailCorp to be substantiated. That evidence met the standard of proof required to establish that Mr Ryan was guilty of the allegations as referred to in Briginshaw v Briginshaw & Anor (1938) 60 CLR 336. 225The three allegations against Mr Ryan constituted three categories of breaches of the Code. The first being the access to inappropriate material on the website; the second being the distribution of the material, and the third being misuse of resources. 226The allegations concerned the website www.countrylink.biz (CSW), a website not controlled by, or affiliated with, CountryLink and colloquially called "Country Stink". It was RailCorp's position that the CSW contained derogatory remarks and allegations about management, in particular about General Manager, Greg McLeod, and other senior management, and encouraged staff to publicly complain about the organisation with anonymity. 227Mr Ryan was accused of accessing the CSW from two RailCorp computers at Albury Station, attempting to quote on the site, printing from the site and placing into the Onboarders' pigeon holes an extract from the site, consisting of four "articles" entitled - "'Take this toast and shove it' by Max"; "46 year retired veteran is disgusted with CountryLink management"; "Mail Call", and "Job Satisfaction, Morale and Trust of Management the lowest ever: Report Shows". 228RailCorp rejected RTBU submissions that Mr Ryan's viewing of the CSW was the reason for his dismissal. This was a simplified and misleading submission. The allegations put to Mr Ryan, all of which were substantiated, related not only to viewing the website, but to distributing material from the website and misusing resources by printing from the site and attempting to comment on the content of the site. 229RailCorp submitted that it was appropriate to consider the allegations in terms of the two separate dates upon which the breaches occurred. 230RailCorp summarised the allegations relating to each date and the evidence that established Mr Ryan's conduct and also refuted the evidence advanced on behalf of Mr Ryan. 23129 May 2010 -Allegation 1 (a) Using two RailCorp computers to access and view the website www.countrylink.biz containing inappropriate Material: Mr Ryan was rostered on a standby shift which required him to be at Albury Station and his timesheet indicated that he claimed payment from 3:30pm to 11:06pm. The only access to the CSW on 29 May occurred during that period, one from the Onboarders' room computer from 7:50pm to 8:55pm, and the second from the Travel Centre computer from 9:09pm to 9:21pm. Rosters showed that the only other person at the Station at the relevant time was SCA, Kevin Dove. Mr Dove's evidence was he saw Mr Ryan at the computer in the Onboarders' room during his shift, at some time after he finished his outside duties, estimated to be after 7pm. The ICT evidence shows that the CSW was accessed from the Onboarders' Room computer from 7:50pm to 8:55pm. Importantly, Mr Dove did not see anyone else at the station from approximately 7:30 to 9:30pm. He reluctantly conceded during his evidence that, due to recent sickness, he spent the majority of his shift, from 7pm to 10pm in the meal room, leaving only to clean the toilets across the hall. He confirmed that no-one but Mr Ryan entered the Travel Centre. 232It was submitted that based on this evidence Mr Ryan was the only person present at Albury Station other than Mr Dove and accessed the CSW from both computers on 29 May 2010. 233It was suggested to Mr Dove by the RTBU in cross examination that he was the person who printed the distributed the material from the CSW and was accusing Mr Ryan to cover for himself. However the Board could be satisfied that this is not the case. Mr Dove gave evidence that he was not aware of the CSW until 29 May, never accessed it from a RailCorp computer, was an employee of only 3 months standing at the time, and had no interest in issues covered in the material such as 'bread on board' as he was a Station staff member, not Onboard staff. It was also notable that no motive was suggested to Mr Dove as to why he would access and distribute material from the CSW. 234It was also suggested that Mr Dove changed his evidence in the course of the investigation. This was not true and rejected by RailCorp. The first and second statements given by Mr Dove (which were identical with the exception of a paragraph added in statement 2) were not set out chronologically. While he referred to seeing Mr Ryan at the Onboarders' computer (paragraph 3), and then mentioned his meal break (paragraph 7), there was no suggestion that this indicated the sequence of events. The sequence of events was set out by way of clarification in his third statement, which confirmed that he saw Mr Ryan after his meal break (approximately 7-7:30) when he went to clean the toilets. This correlated with the ICT evidence that the CSW was accessed at 7:50pm. Mr Dove stated the times as approximate, and it was reasonable that someone would be unable to be exact about his movements during an unremarkable shift when asked about them weeks later. It was submitted that Mr Dove's evidence was credible and consistent, and could be relied upon as accurate by the Board. 23529 May 2010 - Allegation 3 (a) Using a RailCorp computer (source IP address: 10.20.24.6) to attempt to quote and reply to inappropriate Material posted on the web based forum www.countrylink.biz: This allegation refered to the computer in the Onboarders' room. Mr Corkill's evidence, (a Web Address Report) showed the screens that would have been visible to the person using the computer at the relevant time and showed that an attempt was made to quote and reply to content on the CSW. As Mr Ryan was identified as the person who accessed the computer in the Onboarders' room, it followed that he was also the person who attempted to quote and reply to the content on the website. The RTBU's submission that there was no evidence regarding the quote on the CSW was rejcetd. It had never been RailCorp's submission that there was a quote put on the CSW on 29 May 2010. The allegation said an attempt to quote and the evidence of Mr Wood explained that. 23629 May 2010 - Allegation 3(c) Using a RailCorp printer to print the Material contained on the web address www.countrylink.biz and considered inappropriate as per the Particulars of Allegation 1 and/or 2: Mr Dove said that at about 9:30pm Mr Ryan asked if he could print something in the Travel Centre as the printer in the Onboarders' room was broken. Mr Dove witnessed Mr Ryan enter the Travel Centre to use the printer, and saw him later leave the Travel Centre in possession of blue paper and walk towards the Onboarders' Room. ICT evidence was that the CSW was accessed from the Travel Centre computer 9:09pm to 9:20pm. Mr Dove was then approached by Mr Ryan who asked for access to the photocopier in Mr Neal's office, which Mr Dove unlocked for him. He gave evidence that 10 mins later he saw Mr Ryan with a small bundle of blue paper walk from the office in the direction of the Onboarders' room. Blue paper, on which was printed the inappropriate material from the website, was found by Tim Bishop and Peter Bush at 10pm and 11pm respectively. Mr Macklan identified that there was blue paper available in the Travel Centre Manager's office. 237It was submitted that the logical conclusion to be drawn was that Mr Ryan used the printer in the Travel Centre, printed material on blue paper from the Travel Centre Manager's office, and then took that blue paper into the Onboarders' room. 23829 May 2010 -Allegation 2 Distribution of inappropriate Material from the website www.countrylink.biz to members of the Albury CountryLink office. The evidence placed Mr Ryan in the On-boarder's Room in possession of blue paper upon which he had printed material after accessing the CSW in the Travel Centre. 239It was submitted that this evidence, supported by the evidence of the Onboard staff who arrived at Albury Station at approximately 11pm to find blue paper printed with extracts of the website in their pigeon holes, was sufficient to establish that Mr Ryan was guilty of distributing the material from the website. 240It was also submitted that Mr Ryan's version of events had changed throughout the investigation, disciplinary and appeal processes, which could be summarised as follows: Mr Ryan's initial response was that he utilised the available computer equipment for union business and to access his emails. He was aware of the specific allegation that on 29 May he accessed the CSW, printed from it, and distributed this printing to colleagues. In the disciplinary interview (8 December 2011) no further information was given about his actions on 29 May. He was dismissed, lodged his appeal, and on 10 February 2012, received RailCorp's Written Case and documents, containing the statement of Kevin Dove, not previously seen, and learnt Mr Dove recalled allowing him access to the photocopier in Mr Neal's office, then seeing him with blue paper go from the office to the Onboarders' room. In his written statement (5 March 2012) Mr Ryan told a specific story for the first time - that on 29 May he used the Albury Station computer (but did not say which one) to type out his resignation as local Union Delegate, a ballot paper to be used for an election to replace him as Union Delegate and that he printed these two documents on the RailCorp printer, photocopied the ballots on blue paper and took then to the Union Cabinet located in the Onboarders' room. This explanation, if true, should logically and easily have been raised when the allegations were first put to him. In response to this new story, RailCorp produced evidence from Mr Wood (served on Mr Ryan on 2 April 2012) casting significant doubt on its accuracy - that forensic examination showed that no-one created a new document on the Onboarders' computer on 29 May 2010. The only word document that was opened at the relevant time, and by the person responsible for accessing the CSW website, was a RailCorp policy document titled "Corruption and Fraud Lessons.doc". Mr Ryan's evidence before the Board then changed and he said he didn't create the resignation and ballot on the Albury Station computer, blamed the RTBU for the error in his statement, claimed he did not read it before he signed, despite its importance to his job and its seriousness. He then said there were three documents; he created two on his family computer and one on the Travel Centre computer (a computer RailCorp did not have forensically examined), and asked the Board to accept this convenient explanation, despite it being the first time it was put forward, and despite it contradicting his first statement. 241It was submitted that the Board should not place any weight on this new and clearly fabricated story, but should instead view it as evidence that Mr Ryan had been untruthful in the course of the investigation, and was also prepared to be untruthful to the Board. 242It was also submitted that it was during the hearing that for the first time Mr Ryan also offered the names of other persons he claimed were at Albury Station on 29 May 2010, despite them being off duty. This was an example of Mr Ryan's attitude to the disciplinary investigation process - withholding information until it suited him to reveal it, and at a time that was too late for RailCorp to further investigate it. 243RailCorp pointed out that one of the persons he named, Tim Bishop, was a witness in the hearing, but was not asked in evidence whether he saw the other persons named - Dave Huxtable and John Emmery. The question was not asked by RailCorp because at the time Mr Bishop gave evidence Mr Ryan was withholding the names, despite being asked specifically to name them in the disciplinary interview on 8 December 2011. It was a matter for the Board to ask why the question was not asked of Mr Bishop in cross examination either. 244It was submitted that Mr Ryan in his statement referred to other persons who may have been at Albury Station on 29 May 2010, the five crew members from Sydney who arrived at 1512 and left at 1147 the following morning. He claimed that these persons would have had access to the relevant computers. It is submitted that it was not necessary for the whereabouts of these crew members to be investigated, as Mr Dove gave evidence that he did not see anyone else in the Travel Centre at Albury Station at the relevant time (7:30pm to 9:30pm). 245However, for the sake of thoroughness and in response to Mr Ryan's claims, RailCorp questioned and obtained a statement from Senior Passenger Attendant David Engle, a member of the Sydney crew on 29 May 2010. It was his evidence that, in general, the Sydney staff were not familiar with the layout of Albury Station, nor the location of the computer in question. He also noted that it was not usual practice for Sydney staff to be at Albury Station outside arrival and departure times. He recalled specifically that the majority of the Sydney crew were out for dinner on the night in question. 246It was submitted that the evidence of Mr Engle, while not necessary to supplement the evidence that Mr Ryan was guilty of the allegations relating to 29 May 2010, effectively refuted his claim that Sydney crew could have been responsible for accessing the website, printing the blue paper and distributing it. Mr Ryan's attempt to throw suspicion on the Sydney crew therefore came to nothing. 