Mirus Australia Pty Ltd v Gage

[2017] NSWSC 1046

Supreme Court

New South Wales

• Summary available

Medium Neutral Citation:	Mirus Australia Pty Ltd v Gage [2017] NSWSC 1046
Hearing dates:	8 and 9 May 2017
Decision date:	11 August 2017
Jurisdiction:	Equity
Before:	Ward CJ in Eq
Decision:	(1) Declare that the first defendant was in contempt of this Court by engaging in the conduct in the circumstances described in Charge 1 of the Amended Statement of Charge. (2) Order pursuant to rule 14.28 of the Uniform Civil Procedure Rules 2005 (NSW) that [60]-[61] of the first defendant’s defence filed on 12 November 2015 be repleaded in accordance with these reasons and that the following paragraphs or part paragraphs of the said defence be struck out as an abuse of process of the Court: [60(b)]; those parts of [63]-[73] in which the first defendant “otherwise denies” the allegation to which the paragraphs respond (such as [63(e)]); [64(d)-(h)]; [65(b)]; [65(c)]; [65(d)] (the words in the chapeau “in order to do so” and subparagraphs (v)-(vii)); [65(e)]; [65(f)] (the words “in order to maintain the confidentiality of the information”); [65(g)] (the words “and again attempted” through to the end of that sub-paragraph); [65(h)] (the words “in order to maintain the confidentiality of the information”); [65(i)-(j)]; [66(c)-(e)] (insofar as they are intended to apply to Mr Gage’s defence); [66(f)]; [67]; [68(d)]; [69(c)-(e)]; [70(d)]; [71(d)]; [71(g)]; those parts of [72] which repeat answers to [62]-[71] that are to be struck out; [72(a)-(c)]; those parts of [73] which incorporate reference to parts of the defence that are to be struck out; those parts of [92] which repeat those parts of [65(d)-(h)] which are to be struck out; those parts of [93]-[94] which incorporate reference to paragraphs of the defence to be struck out; [103]-[104]; [107(b)] and that part of [109] of the defence insofar as those paragraphs repeat paragraphs of the defence that are to be struck out. (3) Direct the first and second defendants each to file an amended defence within 14 days, noting that the first defendant’s amended defence must accord with these reasons in relation to the paragraphs or part paragraphsof the defence the subject of the order in 2 above. (4) List the matter before me at 9.30 am on 18 August 2017 for further directions as to the filing of evidence and listing of the matter for a sentencing hearing in respect of the contempt of court committed by the first defendant. (5) The first defendant to pay the plaintiff’s costs of the respective notices of motion on an indemnity basis.
Catchwords:	CONTEMPT – criminal contempt – whether contempt can be committed if impugned conduct occurred prior to commencement of proceedings   PRACTICE AND PROCEDURE – abuse of process – deliberate deletion of electronic documents and records of electronic activity after commencement of proceedings – application to strike out parts of defence
Legislation Cited:	Aged Care Act 1997 (Cth) Civil Procedure Act 2005 (NSW), ss 56, 57, 58, 59, 60 Corporations Act 2001 (Cth), s 1317H Evidence Act 1995 (NSW), 140 Income Tax Assessment Act 1936 (Cth), s 263 Uniform Civil Procedure Rules 2005 (NSW), r 14.28
Cases Cited:	Australian Building Construction Employees and Builders Labourers Federation v Minister of State for Industrial Relations (1982) 43 ALR 189 Australian Securities and Investments Commission v Sigalla (No 4) (2011) 80 NSWLR 113; [2011] NSWSC 62 Anderson v Hassett [2007] NSWSC 1310 Ansell Rubber Co Pty Ltd v Allied Rubber Industries Pty Ltd [1967] VR 37 Arrow Nominees Inc v Blackledge [2000] EWCA Civ 200 Athens v Randwick City Council (2005) 64 NSWLR 58; [2005] NSWCA 317 Attorney-General v Butterworth [1963] 1 QB 696 Attorney-General v News Group Newspapers PLC [1989] 1 QB 110 Attorney-General v Sport Newspapers Ltd [1991] 1 WLR 1194 Attorney-General v Times Newspapers Ltd [1974] AC 273 Azzopardi v R (2001) 205 CLR 50; [2001] HCA 25 Briginshaw v Briginshaw (1938) 60 CLR 336; [1938] HCA 34 British American Tobacco Australia Services Ltd v Cowell (2002) 7 VR 524; [2002] VSCA 197 British Steel Corporation v Granada Television Ltd [1981] AC 1096 Clark v State of New South Wales (2006) 66 NSWLR 640; [2006] NSWSC 673 Clark v State of New South Wales [2012] NSWCA 139 Commercial Bank of Australia v Preston [1981] 2 NSWLR 554 Construction, Forestry, Mining & Energy Union v BHP Steel (AIS) Pty Ltd [2001] FCA 1758 Construction, Forestry, Mining and Energy Union v Boral Resources (Vic) Pty Ltd (2015) 256 CLR 375; [2015] HCA 21 Dupas v Channel Seven Melbourne Pty Ltd [2012] VSC 486 Farahbakht v Midas Australia Pty Ltd [2006] NSWSC 1322 Fuji Xerox Australia Pty Ltd v Lee [2003] QSC 303 Hearne v Street (2008) 235 CLR 125; [2008] HCA 36 Inghams Enterprises Pty Ltd v Timania Pty Ltd (2005) 221 ALR 823; [2005] FCAFC 155 James v Robinson (1963) 109 CLR 593 Jones v Australian Competition and Consumer Commission (2010) 189 FCR 390; [2010] FCAFC 136 Jones v Dunkel (1959) 101 CLR 298; [1959] HCA 8 Kirkpatrick v Kotsis [2004] NSWSC 1248 Lane v Registrar of the Supreme Court of New South Wales (Equity Division) (1981) 148 CLR 245; [1981] HCA 35 Mead v Mead [2007] HCA 25; (2007) 235 ALR 197 Meissner v R (1994) 184 CLR 132 Moody Kiddell & Partners Pty Ltd v Arkell [2013] FCA 1066 Ormonoid Roofing and Asphalts Ltd v Bitumenoids Ltd (1930) 31 SR (NSW) 347 Palavi v Radio 2UE Sydney Pty Ltd [2011] NSWCA 264 Palavi v Queensland Newspapers Pty Ltd (2012) 84 NSWLR 523; [2012] NSWCA 182 Raymond v Honey [1983] 1 AC 1 Registrar of the Supreme Court, Equity Division v McPherson [1980] 1 NSWLR 688 Reg v Gray [1900] 12 QB 36 RPS v R (2000) 199 CLR 620; [2000] HCA 3 R v Rogerson (1992) 174 CLR 268 Saunders v Federal Commissioner of Taxation (1988) 19 ATR 1289 Tate v Duncan-Strelec [2014] NSWSC 1125 The Prothonotary v Collins (1985) 2 NSWLR 549 Television New Zealand Ltd v Solicitor-General [1989] 1 NZLR 1 Weissensteiner v The Queen (1993) 178 CLR 217; [1993] HCA 65 Witham v Holloway (1995) 183 CLR 525; [1995] HCA 3 X v Amalgamated Television Services Pty Ltd (No 2) (1987) 9 NSWLR 575 Young v Smith [2016] NSWSC 1051
Texts Cited:	Laws of Australia at [10.11.1250] (current as at 1 September 2014) Lowe N and Sufrin B, Borrie & Lowe: The Law of Contempt (3rd ed, Butt, 1996)
Category:	Principal judgment
Parties:	Mirus Australia Pty Ltd (Plaintiff) Nicholas James Gage (First Defendant) Simon Wilson (Second Defendant)
Representation:	Counsel: T Brennan (Plaintiff) S Keizer (First Defendant)   Solicitors: HWL Ebsworth Lawyers (Plaintiff) Marque Lawyers (First and Second Defendants)
File Number(s):	2015/00261885
Publication restriction:	Nil