247RailCorp submitted that it was assumed that the case for Mr Ryan was the possibility that someone off-duty entered Albury Station, accessed the CSW on both the Onboarders' computer and the Travel Centre computer, printed the extracts on blue paper and then entered the Onboarders' room to distribute them in pigeon holes. This scenario was unlikely when the floorplan of Albury Station was considered. The evidence of Mr Bishop, Mr Bush, Mr Macklan and Mr Engle was that there is a door from the meal room to the Luggage Room, from the Luggage Room to the Travel Centre, and that someone who moved internally from the Travel Centre to the Onboarders' room would have to walk through the meal room. There was also consensus that the door to Mr Neal's office was habitually locked, and that the photocopier and the source of the blue paper were in that office. It therefore followed that, as Mr Dove was in the meal room from 7 to 10, he saw Mr Ryan go into and leave the Travel Centre, he unlocked Mr Neal's office at Mr Ryan's request, and he saw him then walk towards the Onboarders' room with his bundle of blue paper. 248It was also submitted that the floor plan and witnesses' evidence also supported a hypothesis which might be raised by Mr Ryan, that someone could have entered the Travel Centre from the external Luggage Room door, unseen by Mr Dove, accessed the CSW in the Travel Centre, exited the same way and re-entered the building near the Onboarders' room to distribute the inappropriate material. Indeed, this would seem a logical route for someone off-duty who did not wish to be seen. However, this hypothesis did not account for the access to the CSW from the Onboarders' computer earlier in the evening, nor did it explain how this mythical off-duty person gained access to Mr Neal's locked office to print the blue paper without being seen or asking Mr Dove for the key. As an alternative theory it was flawed. In fact the evidence only supported RailCorp's conclusion that Mr Ryan was guilty of these actions. 249It was submitted that any alternative theory presented by Mr Ryan would require asking the Board to accept the unlikely scenario that someone off- duty came into the station, accessed the CSW and distributed the material printed on blue paper, on the very same night and at the same time as Mr Ryan was seen by Mr Dove to use both computers, access the photocopier and to be in possession of a bundle of blue paper. This was clearly too far fetched and unlikely a coincidence, and unsupported by any evidence, for the Board to contemplate. 250It was submitted that the Board could be satisfied that Mr Ryan's claim to have used the computer at Albury Station on 29 May 2010 to type out the resignation and ballot paper was false and unsupported by the forensic evidence. In addition, the evidence of Mr Macklan was that he did not receive notification of Mr Ryan's resignation as Union Delegate, nor did he see such resignation in the Union cabinet and he never received notification of a ballot paper on blue paper. 251It was submitted that Mr Ryan's story about typing, printing and photocopying union related documents at Albury Station on 29 May 2010 was clearly false and fabricated when he became aware that he had been seen with blue paper by Mr Dove. It was not known when or where he created the resignation and ballot paper attached to his statement, but it was submitted that the Board could be satisfied that they were not created at Albury Station on 29 May 2010. 25218 June 2010 - Allegation 1(b): Using a RailCorp computer to access and view the website www.countrylink.biz containing inappropriate Material: The only access to the CSW on 18 June occurred on the Onboarders' computer from 3:41am to 3:43am. The computer was being monitored by Mr Corkill at the time, and video footage showed that the Webmail account for 'dryan' was accessed at 3:40am, immediately followed by the CSW at 3:41am. As Mr Ryan denied that he was "in the state" on 18 June 2010, further investigation was undertaken. The evidence showed that on that date he was rostered to work the ST21/24 train, due to leave Albury Station at 4:12am. His timesheet indicated that he claimed payment from 3:57am. Mr Ryan also claimed that he did not have a secure password for his account, that he alternated between two passwords and that everyone at Albury knew his passwords. This was contradicted by the evidence of Mr Corkill, that Mr Ryan changed his password on 14 June, and rosters showed him to have been away from Albury Station from then until 18 June, limiting the possibility that everyone at Albury could be aware of his password. 253It was submitted that the video footage showing 'dryan' checking his emails then immediately accessing the CSW was conclusive evidence that Mr Ryan was guilty of allegation 1(b). 254RailCorp also pointed out that after the 'dryan' account was closed, and the user then went back to the CSW link, the user opened it and made an attempt to quote, a fact which was overlooked by the Investigator when formulating the allegations. It was also RailCorp's case that, based on the cursor activity and the sequence of actions, the user was one individual, the owner of the 'dryan' account, Mr Ryan. 255RailCorp rejected as illogical and false the attempted criticism of the RTBU of the investigation methods, and the value of the video footage evidence; the claim that it did not establish that the person who checked Mr Ryan's email was the same person who immediately checked the CSW, and that the use of such evidence by RailCorp was questionable under the Workplace Surveillance Act 2005. 256RailCorp also refuted the RTBU's claims that it was conducting inappropriate surveillance of Mr Ryan using the computer. The video footage was taken from inside the computer, not from external surveillance, and as such was classified as audit of the computer, expressly allowed under RailCorp's ICT Services Access and Usage Procedure, as acknowledged by the RTBU. Employees were also reminded of the conditions of their use of RailCorp computers each time they logged in, with the security message which included the warning "Your use of this computer, email and Internet facilities is subject to continuous and ongoing surveillance by interception and monitoring of your activity." It was not feasible for the RTBU to argue that the video footage was in any way outside the allowable audit, interception and monitoring of RailCorp computers, of which employees are well informed. 257The video footage showed use of the computer to commence at 1:37:25. At 1:39 the username 'dryan' was entered along with a 10 character password. At 1:40:12 an email was opened and then closed at 1:40:45. There was then continuous movement of the cursor (and therefore the mouse) to open the CSW. It was submitted that this was conclusive evidence that the same person who opened the email in the account "dryan" was the same person who opened the website. In his statement Mr Ryan noted that he had not yet viewed the footage, yet it was provided to him by way of service on 9 February 2012. He also claimed that: "If I am using the computer looking at my emails someone else might want to use it before they get on a train so I would close whatever I am doing and get up and they would sit down at the computer straight away." 258It was submitted that this scenario did not explain the continuous movement of the cursor, and could be discounted as an explanation of the video footage on 18 June 2010. It was also difficult to imagine that a staff member would be so desperate to view the CSW before boarding a train that they would require Mr Ryan to vacate his computer in a hurry. It was also evident from the pace at which the mouse was used that the person viewing the website was not in a hurry and notable that the pace of the cursor and the apparent level of computer skill did not vary between the person viewing emails and the person viewing the CSW. 259It was submitted that the Board could be satisfied that the person who used the 'dryan' username and password was the same person who immediately viewed the CSW, and that that person was Mr Ryan. 260RailCorp acknowledged that it had been conceded in cross examination by Mr Woods and Mr Corkill that there was a 4 second delay between the user closing the 'dryan' email account and moving to the CSW. It was suggested that this may have provided time for 'dryan' to get up from the computer and another user to sit down and assume control of the mouse. This seemed an unlikely scenario when it was taken into account that all the alleged "second user" did was view the CSW, attempt to quote on an article, appear to change his/her mind, then exit the site 3 minutes later. This did not seem like the activity of a user so eager to access the site that he/she assumed control of the mouse a mere 4 seconds after 'dryan' closed his email, which would most likely require 'dryan' to vacate his seat very quickly and the second user to lean over him to grab the mouse. 261It was submitted that the 4 second delay was more likely accounted for by noting that the email account was closing down for the 4 seconds, and that when it closed the cursor then moved to open the CSW - the 4 seconds was an ordinary pause in the activity of one user, one user who hovered the cursor over the CSW before checking his email as well. It was submitted that his use of the 'dryan' email account shows that that user was Mr Ryan. 262RailCorp referred to the claims by Mr Ryan that others knew his email password, and that it was not secure and submitted that this is refuted by the evidence of Mr Corkill. All RailCorp staff have a secure password for email, and the evidence showed that Mr Ryan's was changed by Fujitsu on 14 June 2010. Even if Mr Ryan's evidence that it was changed to a generic password (such as Railway123) was accepted, the Board would also have to accept that somehow other Albury Staff knew that this change had taken place, knew the generic password and gained this knowledge (which could only have come from Mr Ryan) between 14 and 18 June, when the evidence showed Mr Ryan was not at Albury Station. Again, this was an unlikely scenario, speculative and unsupported by any evidence. The most logical conclusion, supported by the evidence, was that Mr Ryan accessed the CSW on 18 June 2010. 263RailCorp acknowledged that RTBU claims that other RailCorp employees viewed the CSW were, quite rightly, correct. The Board was referred to the third statement of Mr Wood where he explained the basis of the decision made by RailCorp management that such viewing was for the purpose of identifying persons attempting to access the CSW to enable investigative action to be taken with subsequent analysis showing that the only attempts to post information on the site occurred via the Albury Onboarders' room computer. Mr Ryan's action of attempting to comment on the content of the CSW was a deciding factor that resulted in disciplinary action being taken against him. 264RailCorp rejected the queries raised the RTBU as to whether the material accessed, printed and distributed, was in fact inappropriate, and the claim that it would not be automatically obvious to an employee that RailCorp would consider the website inappropriate. In doing so, reliance was placed on the evidence of Mr Wood who set out the specific material deemed inappropriate. Further, Tim Bishop, Peter Bush and Jim Macklan all gave evidence that they independently formed a view that the content of the site was inappropriate. Only Mr Ryan considered it not inappropriate to use the term "Hitler" to describe a RailCorp Manager. In fact, Mr Ryan only found the site inappropriate in that he suspected parts of it referred to him. 265It was submitted that a reasonable person, and reasonable employees such as Tim Bishop, Peter Bush and Jim Macklan, could easily identify the phrases they considered to be inappropriate. RailCorp also reminded the Board of the decision in of Deuter v RailCorp [2012] NSWTAB 11 concerning use of the reference to "Hitler". 266The references to "Hitler" were only part of the inappropriate content of the CSW. The CSW contained material that was potentially damaging to a person's character, derogatory, alleged corruption, and was intended to incite malcontent, and dissatisfaction amongst employees. A small sample, taken from the material distributed by Mr Ryan, illustrated this point: Management are really saying "We don't trust you" This country started with a bunch of convicts deported from England for pinching bread. Don't get caught, management may send you back. ...CountryLink management is a disgrace. They are incompetent, mean, corrupt, unable to tell the truth and could not care about the personnel that they employ. Adolf Hitler was a nobody compared to this senior manager. Clearly McLeod has to change his ways or do the right thing by CountryLink and resign. He is like a bloody Hitler. 267It was submitted that there could be no question in the Board's mind that the CSW not only contained inappropriate material, but that the fact that material was inappropriate was obvious to the reader. 268RailCorp also submitted that it was concerning that the RTBU failed to identify these inflammatory and derogatory remarks and the CSW material as being inappropriate. 269Further, the intent of the website, and also the intent of Mr Ryan in distributing the material, must also be considered. He had deliberately provided his fellow employees with material that claimed the General Manager of their Division was corrupt and worse than Adolf Hitler, and this was intended to instil in them fear regarding the security of their employment based on the assumption that management did not trust or care about the personnel. His actions could only have been motivated by an intention to encourage malcontent, dissatisfaction and fear among his colleagues and consequently to cause problems between his colleagues and CountryLink Management. This was clearly a breach of the Code of Conduct and it could not be in the best interests of RailCorp for an employee to deliberately encourage discord amongst employees and between management and staff. 