Judgment

1. HER HONOUR: Before me for hearing on 8 and 9 May 2017 were two related interlocutory applications brought by the plaintiff (Mirus Australia Pty Ltd) (Mirus) against one of its former senior employees (Mr Nicholas Gage), the first defendant. Another of its former senior employees (Mr Simon Wilson) is also a party to the proceedings (the second defendant) but the present interlocutory applications do not relate to or seek any relief in respect of him.

2. The applications in question, made by separate notices of motion each filed by Mirus on 2 August 2016, are: first, that Mr Gage be found guilty of contempt (the contempt motion) and, second, that certain parts of Mr Gage’s defence be struck out as an abuse of process (the strike out motion). Both applications are founded on allegations that Mr Gage deleted from certain of his computer devices documents and other electronic files of relevance or potential relevance to the present proceedings.

3. That Mr Gage deliberately deleted from computer and electronic devices in his possession a number of documents and files at least some of which contained information confidential to Mirus cannot be (and is not now) denied, having regard to the expert evidence to which I will refer in due course and to Mr Gage’s own admissions. What is in contention is when Mr Gage did so and what, if any, inference(s) should be drawn as to his intention or purpose in so doing. Mr Gage, as was his right (given that a finding of criminal contempt is sought against him), chose not to give any evidence at the hearing before me (whether to explain his actions or otherwise). However, parts of an affidavit affirmed by him earlier in the proceedings on 18 November 2016 were tendered by Mirus (ultimately without objection) as admissions by Mr Gage or otherwise to establish what it was that he had instructed his solicitors to communicate to Mirus as to his defence of the claim.

4. For the reasons that follow, I am satisfied that Mr Gage’s conduct was an abuse of process of the Court and that parts of the defence filed by him should be struck out. I am not persuaded beyond reasonable doubt that the second charge of contempt has been established. However, I am satisfied that the first charge of contempt has been established beyond reasonable doubt. Accordingly, it will be necessary to set a timetable for a sentencing hearing.

Background

5. Mirus provides advisory (and, it says, though this is denied by the defendants, information technology based) services specifically to operators of aged care facilities in Australia (statement of claim at [3]; defence at [3(a)]). The services it provides were described by its Counsel on the present applications as being “quite sophisticated cloud based information technology” (T 4.15). Its managing director has explained that Mirus uses a standard installation of Google Drive; that all email, calendar and file repository services are provided this way; and that Mr Gage set up this architecture (affidavit of James Edward Price sworn 3 September 2015 at [20]).

Mirus’ Medicare Data Capture Tool

6. The core of Mirus’ business is said to be a product referred to as the Medicare Data Capture Tool (statement of claim at [9]; T 4.16), which enables Mirus “to capture Medicare Australia data” from the Medicare Online web system (statement of claim at [13]) and to update that data in Mirus’ data repository on a daily basis (statement of claim at [14]). The defendants admit the allegations at [9], [13] and [14] of the statement of claim in the corresponding paragraphs of their defence.

7. Mirus alleges that the Medicare Data Capture Tool enables “almost real-time analysis of costs and revenue” for each aged care facility operated by its clients (statement of claim at [15]). The defendants deny this allegation and say that the Medicare Data Capture Tool is not used to analyse costs and revenue and does not gather costs data (defence at [15]).

Mr Gage’s and Mr Wilson’s employment with Mirus

8. Mr Gage was a senior employee of Mirus, employed at first by a related entity (Mirus Aged Care Metrics) from 1 March 2011 to about 1 December 2012, and then by Mirus – initially in the position of “Director” and then as “Director of Technology and Innovation” (statement of claim at [22], admitted at [22] of the defence). Mirus’ managing director has deposed that Mr Gage was employed for his expertise in information technology development solutions and that he was responsible for building Mirus’ information technology systems and processes as part of the business’ strategy to build a strong platform to underpin all business operations (affidavit of Mr Price at [26]) and that Mr Gage was responsible for “driving product innovation both in developing ideas for new products and managing the development of new products …” (affidavit of Mr Price at [27]).

9. Mr Gage resigned from his employment with Mirus on 13 July 2015 (defence at [22(e)]) and admits that his employment terminated on 7 August 2015 ([22] of the respective pleadings).

10. Mr Wilson, who as already noted is not the subject of the present applications, was employed to manage and lead Mirus’ sales capability (statement of claim at [39]; admitted in the defence at [39]). His employment with Mirus also ceased on 7 August 2015. Mirus alleges that there was an agreement that Mr Wilson’s employment would cease pursuant to a redundancy arrangement (statement of claim at [55]); Mr Wilson admits that Mirus terminated his employment on the basis of redundancy (defence at [55(d)]). What relevant difference there is, if any, between those two propositions is not clear but nothing turns on it for present purposes.

11. Mr Gage’s contract of employment contained (as did that of Mr Wilson) a restraint clause (cl 23.1) that precluded him, without Mirus’ prior written consent, from engaging directly or indirectly in a competing business within New South Wales and from solicitation of Mirus’ clients and employees, in each case for a period of 3 months from the date of termination of his employment. His contract of employment also contained (as again did that of Mr Wilson) obligations in relation to Mirus’ confidential information, as defined in the contract (see cll 21.1; 21.2), and provided for Mirus’ ownership of all intellectual property that he developed or conceived in the course of or arising out of his employment (cl 21.3).

A dispute arises in August 2015

12. The dispute between the parties arose after Mirus became aware (in August 2015) that the defendants were taking steps to set up a new business (the proposed Aged Care HQ business). Mirus’ solicitors communicated with Mr Gage by letter dated 24 August 2015, asserting that Mr Gage’s decision, in consort with Mr Wilson, to establish the proposed Aged Care HQ business was a breach of the non-compete obligations contained in the restraint clause. In that letter they demanded the delivery up of all of Mirus’ confidential information and intellectual property in Mr Gage’s possession custody or control. Legal action was expressly foreshadowed, including an application for injunctive relief, in both that letter and a further letter dated 26 August 2015 pressing for a response to the first letter of demand. Mr Gage then responded, in an unsigned letter received by Mirus on 26 August 2015, denying breach of the restraint clause. He did not, however, respond to the allegation that he was in possession of Mirus’ confidential information nor did he respond to the demand for the delivery up of such information.

13. By letter dated 28 August 2015, Mirus’ solicitors repeated their demand for the delivery up of confidential information, extending that to a demand that Mr Gage also deliver up all personal electronic storage devices for inspection. Further, the letter expressly put Mr Gage on notice that:

… you are not to destroy, remove and/or tamper with any documents/files in your possession, custody or control that may be the subject of anticipated litigation. Non adherence may result in contempt of Court.

14. Mr Gage instructed his then solicitors (Allens Linklaters) to respond to that letter. They did so by letter dated 3 September 2015 in which it was denied that Mr Gage had breached his employment-related obligations and had misused Mirus’ intellectual property or confidential information. Relevantly, the letter further conveyed Mr Gage’s instructions that Mr Gage was not in possession of any property belonging to Mirus and had no confidential information or intellectual property belonging to Mirus in his possession to deliver up (apart from a small USB drive that included some Mirus-related files and personal files, which it was said he would return, and the tablet computer and mobile phone he had used while working at Mirus, which it was said standard company practice permitted departing employees to retain and which it was said contained no Mirus confidential information).