270It had been suggested by the RTBU, in support of Mr Ryan, that RailCorp's memo to staff on 20 October 2010 was issued a long time after RailCorp became aware of the CSW and that this should in some way pardon anyone who accessed the site in the meantime. The Board was reminded of Mr Wood's evidence that the decision not to close the CSw down was made in an effort to determine who was responsible for it, and also that those who accessed the CSW out of curiosity, and did not attempt to quote or take any further action on the CSW, were not investigated or disciplined. It is submitted that the 20 October memo was by way of formalising that the CSW was not to be accessed on RailCorp computers. However it was clear to those who had accessed the CSW that it was inappropriate and should not be accessed long before the memo was issued. 271RailCorp also dealt with the suggestion by Mr Ryan that it was not him but another employee, John Emmery, who was guilty of the allegations. Mr Emmery had been named as a scapegoat for Mr Ryan, but it was significant that he was not named by Mr Ryan until the very end of the hearing. He was not on duty on 29 May 2010, and no-one else gave any evidence of having seen him at the station. Mr Ryan must have known that he intended to accuse Mr Emmery, yet no summons was issued to compel Mr Emmery's attendance at the hearing, and he was not named by Mr Ryan at any stage of the disciplinary process. It was submitted that the Board did not have sufficient evidence before it to consider Mr Emmery as an alternative culprit. 272RailCorp rejected the RTBU's submissions that the allegations against Mr Ryan had been substantiated on the basis of "indirect or circumstantial" evidence. RailCorp's detailed written submissions set out the evidence that substantiated each of the three allegations. There was direct eye witness evidence from Mr Dove relating to 29 May 2010, and as well as direct evidence from the video footage shows relating to 18 June 2010. This evidence alone was conclusive to establish that Mr Ryan was guilty of the allegations. 273The Board was also referred to the decision of the Board (McDonald C) in Jarman v RailCorp [2011] NSWTAB 18 in which there was circumstantial evidence placing the appellant in the right place at the right time and including some handwriting analysis information. In the case of Mr Ryan that he was seen with blue paper and was in the right place at the right time was stronger on the balance of probabilities of being the person who accessed the website, printed and distributed the material. Mr Dove could be relied on as direct evidence of Mr Ryan being in possession of the blue paper, accessing the website and using the printer. 274It was also submitted that the Board should disregard the RTBU's submissions on procedural fairness. RailCorp's Discipline Procedure was complied with, it was procedure agreed in consultation with the Unions and followed in every disciplinary investigation. The only exception made was the offer of an additional interview to Mr Ryan. Mr Ryan was afforded procedural fairness in the same manner, and to a greater extent, as any other RailCorp employee under investigation. 275It was submitted that the investigation was undertaken in a thorough manner and evidence was also obtained relating to the time that the inappropriate material was found by staff, as well as the layout of Albury Station. When Mr Ryan attended an interview and raised queries about the security of his password and his whereabouts on 18 June 2010, further investigation was carried out to explore his claims. 276It was also submitted that the interview on 8 December ended because Mr Edghill had to be elsewhere. It was not appropriate to speculate as to whether or not the adverse material relating to 18 June would have been 277RailCorp rejected the submission that when Mr Ryan first responded to the allegation he didn't raise being in possession of blue paper because he didn't know about it at the time. He knew about it because he had received a copy in the allegation letter. The first time he was told about the allegations he was provided with the material it was alleged he distributed. While there was dispute during the investigation Mr Wood's evidence established that it was provided. Mr Ryan had not changed his denials since seeing the adverse material and it was submitted that it would have had no impact on the outcome in any event. 278RailCorp also rejected the inferences made by the RTBU that RailCorp obtained evidence with the intention of establishing Mr Ryan's guilt. This proposition was unsupportable when the chronology of the investigation as set out in the third statement of Mr Wood was considered. The investigation into Mr Ryan commenced on 4 June 2010 and only after Mr Dove identified him as the person he saw at the computer and with blue paper. It was further focussed on Mr Ryan on 18 June 2010, when the video footage was obtained that showed 'dryan' to access email, then immediately access the website. It was not until 25 June 2010 that the investigation was specifically of Mr Ryan. Prior to this a general investigation took place, and continued independently of the investigation of Mr Ryan into the owner of the CSW. 279RailCorp submitted that the penalty of dismissal was the appropriate response to Mr Ryan's conduct, not only to his actions in accessing, printing and distributing inappropriate material, but was also rendered necessary in response to his consistent denial of the allegations. Further, Mr Ryan had been untruthful to RailCorp in the course of the investigation, by claiming that he had not accessed the CSW from a RailCorp computer, that he had no knowledge of the printing and distribution of the extracts from the website, that he was not present at Albury Station on 18 June 2010 and that his password was not secure but known to everyone at Albury Station. 280It was submitted that Mr Ryan's failure to be honest to RailCorp in the course of the investigation was an example of his general attitude toward RailCorp management, as manifested in a pattern of behaviour that he had exhibited over a period of time. This behaviour had resulted in two previous instances of dismissal, and a further matter referred for investigation that had been placed in abeyance due to his dismissal, but that will be reactivated should Mr Ryan be reinstated. 281It was submitted that the Board was entitled to consider these matters arising from Mr Ryan's attitude and pattern of behaviour towards RailCorp management with respect to the appropriateness of the penalty of dismissal. It was open to the Board to consider points raised in mitigation of penalty by Mr Ryan. It would also be appropriate in this matter, given his previous history before the Board and the outstanding matters referred to above, for the Board to consider points raised in mitigation of reinstatement by RailCorp. 282RailCorp referred the Board to the provisions of s.17 of the TAB Act concerning the powers of the Board in disciplinary appeals. 283The Board was also referred to the decisions concerning the two previous dismissals by RailCorp of Mr Ryan which resulted in his reinstatement by the TAB on both occasions. In both instances, he was found guilty of aspects of the allegations against him and issued a penalty of suspension without pay for three months and regression to the role of Senior Passenger Attendant on the first occasion, and suspension without pay for one week on the second occasion. 284It was submitted that with respect to the first dismissal, Ryan and RailCorp TD 443/09 (1 April 2010) the then Vice-Chairman of the Board, Mr Thompson, made the finding that Mr Ryan had "not observed or followed RailCorp's instructions particularly in respect of time records to the extent RailCorp is entitled to expect of an officer holding a supervisory position." He also found that "In his position as a Passenger Services Supervisor the appellant did not meet his obligations to lead by example". 285It was submitted that the finding of the Board was evidence that Mr Ryan failed in his obligations in such a way that subverted RailCorp management's expectations of an employee at his level of responsibility, demonstrated a consistent belligerent attitude towards RailCorp and accordingly cannot be conduct that is in the best interests of RailCorp. This was compounded by the circumstances that led to Mr Ryan's second dismissal, also relating to his failure to properly complete his timesheets. 286In Ryan v RailCorp [2011] NSWTAB 10 Acting Commissioner Oakman found that Mr Ryan had not shown accurate records of work performed on specific dates when his timesheet entries suggest that he was on certain trains that he was not. Acting Commissioner Oakman noted that he had repeated his error on a later timesheet Mr Macklan asked him to resubmit, after also telling him to see Mr Macklan if he had any questions about what to claim. A finding was made that Mr Ryan's evidence was coloured by his view that there was a campaign of harassment and bullying against him by Mr McLeod and Mr Macklan. Acting Commissioner Oakman found his evidence with respect to Mr Macklan to be "somewhat coloured and therefore prone to reconstruction" and despite Mr Ryan raising in his defence that there was a campaign of bullying and harassment against him by RailCorp management, no such finding was made. 287It was submitted that this was further evidence of Mr Ryan's attitude towards RailCorp management, which had again been raised by the RTBU in the current appeal. The RTBU claimed that "...a substantial number of false or petty allegations have been levelled against Mr Ryan over the last two years by local managers who have taken a strong dislike to Mr Ryan, such as Mr Macklin (sic)." This is raised by the RTBU to allege that he had been unfairly targeted and punished in a way that other employees had. 288It was submitted that the RTBU's allegations were refuted by the findings of the Board in both previous matters. Mr Ryan was found guilty of breaches of the Code and was issued with disciplinary penalties accordingly. Acting Commissioner Oakman found that Mr Macklan was not targeting Mr Ryan, but that Mr Ryan's evidence was coloured and reconstructed as a result of his view of Mr Macklan. This was further evidence of Mr Ryan's attitude towards RailCorp management. 289It was also submitted that relevant to any consideration of reinstatement was the fact that recent complaints have been made against Mr Ryan relating to instances of bullying and harassment, failing to maintain and promote high levels of acceptable behaviour and failing to treat colleagues fairly, consistently and with respect. While allegations had not yet been put to him due to his dismissal, RailCorp would be obligated, under its duty of care to other employees, to proceed with the investigation immediately should he be reinstated. The nature and seriousness of the allegations might also deem it appropriate that he be suspended from the workplace while the investigation was conducted. As the allegations have not yet been put to Mr Ryan, it was not suggested that the Board place any weight on this information with respect to the current dismissal. However, the Board was being made aware of the pending investigation as yet another factor relevant in any consideration of reinstatement. 290RailCorp acknowledged that the RTBU took issue with this submission and claimed that by making this disclosure, RailCorp was only seeking to paint Mr Ryan in a bad light. This was a misrepresentation of RailCorp's intentions. The pending investigation was disclosed as a courtesy to the Board and to Mr Ryan so that consideration coul be given to the matter as a relevant concern with respect to reinstatement. RailCorp could not ignore or fail to investigate the complaints simply because time had passed with Mr Ryan's dismissal. In the event that he was reinstated as a result of this appeal, RailCorp would be bound by its duty of care to its employees to investigate the complaints. It was only fair that Mr Ryan and the Board had been made aware of this fact. 291RailCorp submitted that dismissal of Mr Ryan was the appropriate response to his breaches of the Code. His intention in accessing, printing and distributing inappropriate material could only have been to cause issues between his fellow employees and RailCorp management, which brought into relevance his own attitude and history with RailCorp management, including his two previous dismissals, his failure to repay money owed and the pending investigation that must be completed should he be reinstated. It was submitted that all of these factors combined to render it untenable to return Mr Ryan to employment with RailCorp. Further, the penalty of dismissal is not only appropriate but necessary under these circumstances. 292It was also submitted that the allegations related to misuse of resources and accessing inappropriate material, which were serous allegations in and of themselves, but the motivation for distributing the material, the intention to incite dissatisfaction among staff and air defamatory statements about RailCorp management, must also be considered. Mr Ryan's actions had caused a loss of trust and confidence between himself and RailCorp. 293RailCorp rejected the RTBU's claim that the penalty of dismissal was too harsh in all the circumstances on the basis that others, including Mr Macklan and Mr Bush, also viewed the website and were not investigated or disciplined. RailCorp also rejected the claim that it had to go to "great length to stop employees in great numbers from visiting the site at work". This was unsupported by evidence. It was also false information that RailCorp spent $1 million in a seven month attempt to shut the CSW down (SMH article). Mr Wood's evidence confirmed that less than $15,000 was spent on the investigation into the owner of the CSW. 294RailCorp also submitted, in response to RTBU submissions, that it was not the case that Mr Ryan was being held responsible for actions that "employees in great numbers" also engaged in, and that the efforts by RailCorp to prevent this occurring were of great magnitude and expense. The Board was also reminded that the penalty of dismissal was not only for viewing the inappropriate content, but for printing, distributing and attempting to comment on it. 295RailCorp submitted that it was not a relevant consideration, as suggested by the RTBU, to consider what damage, if any, was done by the Mr Ryan's actions. The Code of Conduct existed to set a standard of behaviour that, when complied with, avoided damage. To breach the Code, and the standard of behaviour, rightly attracted disciplinary penalty. "Damage" was not a prerequisite of a breach, with the example given of RailCorp's random drug and alcohol testing to detect breaches of the Code in the form of a risk to safety, before damage occurred. It was not relevant whether his conduct caused damage, but whether it had the potential to cause damage, and whether it was in breach of the standard of behaviour required by the Code and it was RailCorp's position that it was. 296RailCorp also rejected the RTBU submissions that consideration should be given to the timing of the investigation into this breach, and claims Mr Ryan was disadvantaged because he was dismissed in between being given the allegations and the completion of the investigation, thereby delaying the matter until he was returned to employment with RailCorp by the Board. It was ludicrous to suggest that RailCorp should have done anything other than reopen the investigation upon his return to work. RailCorp has an obligation and duty of care to staff to investigate alleged breaches of the Code, and could not neglect this duty simply because the person being investigated happened to be dismissed for another matter in the meantime. It was appropriate that the investigation be reopened and completed upon Mr Ryan's return to work. 297In conclusion it was submitted that in all of the circumstances the Board should not alter the decision of RailCorp to dismiss Mr Ryan and his appeal should be disallowed. Submissions on behalf of the Appellant 298Mr Edghill made oral submissions in addition to the written submissions as filed (Exhibit 3) and in doing so summarised the evidence relied on by Mr Ryan and refuted the evidence and submissions of RailCorp. 299It was submitted that Mr Ryan's appeal should be allowed and the dismissal set aside on the following basis: i.The allegations were not substantiated by the evidence available; ii.The allegations, if substantiated, would not be serious enough to warrant dismissal and dismissal was too harsh; iii.Mr Ryan was not afforded adequate procedural fairness throughout RailCorp's conduct of this matter; iv.The evidence showed that RailCorp had unfairly pursued Mr Ryan. 300It was submitted that RailCorp bore the burden of demonstrating that the allegations against Mr Ryan were substantiated and had gone to great lengths in their attempts to achieve this. The result was a great deal of circumstantial evidence, the weight of which was meant to lead the Board to the conclusion that Mr Ryan was guilty. The RTBU submitted that, in a case with a history and characteristics such as this one, substantiation of the allegations should not be found on a basis of indirect or circumstantial evidence - there must be real, direct evidence demonstrating that Mr Ryan, and not another person, accessed the allegedly inappropriate material on the two dates in question. 301In considering the evidence before it, the Board's attention to the comments of Dixon J at paragraph 16 in Briginshaw v Briginshaw 302In accordance with Briginshaw, while it was submitted the allegations against Mr Ryan were in actual fact not serious in that it was disputed that the material was obviously or automatically inappropriate, or of such a nature that its viewing at work warranted dismissal, the fact that it had been found that RailCorp had already wrongfully dismissed Mr Ryan on two occasions since 2009 only to automatically take steps to dismiss him again after his latest reinstatement, and the gravity of the consequences for Mr Ryan of the allegations leading to his third dismissal in a period of barely more than two years, were considerations that the Board must have in mind when considering the evidence. In these circumstances, substantiation of the allegations should not be based on "inexact proofs, indefinite testimony or indirect references" as referred to by Dixon J. 303It was submitted that all RailCorp had provided in their case was the following: inexact proofs of who was using their computers at the times the CSW was accessed; indefinite testimony such as that of Mr Dove about what he saw, when he saw it and who else could have been present at the time; and indirect references to Mr Ryan being guilty because it could not be proved that it was not someone else who accessed the CSW or distributed the material. 304The RTBU submitted that it was also relevant to note that the scenario that RailCorp must establish in order to demonstrate that this dismissal was fair, equitable and not harsh, was itself inherently unlikely. For the dismissal to not be harsh, it must be proportionate to punishments handed out to others who had committed the same alleged misconduct. The RTBU was aware of no one else being charged or disciplined for viewing this site. On that basis, the Board might infer that the viewing of the site was an unusual occurrence, but the evidence showed that it was likely that a large number of RailCorp employees have viewed the site at work and that RailCorp knew this. This was a further factor the Board must have in mind when considering the evidence that it was Mr Ryan, and not any other person, who viewed the website at the relevant times. 305It was submitted that a proper examination of the evidence showed that not one RailCorp witness could give reliable evidence that they saw Mr Ryan access the allegedly inappropriate CSw on a RailCorp computer on either of the dates in question (allegation 1). It also showed that no RailCorp witness could give reliable evidence to say that they saw Mr Ryan print any inappropriate material, photocopy any inappropriate material, distribute any inappropriate material, or have any inappropriate material in his possession (allegations 2 and 3). 306RailCorp sought to rely on computer records to demonstrate that computers at Albury Depot accessed the CSW on 29 May 2010. However, there was nothing in this evidence that showed that it was Mr Ryan using these computers when the site was accessed. Each access was performed by a user using a generic login known as 'Albury Operator'. This was a login known to all staff at Albury and one that the computer was regularly left logged on to, allowing anybody present in the Depot to use it. 307RailCorp sought to rely on the statements of Kevin Dove to overcome their weakness with the above evidence. Mr Dove's statements were used to attempt to show Mr Ryan as being witnessed accessing the site on 29 May 2010, to be photocopying and carrying blue paper that RailCorp wanted the Board to assume was the 'inappropriate material' they alleged was distributed that night, and that Mr Ryan was the only person (other than Mr Dove) who could possibly have been present at the Depot at the time that they deduced the material was distributed. 308The RTBU referred to the three statements of Mr Dove as follows: 1.The 17 June 2010 was the first and least detailed made approximately three weeks after the date he was recalling (29 May 2010): Mr Dove was at Albury Depot from 4pm until 1200am on 29 May. He saw Mr Ryan sitting at the computer with a logo, not unlike the CountryLink logo on the screen. It appeared no such logo was included on the documents provided by RailCorp. When pressed in cross examination he could not remember what he had seen or say with any certainty what he saw that night. He assisted Mr Ryan with access to a photocopier and saw Mr Ryan apparently walking from the photocopier with blue paper in his hand. 2.18 November 2010, over 5 months after the incident and adding to the first: Mr Dove now said he did not see anyone other than Mr Ryan between "roughly" 7.30pm and 9.30pm. 3.On 25 February 2011, approximately 9 months after the incident and after Mr Ryan was dismissed on or about 20 January 2011 as a result of a separate investigation. At the time of RailCorp collecting this statement, Mr Ryan was not an employee and the investigation into him (according to RailCorp's investigators) had been suspended. Mr Dove changed his evidence about the times that he saw Mr Ryan and appears to strengthen his statement that no one else could have accessed the premises. 309It is submitted that the evidence already provided by Mr Dove was inconsistent and unreliable. Further, Mr Dove, RailCorp's key witness to all allegations relating to 29 May 2010, did not see Mr Ryan access, print, photocopy or distribute any inappropriate material. 310The RTBU referred to the further information in a number of statements and investigator file notes, which showed RailCorp had asked some employees how and when they came to find the allegedly inappropriate material in the workplace. Again, none of this evidence was directly linked to Mr Ryan. None of these witnesses saw him on the computer, with the material or distributing the material and the evidence of these witnesses did not rule out the possibility of another person viewing or distributing the material. 311It was also submitted that the evidence about access to different doors within the building was inconclusive and there was conflict between Mr Macklan's evidence (who was rarely there after hours) and other witnesses about when different doors may or may not have been locked and Mr Ryan's evidence that the door was never locked.. 312It was submitted that on the basis of the evidence provided, it could not be substantiated that Mr Ryan accessed the CSW on 29 May 2010 from a RailCorp computer or that he printed or distributed any material from it. 313The RTBU also referred to RailCorp's evidence relating to the monitoring carried out of one of the Albury computers. The footage of a computer screen accessing David Ryan's email and then accessing the CSW website just before 4am on 18 June 2010. This was the main piece of evidence that RailCorp withheld from Mr Ryan during the course of the investigation despite repeated requests for such evidence and direct requests to investigators during the interview of 8 December 2011 for information relating to 18 June 2010. 314It was submitted that the evidence showed that someone did access Mr Ryan's email and it was conceded that there was no reason to believe it was not Mr Ryan himself. But this did not demonstrate that he was the person who accessed the CSW after his email was closed down. His evidence was that he has not viewed the CSW at work and that on 18 June 2010, as with many other occasions, he and other employees used the computer before beginning a shift. It was a usual occurrence, and one that was certainly reasonable for the Board to accept, that when one employee closed the window they were working on, as they got up to move away from the computer, then another employee waiting to use the computer could take control of the mouse immediately as they sat down. It was submitted that this explanation was perfectly reasonable to infer from the evidence made available. 315It was submitted that, on the basis of this evidence, it could not be substantiated that Mr Ryan accessed the CSW on 18 June 2010. Further, in considering this evidence the Board should also have regard to the way that it was obtained. Serious questions arose here as to whether or not RailCorp had lived up to its obligations to give employees appropriate notice about this kind of intrusive surveillance. 316The RTBU drew the Board's attention to the provisions of ss.10 and 12 of the Workplace Surveillance Act 2005 (NSW) concerning the requirements for notice of surveillance. 317The RTBU also referred RailCorp's ICT Services Access and Usage Procedure which states that "RailCorp may audit your computer, email and internet usage at any time to ensure legitimate use of its resources." It did not follow from this statement that an employee who was aware of the policy would be able to reasonably conclude that RailCorp might record live usage of a computer at any time without any specific warning. 318It was submitted that this raised the following questions concerning RailCorp's conduct: Did they give appropriate notice that this kind of surveillance was to be carried out? Did they give appropriate notice of how surveillance would be carried out, when it would start or how it would continue? Did they carry out the surveillance in accordance with their policy? Was the policy sufficiently clear to explain to employees what kind of computer surveillance may be undertaken? Was Mr Ryan notified of this specific policy in such a way that it is reasonable to assume that he understood it (that is, more than simply a reference to one of a great number of policies available for download at the employee's own initiative)? 319It was submitted that these factors were appropriate for the Board to consider when examining and making conclusions on this evidence. 320The RTBU submitted that, while it was not a specific allegation, RailCorp had asserted that Mr Ryan had not been truthful during the investigation and in his pleas to this Board. This was rejected. RailCorp appeared to have three reasons for asserting untruthfulness: 1)Mr Ryan denied the allegations that they said were substantiated. In circumstances where there was absolutely no direct evidence to prove the allegations to any standard, let alone the one necessary in this case, this could not be held up as evidence of untruthfulness. 