15. In the defence filed after the proceedings that had been foreshadowed were in due course commenced, Mr Gage has admitted that on particular dates he copied certain material containing confidential information within the meaning of his contract of employment into his personal Google Drive account (see, for example [64]; [69] of his defence) and that he created certain “.zip files” on about 6 August 2015 which were downloaded to his personal Google Drive account (some but not all of which he accepts contained confidential information within the meaning of his contract of employment and/or contained confidential information of Mirus) (see for example [63], [65], [68], [70] of his defence). It must be concluded from this that the information conveyed to Mirus by Mr Gage through his then solicitors in their letter of 3 September 2015 was factually incorrect to the extent that any of the downloaded information containing what is now admitted to be confidential information of Mirus remained on any of Mr Gage’s electronic devices at that time.

Commencement of proceedings on 7 September 2015

16. Mirus commenced proceedings on an ex parte basis on 7 September 2015, seeking and obtaining orders for short service from Hallen J in the duty list. Those orders were served by email on Mr Gage’s solicitors (who had earlier acknowledged they had instructions to accept service) at approximately 12.30pm on 7 September 2015, together with a copy of the notice of motion and summons filed in Court and the sealed affidavits filed in support. Mr Gage’s solicitors were advised that the proceedings had been listed before Hallen J at 2pm on 8 September 2015. Mr Gage became aware of this relatively soon after the documents were served on his solicitors. In the affidavit later affirmed by Mr Gage on 18 November 2016, Mr Gage deposed (at [14]) that he became aware by about 1pm on 7 September 2015 that the proceedings had been commenced (see [61] below). His affidavit also makes clear (at [15]) that at that stage he turned his mind to which of his electronic devices might be the subject of orders for delivery up by him (see [61] below).

17. That afternoon, purportedly in an attempt “to allay Mirus’ apparent concerns”, Mr Gage’s solicitors indicated that the defendants would consent to certain of the relief sought in the summons, albeit with some modification.

18. Pausing here, there can thus be no doubt that by the afternoon of 7 September 2015 Mr Gage was on notice of the allegation by Mirus that he was in possession of confidential information belonging to it and as to the relief that Mirus was claiming in the proceedings. That relief included both an order for the delivery up of “all computers, media, USB storage and other electronic storage devices containing or which did contain the Confidential Information and the Intellectual Property which has been copied or backed up or subsequently deleted” (my emphasis) (see prayer 4 in the summons) and an order that, until further order of the Court, he be restrained from, inter alia, deleting or causing to be deleted the Confidential Information and the Intellectual Property on any computer or electronic storage device or cloud service account in his possession, custody or control (see prayer 3 in the summons). Moreover, he had been on notice since 28 August 2015 of Mirus’ demand that he not destroy, remove and/or tamper with any documents or files in his possession that might be the subject of the anticipated litigation and had been warned that, if he did so, he might be (or at least be accused of being) in contempt of Court. Thus the significance of deleting potentially relevant material from his electronic or computer devices as at 7 September 2015 can hardly have been lost on him.

The orders made by Hallen J on 8 September 2015 and the inspection regime

19. There was some negotiation between the respective solicitors as to the draft short minutes of order proposed by the defendants and then, when the matter came back before Hallen J on 8 September 2015, orders were made by consent pursuant to which the defendants were restrained until further order from certain conduct (broadly reflecting the terms of the restraint clause) (order 1(3)) and from conduct in relation to the “Confidential Information and the Intellectual Property” (orders 1(4) and (5)). The defendants were also ordered to deliver to their solicitors by 12 noon on 9 September 2015 certain identified devices (order 1(6)). (It is accepted that those devices did not identify a particular computer belonging to Mr Gage, referred to as PC05.) I set out below the terms of orders 1(4)-(6) in full.

1(4)   Upon the Plaintiff, by its Senior Counsel, giving the usual undertaking as to damages, order that the defendants be restrained until further order from accessing, downloading, transferring, interfering with, disclosing, copying using, or exploiting the Confidential Information and the Intellectual Property.

(5)   Upon the plaintiff, by its Senior Counsel, giving the usual undertaking as to damages, order that until further order of the Court, each of the defendants be restrained from:

(a)   causing any steps to be taken to access, download, transfer, interfere with, or copy the Confidential Information and the Intellectual Property, including but not limited to, assisting third parties to access, download, transfer, interfere with, or copy the Confidential Information and the Intellectual Property;

(b)   deleting or causing to be deleted the Confidential Information and the Intellectual Property on any computer or electronic device or cloud service account in the defendants’ possession, custody or control; and

(c)   taking any steps or causing any steps to be taken which may impede the recovery of the Confidential Information and the Intellectual Property.

Orders 5(a) [sic] includes, but is not limited to, access, downloading, transferring, interfering with or copying by way of remote access to the plaintiff’s servers, or by the use of cloud services or other computers or devices or media (including social media) platforms to the plaintiff’s servers in which the Confidential Information and Intellectual Property is stored or assisting third parties to do the same.