2)Mr Ryan at one point asserted that he was out of the State on 18 June 2010 and this was found to be incorrect. What Mr Ryan did say to the Investigator was "I do not believe I was even in the state on that 18th of June 2010... Whatever the date is". This was not a categorical statement by him. The evidence showed that he departed Albury at around 4am that day bound for Melbourne. On this basis, it was perfectly reasonable that Mr Ryan held the belief that he was out of NSW on that day. 3)Mr Ryan stated during the interview that he had trouble with his password and at times had his password re-set or was provided with what he believed to be a generic password that was not secure. The evidence provided by RailCorp supported the assertion that Mr Ryan had problems with his password (and it had to be reset a number of times) and did nothing to dispute his statement that he believed his password was "rail123 or railway123" and that he believed this password was not secure. 321It was submitted that even if the allegations could be substantiated (which was not conceded) the RTBU asserted that dismissal was harsh in all the circumstances. 322RailCorp's submission that Mr Ryan putting forward at a late hour names of others who was present did not demonstrate that he was untruthful or guilty. The Board was asked to consider that Mr Ryan was a Union delegate and operated within his code and part of that code was that unless he had direct evidence that someone was guilty he was not going to dob them in. That did not demonstrate untruthfulness but that Mr Ryan had taken a reasonable position that it was RailCorp's job to prove him guilty. 323In Mr Ryan's cross examination he said Mr Emmery was one of the people present. There was also evidence from Mr Wood and Mr Macklan about a sting to establish who was going on the CSW and Mr Emmery was one of the names of identified at the time the CSW was being accessed. There was also Mr Macklan's evidence about previous allegations against Mr Emmery about distributing inappropriate material. There was never any suggestion that Mr Ryan had ever engaged in such kind of behaviour. In a sense it was open to the Board to find that Mr Emmery distributed the material. It was not the role of the appellant or the RTBU to demonstrate that Mr Emmery or any other person did it but to point out the flaws in RailCorp's case when they said Mr Ryan distributed the material. 324It was submitted that the evidence enabled the Board to conclude that there was a high level of accessing or use of the CSW by staff at Albury and by CountryLink staff in general at the times relevant to these allegations. Mr Ryan's previous submission to RailCorp and his witness indicated that he was aware that a number of employees had accessed the CSW at work. This included RailCorp witnesses Mr Macklan (a manager) and Mr Bush. Mr Bishop's statement also indicated that he had accessed the CSW on a RailCorp computer. 325It was submitted that RailCorp had such a problem with staff viewing and contributing to the site that they reportedly spent $1 million in a seven month effort to shut it down according to a report in the Sydney Morning Herald of 26 December 2010 (and attached to the written submissions). The site was reported to have had more than 500 000 hits by 26 December 2010. The organisation also shut down staff access to the site and sent a memo to staff from Chief Operating Officer, Andy Byford, effectively banning the site from RailCorp use but subsequent to the time of Mr Ryan's alleged use. The RTBU noted that RailCorp had not included a copy of Mr Byford's memo in their written case. It was submitted that the memo and its date were relevant to these proceedings. 326It was submitted that in these circumstances, it was clearly harsh to charge and then dismiss Mr Ryan for allegedly accessing the CSW for the following reasons: Many other employees accessed the site without consequence; The CSW material was not automatically or obviously inappropriate and did not amount to a breach of the Code of Conduct, or one serious enough to warrant dismissal. The Code instructed employees RailCorp resources such as computers could be used for limited private use, with that use prohibited if it was illegal, unethical, anti-social, used to gain personal profit or interfered with the employee carrying out their job. Accessing of the CSW material provided did not automatically fit into any of these groups of prohibited use. The information provided from the CSW included concerns about staff cuts and safety for CountryLink workers, complaints/concerns about the way managers treated staff or about low staff morale. Much of the information presented appeared to simply be the opinion of the webmaster (or of other 'posters') and appeared to contain no threats against any person and no aggressive, racist or obscene comments. The CSW was clearly not violent, sexual or racist in nature. It would be automatic or obvious that an employee would consider that the CSW fell outside of RailCorp's acceptable usage policy. This was supported by the evidence that RailCorp had to go to great lengths to stop employees in large numbers from visiting the CSW at work. Either these employees did not understand the policy, or they did not think the material was inappropriate enough to be outside acceptable usage. The fact that employees like Mr Ryan saw their managers and others viewing and laughing at the CSW, and the fact so many employees were viewing it, would lead the reasonable person to conclude the site was considered acceptable. Most employees would feel they had a right to express opinions, negative or otherwise, about their situation at work. To dismiss any employee for accessing or sharing information in an environment that obviously had serious issues was certainly to be considered harsh. 327Mr Edghill traversed the actual material in some detail in oral submissions. He conceded that some parts of the material were inappropriate and that had also been conceded by Mr Ryan in relation to the comments about Hitler. 328Mr Edghill also rejected RailCorp's reliance on the observation of the Board in Deuter concerning the use of "Hitler" as being derogatory and pointed out that Mr Ryan had indicated that he considered the reference to Mr McLeod and "Adolf Hitler" as being "over the top". 329It was also submitted that the dismissal was harsh as Mr Ryan had no warning that the type of behaviour he allegedly engaged in could be cause for dismissal. He had no previous problems, warnings or counselling in relation to internet or computer usage. He was aware that others had used the site and he had been given no instruction that this was unacceptable. RailCorp did eventually issue a warning to staff about the site and instructed them not to access it using RailCorp resources (which they had a right to do) but this warning did not come until a considerable amount of time after the alleged misconduct. 330In considering harshness, the Board must also consider what damage, if any, was actually done by the alleged misconduct. The evidence clearly demonstrated that CountryLink had a problem with staff morale and with staff-management relationships. To suggest that this was caused or contributed to in any real way by somebody accessing this website and communicating information from it to others was to ignore the real issue. 331It was submitted that obviously a number of people had problems with CountryLink and felt strongly enough about this to take to this website in great numbers and to post anonymously on the site to bring those problems to light. Whoever distributed the material obviously had concerns about the way things operated and others shared those concerns. These were not unusual complaints that people might find in a workplace that had something of a poor culture. To sheet that poor culture home to one individual, Mr Ryan, as the person distributing this information because he was upset at being continually dismissed, would be to do a great disservice those employees and ignore the real problems in the workplace. The problems were already there, they weren't created by the website. In that context, it could be questioned what real damage was done by an employee viewing the CSW on two dates and sharing some of the information on that site with other employees who would likely have had an interest in it. RailCorp assumed that there was bad intent these actions as well as the assumption that Mr Ryan was responsible. Even if it were to be established that Mr Ryan did access and distribute the material, and even if it was to be established that he knew the material was inappropriate at the time, there would be no way that RailCorp could demonstrate that he was seeking to cause some damage by doing this - whoever did this was sharing with employees information reportedly about their own workplace. On this basis, again, the dismissal must be considered harsh. 332Further even if the Board was satisfied that Mr Ryan did quote or attempt to quote there was no knowledge as to the content of that quote and it would be harsh to imagine that the content would have been negative or derogatory or to such a level that dismissal was warranted. 333It was also submitted that the Board should give consideration to the timing involved in the allegations and investigation. Since 18 August 2009, there had been just four months where Mr Ryan had been at work without being under investigation. He was dismissed on 15 December 2009 and had to wait until April 2010 for a decision from the Transport Appeal Boards to reinstate him. On 4 August 2010, RailCorp informed Mr Ryan they were again investigating him and was then informed he was to be dismissed for a second time on 18 January 2011. This time Mr Ryan had to wait until 30 June 2011 for the decision reinstating him. A week later, in July 2011, RailCorp informed Mr Ryan they were reopening an old investigation into him. This was an investigation he had already been told was completed. That investigation lead to him being dismissed a third time late in the evening on 22 December 2012 (it appeared the DRP convened a special meeting to ensure he could be dismissed again before Christmas). Between Mr Ryan being reinstated after 30 June 2011 and his dismissal on 22 December 2011 no problems with Mr Ryan's conduct or performance were brought to his attention by RailCorp. The only allegations pre-dated his last dismissal and successful appeal. The amount of time that had passed and lack of useful information provided by RailCorp, made it difficult for him to respond during the reactivated investigation. Nonetheless, Mr Ryan continued to work for RailCorp, completing his duties diligently and without incident or complaint. The Board must consider these factors in determining whether or not dismissal for this reactivated investigation was appropriate in the circumstances. 334It was also submitted that the Board should consider the obvious impact of the decision to dismiss on Mr Ryan financially, in terms of health, stress on both the individual and the family, particularly in light of RailCorp's other flawed decisions to dismiss. This impact was exacerbated when a person was dismissed three times from the same employer in barely more than two years. The RTBU asserted that it was aware of no similar situation. Mr Ryan had a family to support and financial commitments to meet. Previous dismissals had already caused him to have to move his family home. It should also be considered that Mr Ryan and his family are based in Albury, in regional NSW, where it is even more difficult for him to find any work, let alone work that will support him and his family. 335The RTBU replied to RailCorp's reliance on the previous dismissals of Mr Ryan characterising them as "failed and unfair attempts" to justify this latest dismissal and submitted that in doing so they had presented a misleading version of the events and decisions in these previous matters. The RTBU sought to correct the misleading impression that might be drawn from RailCorp's assertions about these cases and pointed out the following: First dismissal case Mr Ryan was charged with: Not filling out timesheets correctly and claiming allowances they said he was not entitled to, refusing to sign a secondary employment declaration, refusing to sign acknowledgment for a bulletin and refusing to follow a direction by not following a process apparently set out in an information bulletin. The Board found that he was filling out timesheets consistently with the practice of the workplace and while it was held to be inappropriate, it was not brought to Mr Ryan's attention and he "did not intentionally make false entries" and "did not intend to defraud RailCorp". The Board found that Mr Ryan did refuse to sign his secondary employment declaration, but found that the other allegations not sustained. The only allegation RailCorp could sustain was that Mr Ryan did not sign a secondary employment declaration after being asked. Relevantly, the Board noted that Mr Ryan had been a satisfactory employee since 2003, there was no evidence of prior disciplinary matters and found he had not been dishonest. Second dismissal: Mr Ryan was charged with: Submitting two time sheets not filled out correctly on five dates and allegedly not following a direction regarding attestation found in a RailCorp bulletin. The decision recorded that it was not contended that Mr Ryan was fraudulent or dishonest, but the decision to dismiss was about "attitude and compliance". The Board did not find any serious problem with attitude or compliance with which to uphold the dismissal. The Board found Mr Ryan to be a witness of truth, the allegation about attestation could not be sustained and that there was an "almost complete lack of agreement amongst the witnesses" on the process that Mr Ryan was accused of failing to follow, as well as differences between witnesses about the processes to be followed concerning timesheets, The Board went on to find that Mr Ryan did fail to record his timesheets correctly in some instances but that the information that was recorded did allow "the reader to determine what work Mr Ryan performed on those days and thus calculate his payments". The Board found dismissal to be "entirely disproportionate to the overall seriousness of the misconduct involved" and ordered Mr Ryan's reinstatement with a one week suspension. 336It was submitted that these past cases could not be used as justification for Mr Ryan's dismissal in this case. None of the allegations related to allegations made in this matter. Further, the RTBU made repeated attempts to understand what factors were being considered by RailCorp's decision maker and were at one point informed that Mr Ryan would be judged, in part, on previous overturned allegations. Had the RTBU been informed of that, it would have sought to make submissions to the decision maker about these issues, which would have obviously been of some value given RailCorp's apparent view of these decisions. 337The RTBU submitted that if these cases were to be considered by the Board, they should be considered to show a pattern where RailCorp repeatedly pursued, investigated and dismissed Mr Ryan on baseless and petty charges. The Board should consider if it was aware of other cases where a person had been dismissed for failing to sign in acknowledgement of a bulletin as happened in the first Ryan v RailCorp or for filling out a timesheet incorrectly, even though there was no allegation of fraud and the time keeper was able to determine the entitlement due as happened in the second Ryan v RailCorp. 338It was submitted that these past cases, and RailCorp's treatment of them in their submissions, should be considered further evidence of RailCorp's continued unfair pursuit of Mr Ryan and further evidence of the harshness of the most recent decision to dismiss him. 339It was also submitted that RailCorp had failed to provide Mr Ryan with an appropriate level of procedural fairness. Reference was made to the Code of Conduct and in particular the section concerning 'Fairness and equity'. 340It was submitted that Mr Ryan was denied procedural fairness as he was denied the opportunity to put his case forward when he was denied access to the adverse evidence that RailCorp held against him (and thereby deprived of the benefit of responding to it) and also denied the opportunity to see this information because of his insistence on representation by the RTBU. (Details were then given of the way the RTBU sought/requested information about the allegations/matters being considered by the decision maker). Despite clear and repeated requests, RailCorp did not provide the information that they held against Mr Ryan or make clear the matters the decision maker was considering, hence denying Mr Ryan the opportunity to respond. This amounted to a denial of procedural fairness. 341It was submitted that whilst through various relevant legislation (then listed) Parliament had conferred on RailCorp the power to make such decisions, such power could only be validly exercised if common law notions of natural justice and procedural fairness were followed. 342The RTBU asserted that RailCorp had not followed procedural fairness to the extent required by their own Code of Conduct and nor to the extent required by well established case law and relied on Jarratt v Commissioner of Police for New South Wales and Anor [2005] HCA 50 on the form of natural justice with which a person affected by a decision is entitled to be provided. 343The RTBU further relied on the following cases in relation to the concepts of fairness and natural justice; Dixon v Commonwealth (1981) 61 ALRR 173, and Commissioner of the ACT Revenue v Alphaone Pty Ltd [1994] FCA 1074. 344In this case, despite requests, RailCorp did not afford Mr Ryan the opportunity to rebut, qualify or comment on adverse material considered by the decision maker before they made a decision. 345Mr Edghill elaborated on those submissions in some detail in oral submissions giving examples from the transcript of 8 December interview and in support of the written submissions. 346The RTBU also referred to RailCorp's submissions that, if reinstated, they will investigate Mr Ryan again and asserted that it would be a tremendous injustice to Mr Ryan if such threats were held up as reason to refuse reinstatement (the only useful remedy open to Mr Ryan in these proceedings). Mr Ryan has not had any allegations of the kind referred to by RailCorp put to him at any time and has had no opportunity to consider or respond and could not possibly be expected to respond to such accusations in these proceedings. 347It was submitted that in these circumstances, it was inappropriate in the extreme for such an allegation to even be put before the Board by RailCorp who were simply trying to paint Mr Ryan in a bad light. For the Board to hold such a consideration would also be a grave breach of the notions of natural justice. 348It was also submitted that it was further evidence of the unreasonable and overly aggressive attitude that RailCorp had taken towards Mr Ryan. It is this context that should be considered when the Board was determining the question of harshness. 349In conclusion The RTBU reiterated that the allegations against Mr Ryan could not be substantiated, and if they were then dismissal was harsh in the circumstances. Mr Ryan has been denied natural justice and procedural fairness by RailCorp. The Board was asked to remember that, despite their tireless pursuit of Mr Ryan, RailCorp had never come up with an allegation that showed him to be anything other than diligent and professional in the work he carries out for RailCorp. 350it was submitted that the appeal should be allowed, the dismissal overturned and Mr Ryan should be returned to his former position with full back pay and continuity of employment. Findings 351The Board has carefully considered all of the evidence (including viewing the video footage relevant to 18 June 2010), the submissions of the parties, as well as the cases cited. 352This is an appeal under clause 43 of the Transport Administration (Staff) Regulation 2005 against RailCorp's decision to impose the punishment of dismissal on Mr Ryan. Section 23(1) of the TAB Act provides that the Board may decide to allow, or disallow the appeal, or make such other decision as it thinks fit. 353Mr Ryan disputes the findings made concerning the allegations against him made by RailCorp and its decision to dismiss him from his employment. The Board's function in this matter is to determine firstly, whether the allegations are sustained and secondly, to determine whether the disciplinary punishment imposed by RailCorp in relation to such findings is appropriate in all the circumstances - see Duhbihur v Transport Appeal Board and Anor [2005] NSWSC 811 at [116]-[125]. 354The Board is obliged to determine the disputed issues before it on the civil standard of proof, that is, the balance of probabilities. The Board is also obliged to approach the matter in a manner consistent with the principles enunciated in Briginshaw v Briginshaw & Anor (1938) 60 CLR 336. 355Specific reference was made during submissions to the oft-quoted principle in Briginshaw which states as follows: The truth is that, when the law requires the proof of any fact, the tribunal must feel an actual persuasion of its occurrence or existence before it can be found. It cannot be found as a result of a mere mechanical comparison of probabilities independently of any belief in its reality... it is enough that the affirmative of an allegation is made out to the reasonable satisfaction of the tribunal. But reasonable satisfaction is not a state of mind that is attained or established independently of the nature and consequences of the fact or facts to be proved. The seriousness of an allegation made, the inherent unlikelihood of an occurrence of a given description, or the gravity of the consequences flowing from a particular finding are considerations which must affect the answer to the question whether the issue has been proved to the reasonable satisfaction of the tribunal. In such matters, 'reasonable satisfaction' should not be produced by inexact proofs, indefinite testimony or indirect references. 356In Neat Holdings Pty Ltd v Karajan Holdings Pty Ltd (1992) 110 ALR at 449 - 450, Mason CJ, Brennan, Deane and Gaudron JJ explained the above passage from Briginshaw this way: The ordinary standard of proof required of a party who bears the onus in civil litigation in this country is proof on the balance of probabilities. That remains so even where the matter to be proved involves criminal conduct or fraud. On the other hand, the strength of the evidence necessary to establish a fact or facts on the balance of probabilities may vary according to the nature of what it is sought to prove. Thus, authoritative statements have often been made to the effect that clear or cogent or strict proof is necessary "where so serious a matter as fraud is to be found". Statements to that effect should not, however, be understood as directed to the standard of proof. Rather, they should be understood as merely reflecting a conventional perception that members of our society do not ordinarily engage in fraudulent or criminal conduct and a judicial approach that a court should not lightly make a finding that, on the balance of probabilities, a party to civil litigation has been guilty of such conduct. (Emphasis added). 357The Full Bench of the Industrial Relations Commission considered the intertwined issues of both who bears the evidentiary onus and the standard to be applied to that onus in an appeal from a decision in an application for reinstatement under s.84 of the Industrial Relations Act 1996 in New South Wales Nurses' Association (on behalf of Colin Prior) and South Eastern Sydney and Illawarra Area Health Service [2007] NSWIRComm 164. After upholding the "well established principle" that the evidentiary burden in a case of serious misconduct shifted to the respondent employer as set out in the line of relevant authorities (as cited), the Full Bench went on to relevantly observe: 13 Although it must be accepted that the respondent carries the onus to be discharged according to the ordinary civil onus, on the balance of probabilities, the very nature of the issues involved and the consequences of a decision to summarily dismiss an employee, required the respondent to make out its case in a convincing way. It has long been established that the dicta laid out in the High Court of Australia in Briginshaw v Briginshaw (1938) 60 CLR 336, should apply. (Emphasis added) 358Mr Edghill's submission essentially went to the onus being on RailCorp "to prove" that Mr Ryan had committed the misconduct alleged in the three allegations and emphasised that the evidence relied on could not be "produced by inexact proofs, indefinite testimony or indirect references" relying on Briginshaw. This seemed to suggest that in the absence of exact proof, definite testimony and direct references, RailCorp had not discharged the requisite onus and its case failed. 359The Board considers that to be a misunderstanding of Briginshaw. It still comes back to the standard of proof required being the 'balance of probabilities' and not one of 'beyond reasonable doubt' which would seem to be necessary to be applied if the submissions of the RTBU were to be followed. It does not mean that RailCorp must have evidence of someone actually seeing Mr Ryan printing off the CSW material, then actually seeing him photocopying it and actually seeing him placing the material in the Onboarders' pigeon holes. 360Ms Robinson quite rightly has drawn a comparison with Jarman concerning being in the 'right place at the right time' and submitted that RailCorp's evidence in the case of Mr Ryan is in fact much stronger and is direct through the evidence of Mr Dove and the forensic evidence. 361The Board can only make findings based on the evidence before it as set out in the provisions of s.17 of the TAB Act as set out below: 17 Evidence 1)A Board is not bound by the rules or practice as to evidence and may, subject to subsection (2), inform itself on any manner in such manner as it thinks fit. 2)A Board shall not inform itself on, or take into consideration, any matter which has not been disclosed in evidence at a sitting of the Board if the matter is one which ought, in the interests of justice, to be available to challenge or testing by the persons entitled to be present at a sitting. (Emphasis added). 3)Nothing in subsection (2) prevents a Board from informing itself on, taking into consideration, any matter of which is entitled to take judicial notice. 362Also of relevant consideration, particularly in the case of Mr Ryan, are the provisions of s.16 of the TAB Act and in particular subsection (2) as set out below: 16 Order of presentation of cases 1)At the hearing of an appeal by the Board, the employer's case shall be presented first. 2)Nothing in subsection (1) removes from an appellant or any other person the onus of proving any ground on which the appellant or person relies (Emphasis added). 