…

(6)   The defendants to deliver to their solicitors by 12 noon on 9 September 2015 in a sealed packet the following devices:

(a)   the first defendant’s iPad, serial number DLXM K0BUFLMQ:

(b)   the first defendant’s Samsung S5 mobile phone, IMEI number 353423060684385;

(c)   the second defendant’s iPad, serial number DLXLH0ZHF4YF;

(d)   the second defendant’s iPhone, serial number C39LLM6TFRC8;

(e)   the USB drive referred to in section 3(a) of the letter from Allens to HWL Ebsworth dated 3 September 2015;

(f)   the first defendant’s Surface tablet; and

(g)   the first defendant’s home laptop computer.

20. The agreed orders did not make provision for the regime by which the identified electronic devices would be delivered up for inspection by Mirus’ computer experts. This was the subject of correspondence between the respective solicitors between 8 and 10 September 2015. In the course of that correspondence, Mirus’ solicitors sought confirmation that the devices delivered up in accordance with his Honour’s orders (referring in that regard, apparently mistakenly, to order 7) were “all the devices in your clients’ possession, custody or control”. That elicited a response from the defendants’ solicitors that:

It was not apparent to us that your proposed regime dealt with cloud-based accounts

and they then indicated that the defendants “in the spirit of co-operation” would make available for inspection their respective “Dropbox” and other similar accounts. There was no reference at that stage to any other computer (relevantly, PC05) in Mr Gage’s possession.

21. The inspection regime agreed between the parties on 11 September 2015 provided for Mirus’ computer expert to obtain a forensic image of, and review, the devices which had been delivered up pursuant to the orders of 8 September 2015, including access to the defendants’ cloud-based accounts (see cll 7-9 of the inspection regime agreement).

22. The forensic imaging process commenced at about 12.30pm on 11 September 2015 in the offices of Allens Linklaters. One of Mirus’ solicitors (Ms Stuckey-Clarke) has deposed (in an affidavit sworn 2 August 2016) to a conversation (on which she was not cross-examined) with a senior associate of Allens Linklaters (Mr Ratu) in the presence of Mr Gage that afternoon in words to the following effect:

Ms S-C:   We need to make sure that all devices that contain Mirus Australia’s confidential information and intellectual property have been delivered up. Please confirm that the devices that have been delivered up today by your clients [first and second defendants] are all the devices in their possession relevant to the proceedings?

Mr R:   Yes. Those are my instructions. These are the only devices with confidential information on them.

Mr Gage:   Yes, that’s all of it.

Ms S-C:   Does that mean that there are no other devices at home or elsewhere which you use or store information on?

Mr Gage:   There are no servers at home.

Mr R:   The devices being imaged today are the only devices relevant to the Proceedings.

23. As it turned out, that was not correct (see [25] below), though I do not suggest that Mr Gage’s solicitor was aware of this at the time.

24. Steps were then taken by Mirus’ computer expert (Mr Michael Khoury of Ferrier Hodgson), who had already produced an initial report of 4 September 2015 based on his inspection of Mirus’ devices, and the defendants’ expert (Mr Nigel Carson of KordaMentha) to inspect the devices that had been delivered up in response to his Honour’s orders. A number of reports were prepared by each, culminating in the preparation of a joint expert report which was signed on 28 April 2017. (The two experts gave evidence concurrently at the hearing before me.)

25. It became apparent during the course of the forensic inspection of one of the devices (PC04) that there was another computer on which Mirus confidential information might have been located (PC05). That led to the delivery up of that computer pursuant, as I understand it, to orders made by consent by Hallen J on 28 April 2016.

26. The defendants’ 3 month contractual restraint period expired on 6 November 2015. After some opposition by Mirus, the injunction imposed by order 1(3) was discharged by consent (see the orders made by Hallen J on 28 April 2016). However, the other injunctions granted by Hallen J on 8 September 2015 remain in place.

27. Mirus’ present solicitors have confirmed to Mr Gage’s present solicitors (by letter dated 24 June 2016) that Mirus is pursuing a claim for damages but Mirus has filed no further evidence at this stage. Indeed, as I understand it, no further steps have been taken in the substantive proceedings since the filing on 2 August 2016 of the motions presently before me.

The relevant devices

28. I have already adverted to various of the electronic devices and cloud storage accounts to which reference will be made when considering the deletions in question. For completeness, those devices and accounts are: PC01 (Mr Gage’s principal work computer while at Mirus); Mr Gage’s Personal Google Drive account (which is a distinct account from his Mirus Google Drive account); the Surface Pro (Mr Gage’s principal working laptop computer following completion of his employment with Mirus); PC05 (Mr Gage’s principal home computer, on which he had installed a “virtual” computer machine or system named “DARWIN” and another named “NEWTON”); and PC04 (Mr Gage’s “old” personal home computer). Mr Gage has explained (at [88] of his 18 November 2016 affidavit) that DARWIN is a virtual server that he used for file storage.