363The Board considers that the onus does not rest solely on the respondent RailCorp to prove its case. The respondent in a TAB disciplinary appeal certainly bears the onus to prove, on the balance of probabilities, that allegations are sustained. However, that does not absolve, as s.16(2) makes clear, an appellant such as Mr Ryan, from also proving those matters upon which he relies in rebuttal of the allegations against him. He cannot just effectively fold his arms and say they have to prove their case I don't have to do anything, particularly in circumstances where there was specific information that could have been provided by Mr Ryan, effectively in rebuttal, when he was afforded the opportunities to provide such, did not do so, only came forward with that information at the appeal hearing stage and then in such a way as to prevent it being tested. This is of particular relevance to the investigation process which RailCorp undertook and the decision it made on the available evidence. 364Further, if the RTBU's submissions as to Briginshaw were to be followed it would surely follow, applying s.16(2), that any reliance pressed on behalf of Mr Ryan that the Board should find Mr Emmery was the one who accessed, printed and distributed the CSW material, would also have to follow Briginshaw in the same manner as submitted by the RTBU and require that he had also been seen accessing, printing and distributing the material. 365The Board should also indicate at the outset, that while it is appreciated that Mr Ryan very firmly believes he has been the victim of on-going targeting and harassment by RailCorp, the Board can find no evidence of such in this matter. 366A disciplinary investigation had been commenced in July 2010, formal allegations had been made, sent to Mr Ryan and he had provided a written response. The investigation had not been concluded as at the date of his dismissal in relation to the timesheet allegations and it was not unreasonable that such a formal investigation into what were very serious allegations of misconduct, having been commenced and not concluded, should be resumed when Mr Ryan was reinstated. Obviously if he had not been reinstated RailCorp could not have pursued an employment matter if Mr Ryan had no longer been an employee. 367True it is that the allegations against him were forwarded to him on 5 August 2010, and from perusal of the second Ryan decision, that was the day after the allegations were forwarded to him concerning the timesheets. Both investigations were conducted by RailCorp's Investigations Unit but by different Investigators. They both evidently proceeded at their own pace. It is also clear from Mr Wood's evidence that he was still undertaking external forensic enquires concerning the CSW and how it operated as late as November 2010. The investigation was placed on hold apparently due to the other investigation which was finalised by an Investigation Report of Mr Crimmins of 2 December 2010 (as detailed in Ryan). However there were no questions directed at Mr Wood as to the reasons why his investigation was placed on hold, or whether it could have been concluded in 2010. 368It is also very clear from the evidence of Mr Wood that this matter had its genesis in the automatic Google "push" notification received by RailCorp about the related CSW (due to it use of the name "CountryLink") around 25 to 28 May 2010. This was cause for concern of those at the highest level of Railcorp management. Albury Station became the focus when Mr Macklan became aware on Monday 31 May of the CSW material that had been distributed on 29 May through the material left under his door and his subsequent conversation with Mr Bishop and passed that information on to higher management levels, (including the CSW material that had been distributed). Mr Ryan did not come into the picture until Mr Macklan spoke to Mr Dove at the end of the week, on Friday 4 June, and was told what Mr Dove had seen in relation to Mr Ryan on the night of 29 May and which was clearly of considerable relevance. 369Mr Dove gave his statement to Mr Wood on 17 June only some 19 days after the events of 29 May, it would still have been reasonably fresh in his memory. The Board considers that Mr Dove's evidence has been consistent throughout his three statements and his oral evidence and it is not a case that his memory has improved over time as was suggested by the RTBU. Additional detail and clarification has certainly been provided in the two subsequent statements (that had not previously been referred to) but he has been firm and consistent as to the relevant facts detailed in his initial evidence, particularly about the unlocking of Mr Neal's office door to allow Mr Ryan access to the photocopier. As a relatively new employee carrying out his duties and for the reason he gave (a float going missing previously) the Board has no doubt about his evidence about locking the door and found him a witness of credit. 370In contrast, Mr Ryan did not give any information about what happened on 29 May when he had the opportunity to do so in August 2010, consistently denied the allegations, only provided information for the first time in his written statement filed in reply to RailCorp's evidence, then changed crucial elements of that statement in oral evidence and then put forward new information in cross examination. Revealing his version of events in this way meant that it could not be tested either during the course of the investigation or in the hearing. The Board considers that this reflects very adversely on his credit as a witness and the reliability of his evidence. 371Taking all of the above into account the Board can find no basis for the assertion that Mr Ryan has been targeted in relation to these allegations. RailCorp acted on the evidence available to it and proceeded on that basis. 372The Board also finds that it is absolutely beyond doubt, that the CSW material in question contained totally inappropriate content and was manifestly inappropriate to be accessed on a RailCorp computer, printed off and distributed to other RailCorp employees. The material did not have to be racist or obscene or threatening or aggressive or violent or sexual to constitute inappropriate material as suggested by the RTBU. It was derogatory, offensive and inflammatory. Further a website that allowed anonymous postings where literally anything could be said or alleged against RailCorp management, or indeed other RailCorp employees, was way beyond being a forum where employees could simply air their concerns about management, as also seemed to be suggested by the RTBU. The Board shares RailCorp's concern regarding the RTBU's submissions on this issue. 373To seek to draw comparisons with union journals/publications/notices was simply not a valid comparison. A union is an outside independent organisation using its own resources, not a RailCorp employee using RailCorp resources, on RailCorp premises, in Railcorp work time, and with obligations under a well promulgated and known Code of Conduct and policies governing the use of RailCorp resources particularly via email and the internet. The Board would be very surprised if a union was to publish material in such terms and does have some familiarity and knowledge of various union publications from past years. 374The Board concurs with the submission of RailCorp that it was not necessary to show actual damage to RailCorp that was attributable to the dissemination of the inappropriate and disparaging CSW material but the potential for damage to RailCorp and its interests was sufficient. This was patently objectionable, and offensive material of considerable detriment to RailCorp and the staff and management of CountryLink. It also had the potential to sew and foster dissension and disharmony amongst staff, and between staff and management. RailCorp's concerns were evidenced by the fact that they took action (when it was appropriate to do so) to shut the CSW down. 375This brings the Board to a consideration of the procedural fairness issues raised by the RTBU. 376The Board has carefully considered RailCorp's Discipline Policy as attached to Mr Kinney's statement and can find no departure from that Policy in the way in which the investigation concerning Mr Ryan proceeded. There is no requirement in the Policy for the provision of an Investigation Report to either an employee or their representative. This certainly contrasts with the practice generally concerning employees subject to the provisions of the Public Sector Employment and Management Act 2002, (an Act listed in the Code of Conduct at 20. Applicable Laws with which the Code is consistent). However the Board also notes RailCorp's submission that the Policy is one agreed between the various unions and RailCorp, and that has been in place for a number of years. Certainly the investigative/disciplinary procedure that was followed in this matter is consistent with what the Board has encountered in previous appeals concerning RailCorp and involving both the RTBU and other industrial unions. 377The RTBU were apparently seeking access to the material that RailCorp had against Mr Ryan. Essentially it seems to the Board that what the RTBU were seeking to ascertain was the evidence, or really the strength of the evidence, that RailCorp had against Mr Ryan and to then respond to that evidence in advance of appeal proceedings. That is not a procedural fairness issue in the Board's view. 378The Board has carefully considered the transcript of the interview of 8 December between Mr Kinney and Mr Ryan, at which Mr Edghill's role was only supposed to be as a support person (to be commented on further below). It is clear that documentary material upon which RailCorp was relying was being shown and made available to Mr Ryan. That the interview was not able to traverse all the subject matter proposed to be dealt with is evident from a reading of that transcript. 379The Board considers that situation arose purely from firstly, the attempts of Mr Edghill to seek to represent Mr Ryan as an advocate rather than as a support person; secondly Mr Ryan's attitude, which at times was less than helpful and cooperative; and thirdly, Mr Edghill having another commitment which he had to attend at 12.30 pm thus cutting short the interview. If there had been a less argumentative and frankly combative approach taken by both Mr Edghill and Mr Ryan then the interview would clearly have been of longer duration (even taking into account Mr Edghill's other commitment) on actual issues of relevance, including material that had been sought and was evidently able to be made available, and intended to be made available, in the interview, based on the comments of Mr Kinney. 380Indeed frankly, if the amount of time that was wasted during that interview process had not occurred, then the RTBU and Mr Ryan may well have had access to the material they sought. Whether that would have assisted Mr Ryan's cause is another matter, given that Mr Ryan had been singularly unforthcoming with any information he possessed about the events of 29 May, up to and including 8 December 2011, apart from denying the allegations. 381There was, however, follow up on some of the information provided by Mr Ryan (concerning 18 June 2010), resulting in Mr Kinney's further investigation report. There could also have been relevant follow up of other information Mr Ryan alluded to (such as it was), specifically the actual names other persons he said he saw/was aware of at the Station on 29 May, if he had been prepared to provide such. 382RailCorp's Discipline Policy makes the position of the support person/representative quite clear, it is not to take the role of an advocate or to be a spokesperson, as Mr Ryan sought/advised at the outset of the interview. That conforms with standard practice across both the public and private sector in the Board's extensive and lengthy practical industrial relations experience. What is essential in any disciplinary/investigative interview is for the interviewer to elicit responses directly from the interviewee not via the support person. That person is essentially there, as the name suggests, to give support, can certainly give advice/counsel during adjournments for that purpose, and is also there to ensure and witness a fair process. Just as the interviewer will have a support person/witness present. RailCorp's Policy provides for an opportunity for a support person to speak in circumstances as set out in the Policy. The chance for representation in an advocacy role comes once an investigation is completed and a union can go in to bat as strenuously as they wish in their member's interests in relation to the outcome of such investigation. 383The Board considers and finds that Mr Ryan had been provided with the allegations in sufficient and requisite detail to enable a considered response and had an opportunity to rebut those allegations. He was provided with a copy of the accessed CSW material (Mr Wood's evidence is accepted on this issue) in conjunction with the allegation letter, the allegations made clear that the accusation involved the accessing, printing and distribution of the CSW material. The only item of relevant information missing was precisely where the material was distributed. However no further information was sought by Mr Ryan in clarification if he had any doubt or inability to appropriately respond, and in any event Mr Ryan's written response made it clear that he was aware of material being taken from staff pigeon holes by Mr Macklan. He was also aware that Mr Dove was at the Station and on duty that night and would have had an expectation that Mr Dove would be questioned. 384The only more precise piece of information that could have been provided by RailCorp in relation to the allegation concerning 18 June that might have changed Mr Ryan's response (or enabled a more considered response than that given), would have been to provide the timeframe within which the alleged access of the CSW took place, e.g between 0300 and 0400 hours. Given that Mr Ryan departed Albury Station on a 4:00 am train that then travelled interstate to Melbourne, his statement that he was not in the State on that day was not totally inaccurate, but it may have been avoided entirely if the allegation had been more specific. 