29. Relevantly, for the purpose of explaining the basis for some of the inferences that Mirus submits should be drawn from Mr Gage’s conduct, the Surface Pro did not “synchronise” with Mr Gage’s personal Google Drive account but PC04 and PC05 did synchronise with that account from time to time. Whether and when the last complete synchronisation occurred between PC04 and Mr Gage’s personal Google Drive account is of significance and is something on which the experts were initially in disagreement. However, this seems now to be agreed (see [30] below).

30. The computer experts (Mr Khoury and Mr Carson) are of the view that there was a synchronisation between PC04 and Mr Gage’s personal Google Drive account on 17 August 2015 and that what is on PC04 under the Google Drive folder represents the state or the content of Mr Gage’s personal Google Drive account as at that date. Mr Khoury now accepts that a successful synchronisation between PC04 and Mr Gage’s personal Google Drive account did not occur on 8 September 2015 (since certain activities recorded in Mr Gage’s personal Google Drive account between 17 August 2015 and 8 September 2015 are not reflected in the locally cached copy of files and folders on PC04) (see [65] of his report dated 31 January 2017).

31. Mr Khoury's position is that either there was no synchronisation after 30 August 2015 between PC04 and Mr Gage’s personal Google Drive account or, alternatively, there was only a partial synchronisation after 30 August 2015, which means that some files were synchronised and some files were not (see T 38). Mr Khoury accepts that what that means is that he cannot be certain as to when, after 30 August 2015, the files on the personal Google Drive account were deleted, though he is certain it did not happen before 30 August 2015 (for the reasons, as I understand them, set out at [38] below). It had clearly happened by 11 September 2015 because that is the date on which Mr Gage’s personal Google Drive account was made available for inspection and the files were not located on the Google Drive account at that time.

What was downloaded/copied?

32. Before considering in detail the chronology of events that occurred in relation to the deletions, it is useful to summarise the allegations Mirus makes as to the copying or exporting by Mr Gage of Mirus’ confidential information (contained at [62]-[71] of the statement of claim).

33. It is alleged: that, during the course of his employment Mr Gage transferred confidential information of Mirus onto a portable storage device (a USB) ([62]); that on 17 June 2015 he copied the Medicare Data Capture Tool and an “SQL Database” into his personal Google Drive account ([63]); that on 10 July 2015 he copied confidential financial and management reports of one of its clients into his personal Google Drive account ([64]); that on 21 July 2015, he exported the contents of the Capsule CRM (client relationship management system) into his personal Google Drive account under the folder named “NickSi” and gave access thereto to Mr Wilson ([65]-[66]); that on 23 July 2014 he copied various other files to his personal Google Drive account ([68]); that on 24 July 2015 he copied Mirus’ balance sheet and profit and loss statement into his personal Google Drive account ([69]); that on 29 July 2015 he copied other confidential information into his personal Google Drive account ([70]); and, finally, that on 6 August 2015 (i.e., the day before his employment with Mirus ceased) he copied other confidential material into his personal Google Drive account ([71]).

34. The download on 6 August 2015 was described by Mirus’ Counsel as the downloading of the coding for all of the “back-end IP” and a number of Mirus databases, including the whole of the contents of the Mirus Client Relationship Management database (Mirus CRM database) (see T 4.43).

35. In summary, Mr Gage does not dispute having downloaded/copied that material (though he says that was done on 6 August 2015 by way of “zip files” and, in his defence, he proffers what might be described as an “innocent” explanation for so doing (see [65(f)] of the defence in relation to the CRM Zip File)). He also admits that he deleted all (or perhaps more precisely it might be said that he deleted some and attempted to delete all) of that material from his computer devices. What was not deleted was the material on PC04 because of an oversight pleaded by Mr Gage at [83(c)] of his defence – see [41] below). However, he says that not all of the material he downloaded (and by extension presumably not all the information he deleted) was confidential information.

The alleged deletions

36. Mirus alleges that there were three separate instances or episodes of electronic data deletion.

The Surface Pro deletions on 7 September 2015

37. First, it is alleged that on the evening of 7 September 2015 (after service of the summons and Mirus’ application for interlocutory orders, including for the delivery up of the Surface Pro, as well as service of the affidavits upon which Mirus was relying and its first expert report, but before any substantive orders were made restraining the deletion of documents) Mr Gage deleted Mirus folders and files from his Surface Pro laptop by use of a Microsoft operating system application called “SDELETE” (the Surface Pro deletions). Mirus complains that as a result “much of the evidence of manipulation or use of those files by Mr Gage” has been destroyed (Mirus’ written submissions at [20]). (Although Mr Gage submits that it is speculation to refer to “evidence of manipulation or use”, properly understood Mirus’ complaint is that it now cannot ascertain what, if any, manipulation or electronic use was made by Mr Gage of those files prior to their deletion.)

The cloud storage deletions between 29 August 2015 and 11 September 2015

38. Second, it is alleged that at some time between 29 August 2015 and 11 September 2015 (i.e., at some time in a period spanning both before and after the commencement of the proceedings; and potentially after the interlocutory orders were made on 8 September 2015 though no complaint is here made of breach of those orders), Mr Gage deleted from his personal Google Drive account the electronic data contained in two folders (the “Mirus Stuff” and “NickSi” folders) (the cloud storage deletions). All of those files had been deleted from Mr Gage’s personal Google Drive account by 11 September 2015, when the forensic expert took an image of that account. Mirus says that since the “Mirus Stuff” folder (and Mirus’ files containing the computer coding for Mirus’ programs) was downloaded from Mr Gage’s personal Google Drive account to the PC05 computer on 30 August 2015, it is to be inferred that that folder and its files were deleted from Mr Gage’s personal Google Drive account at some time between 30 August 2015 and 11 September 2015 (T 3). Again, the result of that deletion is that recovery of the deleted files (in whatever form they were in on Mr Gage’s personal Google Drive account as at the date of deletion) has been prevented and Mirus complains that Mr Gage has thereby destroyed evidence of manipulation or use of those files by Mr Gage up to at least 30 August 2015 and possibly up to 11 September 2015.

The PC05 deletions on 11 September 2015

39. Third, it is alleged that close to midnight on 11 September 2015, after his other devices had been delivered up for inspection, Mr Gage deleted electronic data from PC05 using “CCleaner” and then “Recuva” (the PC05 deletions) (for a description of those applications see [76]-[78] below). The first of those programs (CCleaner) is a program that “securely deletes” files from a computer hard drive. The second (Recuva), which was used by Mr Gage after he had run the CCleaner program and immediately after he had accessed the internet to undertake searches as to how securely to delete data, is a program the primary application of which is to scan a computer to identify previously deleted files and to allow the user securely to erase those already deleted files from the hard drive. Mirus submits that the only purpose of its use is wholly to destroy any records of a file having been on a computer; and that since, immediately before running Recuva, Mr Gage undertook internet searches about it, it is to be inferred that he well knew its purpose and intended to use it for that purpose.

40. Mirus says that the metadata recovered from PC05 is sufficient to show that Mr Gage had succeeded in moving some unidentified amounts of the data from the Mirus CRM database to cloud based applications in respect of which Mr Wilson was able (whether he did or not) to have access; and says that the running of Recuva resulted in destruction of all of the evidence of what files and data Mr Gage had in fact moved to the “cloud”. Thus it is said that the running of Recuva also resulted in destruction of any evidence of manipulation or use of Mirus’ files by Mr Gage up to 11 September 2015.

Mr Gage’s “oversight”

41. Mirus says that, in a practical sense, Mr Gage’s “destruction scheme” came undone by the “oversight” pleaded by Mr Gage at [83(c)] of the defence. Paragraph 83 of the defence contains the defendants’ response to the same numbered paragraph of the statement of claim in which it is alleged that, from the date of each copying or download, Mr Gage has been and but for the interlocutory injunction of the court would remain able to access each of the files the subject of the specified downloads from any computer, tablet, phone or other device connected to the internet and copy all or any of those files to any such device. The defendants have admitted that allegation but go on to say that

83   …

(a)   prior to the grant of the interlocutory injunction, the first defendant deleted all the files pleaded in paragraph 83 of the Statement of Claim from his personal Google Drive account;

(b)   the first defendant believed that doing so would result in the deletions flowing down to all synchronised devices, so that he would not be able to access any of the files through any synchronised device; and

(c)   due to an oversight by the first defendant, his laptop (PC04) was not properly synchronised and hence the files remained available to him through his laptop (my emphasis)

42. The result of that admitted “oversight” on Mr Gage’s part is that it is now known what was on Mr Gage’s personal Google Drive account on 17 August 2015, by reference to what remained on PC04 when it was inspected on or after delivery up on 11 September 2015. However, to anticipate what follows later in these reasons, Mr Gage submits that the Court cannot be satisfied beyond reasonable doubt that the SurfacePro or cloud storage deletions took place either after the making of the orders on 8 September 2015 or after the commencement of proceedings on 7 September 2015. Pausing there, what is however established from Mr Gage’s own admissions in the verified defence (see [83]), is that the deletions were intentional and that Mr Gage believed that by deleting the data (which occurred before PC04 was delivered up for inspection) this would result in “the deletions flowing down to all synchronised devices”, of which he must have assumed PC04 was one.

Detailed chronology of events

43. At this stage it is helpful to consider in detail the evidence as to what occurred in relation to the computer coding that was downloaded by Mr Gage, separately from the evidence of events in relation to the Mirus CRM database.

Coding

44. On or by 6 August 2015 (the date on which Mr Gage puts the timing of the download – see [63]-[67], [71] of the defence), which was the day before his employment with Mirus terminated, Mr Gage downloaded the coding of the Medicare Data Capture Tool to his personal Google Drive account by creating a zip file. Because there was synchronisation between Mr Gage’s personal Google Drive account and PC04, that zip file was also downloaded or copied to PC04.