385The Board makes clear that in the circumstances, Mr Ryan's initial written response as to being out of the State on 18 June 2010 does not reflect adversely on his credit. 386Mr Ryan was given the opportunity to respond in writing in August 2010. He was also given an opportunity to attend an interview with Mr Wood on 29 September 2010 which he declined. The written response he provided, in the light of his subsequent amended written evidence and subsequent oral evidence to the Board, did not respond to the allegations (1 and 2) in any specific way or informative way and only in the most general terms in circumstances where he could have clearly indicated just what he had done on 29 May 2010 and what precise RailCorp resources he had used, and where, and in what manner. His language in his written response was " As RTBU Sec of ABx I do have access to electronic equipment as per our award and I utilize the available equipment for union business and to access my e-mails". He did not say "I utilized" the available equipment or give any explanation or information about how and in what way he utilised the equipment that he subsequently disclosed in his amended written statement (as amended at the hearing) and oral evidence. This meant this could not be investigated by RailCorp in any way. 387This was detailed information he could have provided, and that if it was true, could have been supported/confirmed, at least in part, by factual forensic evidence (examination of the Travel Centre computer) and provision of copies of the documents he said he printed/photocopied. 388It is also abundantly clear from the 8 December interview that Mr Ryan had information about other RailCorp employees who were at the Albury Station during the relevant times on Saturday 29 May 2010 and declined to disclose that information thereby cutting off a further avenue of enquiry that may have been of assistance to Mr Ryan or provided further relevant information. It was not a case of 'dobbing' someone in but of enabling RailCorp to interview those persons to see if they had any relevant independent information to provide about what happened on the night of 29 May 2010. 389Further, that information and more detail about those persons and their interaction with Mr Ryan was only forthcoming for the very first time in cross examination and where no relevant questioning took place of at least two (Mr Dove and Mr Bishop), possibly three (Mr Engle), of RailCorp's witnesses in their respective cross examination, leaving Mr Ryan's evidence totally untested. 390The Board indeed wonders for what real purpose RailCorp's evidence was being sought. Given Mr Ryan's denials in his written response and the fact that he was not prepared to volunteer any information whatsoever about his actions on 29 May 2010. Even if all the RailCorp material being sought had been forthcoming would it have made any difference to Mr Ryan's responses and the outcome of the investigation and disciplinary process? 391Even where there are held to be procedural flaws and/or defects in a process, that does not necessarily mean that it is fatal to the eventual outcome. There have been numerous cases dealing with procedural fairness issues in formal arbitral proceedings. The decision in D & R Flood Commercial Pty Ltd and Flood [2002] NSWIRComm 88 traversed the various authorities in that context (and in particular where there had been reference/reliance by the decision maker below on a matter raised/referred to in conciliation) and the Full Bench indicated at para 53 as follows: A convenient statement of the appropriate general approach is that set out in the judgment of the High Court in Stead v State Government Insurance Commission (1986) 161 CLR 141, where the Court, having referred to the "general principle ... well expressed by the English Court of Appeal" in Jones v National Coal Board [1957] 2 QB 55 at 67 that "everyone ... is entitled [to] a fair trial at which he can put his case properly", observed at 145 - 146: That general principle is, however, subject to an important qualification which Bollen J plainly had in mind in identifying the practical question as being: Would further information possibly have made any difference? That qualification is that an appellate court will not order a new trial if it would inevitably result in the making of the same order as that made by the primary judge at the first trial. An order for a new trial in such a case would be a futility. For this reason not every departure from the rules of natural justice at a trial will entitle the aggrieved party to a new trial. .................. 392The Board considers that the general principles enunciated above are equally applicable to an investigative/disciplinary process. The crucial question to asked is whether that that alleged flaw/defect in procedural fairness would have affected the outcome. 393A example of a clear procedural defect and a procedural fairness issue during an investigative process which did affect adversely affect the outcome of a disciplinary process and hence the ultimate decision was referred to in Cockayne v Hurstville City Council [2009] NSWIRComm 1013. There were alleged admissions made during the initial interview, relied on by the decision maker but disputed by Mr Cockayne. The Commission observed as follows: 352The investigative procedures followed by HCC overall were appropriate and fair. However those procedures were hampered and flawed, in my view, by the absence of proper minutes/notes being taken at the first two meeting with Mr Cockayne and Mr Margerison and the failure to then provide such minutes/notes to them for verification. This is generally a standard part of disciplinary/investigative procedures in the public/local government and perhaps to a lesser extent in the private sector (usually dependent on the size of the employer). 353In my view this did not allow for there to be a proper and informed decision to be made or a decision that could have been arrived at beyond doubt. 394The Commission went on to find this to be unjust on procedural fairness grounds, and in conjunction with other grounds the applicant was reinstated to his position (but with an unpaid four month suspension effectively imposed). 395Having carefully considered the relevant evidence and submissions of the parties and the authorities cited above, Board finds that Mr Ryan was afforded procedural fairness at all stages of the investigative and appeal process. 396The Board has carefully considered the relevant provisions of the Workplace Surveillance Act 2005 as raised by the RTBU and in doing so has had particular regard for s.16 which provides as follows: 12 Additional requirements for computer surveillance Computer surveillance of an employee must not be carried out unless: a)the surveillance carried out in the woods with the policy of the employer of the computers unveiled some employees at work, and b)the employee has been notified in advance that policy in such a way that it is reasonable to assume that the employee is aware of and understands the policy. 397The Board has also carefully considered the relevant provisions of RailCorp's ICT Services Access and Usage Procedure and can find no breach of the Act took place in relation to the internal monitoring and auditing of the Onboarders' computer that was undertaken by RailCorp. It was carried out entirely within, and in accordance with the Procedure and was clearly 'computer surveillance of employees at work'. RailCorp employees have been made aware of that Procedure and copies are on the Railcorp Intranet. Further every time a computer is logged into employees are advised by a standard security message that appears that usage of the email and Internet facilities by them is subject to ongoing "surveillance by interception and monitoring of your activity". That is not unreasonable given that they are using a RailCorp computer in the workplace for such usage, 398That Brings the Board to a consideration of whether RailCorp has discharged the requisite onus and established that the three allegations are sustained. 399The Board finds that based on all the evidence before the Board, the only conclusion that is available to the Board is that Mr Ryan did access the CSW on both the Onboarders' computer and the Travel Centre computer, attempted to post a reply on the Onbaorder's computer and printed off material from the CSW on the Travel Centre computer having obtained blue paper and photocopying those printed extracts after being given access to Mr Neal's locked office by Mr Dove and he subsequently distributed those copies in the Onboarders' pigeon holes (with the exception of Mr Bishop's and one other). That conclusion is based on the evidence of Mr Dove and Mr Bishop (who found the material at 10 pm when it had not been there at the start of his shift and the forensic evidence. There is no evidence of a reliable nature that anyone else other than Mr Dove and Mr Ryan were at Albury Station when the access, printing and distribution took place. The evidence as to available access to the relevant areas of the Station given by RailCorp witnesses is consistent and taken with the evidence of Mr Engle (and Mr Dove) eliminates the Sydney crew from consideration. Further no-one could have accessed the Travel,Centre at that time without passing Mr Dove in the meal room. No RailCorp witness had any knowledge of spare keys in the luggage room and relevant witnesses (Mr Dove and Mr Macklan)maintained the door to Mr Neal's office was locked out of hours. There is absolutely no corroborative evidence whatsoever that the Board can find that would substantiate Mr Ryan's version of events. 400The Board does not consider that the evidence is entirely circumstantial, albeit that the actual printing and distribution of the material was not witnessed by Mr Dove (or anyone else) and that he did not see what documents were actually being photocopied. However the only person 'in the right place at the right time' was Mr Ryan and based on the evidence before the Board and on the balance of probabilities the Board finds that Allegations 1 (a), 2 and 3 are sustained. 401The Board also finds that Allegation 1 (b) concerning the access of the CSW on 18 June 2010 is sustained. Mr Ryan's evidence is not accepted as to his email access. While the forensic evidence does support his evidence that his email password was changed 8 times, the forensic evidence does not support his assertions concerning the nature of his password or its accessibility to other staff (unless he had told anyone his password. 402The Board has carefully viewed the video evidence and does not consider it possible that another employee could have accessed the CSW once Mr Ryan closed his emails the action of the cursor is too smooth and continuous and would literally have required someone to have placed their hand on the mouse (while standing behind/immediately next to Mr Ryan) as soon as he lifted his off the mouse whilst at the same time sliding into the seat as it is being vacated. The Board does not find this probable. 403In considering an appropriate penalty the Board has not had any particular regard for the previous decisions of the TAB (including the 'spin' sought to be placed on them by RailCorp). The Board has taken into account that here have been no issues raised as to Mr Ryan's work performance. 404The Board has carefully considered those issues of mitigation raised by the RTBU, however consideration must also be given to his ongoing denials in the face of the evidence before the Board. No alternative version of events is supported by any evidence. 405The Board considers that if Mr Ryan had only accessed and viewed the CSW that would not warrant any disciplinary outcome at all as acknowledged by Mr Wood. At that time employees (including Mr Ryan) had not been warned or advised that they should not access the CSW. The Board accepts that it was not appropriate to send out such advice (the Byford memo) pending attempts to identify those responsible for establishing the CSW. 406Similarly the Board does not consider attempts to post information or respond to the CSW, in the absence of any forensic proof that such an attempt was successful or the nature/content of the post/reply, would have warranted anything other than perhaps a caution or formal written warning. This lack of evidence contrasts with the distributed CSW material about which there was actual proof, that being the printed sheets themselves and their matching to the same postings on the CSW. 407It is one thing for an employee to view/access inappropriate or non-allowable material on a workplace computer in contravention of an employer's Internet usage policy, however once such material is forwarded on to other employees (unless for authorised purposes) then that becomes a very serious matter and breach of such policy. Depending on the circumstances (and the nature of the material) such action would warrant consideration of appropriate disciplinary action up to and including dismissal. 408The Board finds that the actual accessing and printing (on RailCorp resources) and distribution of the highly inappropriate www.countrylink.biz material to other RailCorp employees in the workplace by Mr Ryan on 29 May 2010 was completely contrary to the Code of Conduct and of such seriousness, given the content of the material, as to constitute misconduct for which dismissal was the appropriate penalty. 409The Board therefore is not prepared to set aside the decision of RailCorp to dismiss Mr Ryan from his position of Senior Passenger Attendant and his appeal (TAB12/1514) is disallowed. Order(s) 410The appeal is disallowed. Elizabeth Bishop Commissioner ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 31 July 2012