45. As there was no synchronisation between Mr Gage’s personal Google Drive account and the Surface Pro, the file did not automatically download to the Surface Pro. On 13 August 2015, Mr Gage downloaded the coding from his personal Google Drive account (via a “TFS.zip” file) to the Surface Pro. Mr Khoury considers it most likely that the “TFS.zip” file (containing the coding) was downloaded via web browser access to the Google Drive cloud storage rather than through synchronisation since Mr Gage’s personal Google Drive account was not directly synchronised with the Surface Pro (as already noted – see [29] above). Mr Khoury notes that the “TFS.zip” file was present (when PC04 was later inspected, I assume) within the local Google Drive cache on PC04 in the folder “Mirus Stuff” (see [23], Mr Khoury’s 15 January 2016 report). Mr Khoury says that a folder titled “TFS” was extracted from the “TFS.zip” file at 9.54am on 13 August 2015 (see [57], Mr Khoury’s 31 January 2017 report).

44. The “TFS” folder contained some 3,000 files of database and software coding (the coding for Mirus’ programs, for the development of which Mirus says Mr Gage had been principally responsible and which it says was highly confidential). As already adverted to, the content of what was downloaded can be ascertained because it still resides on PC04.

45. On 14 August 2015 at 3.22pm, nine files were created in the “TFS” folder on the Surface Pro, including four output files relating to a program named “AccreditationCheck.vshost”, the creation of which (according to Mr Khoury) indicates that source code relating to the “AccreditationCheck” program within the TFS folder was “compiled” (see [58]-59] of Mr Khoury’s report dated 31 January 2017), or turned into a useable program. That same file of coding was later downloaded on 30 August 2015 from the Google Drive to PC05 – Mr Gage’s personal desktop computer at home which was not produced for inspection until April 2016.

Creation of “Mirus stuff” and “NickSi” folders on 17 August 2015

48. On 17 August 2015, Mr Gage created two folders on his personal Google Drive account: “Mirus Stuff” and “NickSi” (the latter, one might infer, being an amalgam of the first names of the two defendants). Mr Khoury describes the respective folders (at [93]-[94] and [106] of his 31 January 2017 report) and concludes that it was not possible for the “Mirus Stuff” and “NickSi” folders to have been shared from Mr Gage’s Mirus Google Drive account. He explains that the local cache copy of Mr Gage’s personal Google Drive account on PC04 contains the “Mirus Stuff” and “NickSi” folders created as a result of the synchronisation between that personal Google Drive account and PC04 on 17 August 2015 and says that those folders do not exist in the local cache copy of PC01 (the Mirus work computer), which was forensically preserved as at 21 August 2015 (see [94]). Pausing here, the 17 August 2015 date is significant because (as already noted) Mr Khoury accepts that this was the last date on which there was a full synchronisation between Mr Gage’s personal Google Drive account and PC04.

Events following communications from Mirus’ solicitors

49. On 24 August 2015, Mirus’ solicitors sent the first letter of demand (see [12] above), demanding the delivery up of Mirus’ confidential information and foreshadowing the commencement of proceedings. (Mirus submits that, on receipt of this letter, Mr Gage knew of the scope of the likely dispute and knew that if he did not deliver up that which was demanded then that dispute would occur in this Court. Mirus further says this is clear from Mr Gage’s affidavit of 18 November 2016 at [9]-[11].)

50. On 25 August 2015, after Mirus’ first letter of demand was sent, a file of financial data (namely, “Ozcare Financials FY 2015.pdf”) relating to one of Mirus’ clients (Ozcare) was moved from one folder on Mr Gage’s personal Google Drive account (namely, the “Share between Mirus Drive & Personal” folder) to the “NickSi folder” (see [76(a)], Mr Khoury’s 31 January 2017 report). The “Share between Mirus Drive & Personal” folder, as I understand it, was a folder in which something downloaded from Mr Gage’s work computer (that is, PC01) to his Mirus Google Drive account would then appear on his personal Google Drive account. According to Mr Khoury (at [76(a)]), the movement of the “Ozcare Financials FY 2015.pdf” file between folders shows that the former folder (the “Share between Mirus Drive & Personal” folder) was no longer the “root location” of the “Ozcare Financials FY 2015.pdf” file. Also on that date, the “Share between Mirus Drive & Personal” was placed into the “Bin”, i.e., identified as “trash” (see [76(b)] of Mr Khoury’s report). In other words, that share folder was then removed from Mr Gage’s personal Google Drive account.

51. Mr Gage’s position at that stage (as asserted by him in the unsigned letter received by Mirus on 26 August 2015) was, as repeated in the defence he later filed, that he was not seeking to compete with Mirus and that the products which he and Mr Wilson would be seeking to deliver would not be products competing with Mirus’ products.

52. Mr Khoury has also identified that on 26 August 2015 (the same day Mr Gage was asserting to Mirus a lack of intention to compete with Mirus), a file from the “Mirus Stuff” folder on Mr Gage’s personal Google Drive account was moved to the Aged Care HQ folder on his personal Google Drive account (see [76(c)] of the 31 January 2017 report).

53. On 28 August 2015, the third letter of demand from Mirus’ solicitors was sent (see [13] above). That letter advised Mr Gage that Mirus had engaged an independent forensic information technology specialist to undertake an investigation and that the investigation had identified a large repository of Mirus’ confidential information and intellectual property on Mr Gage’s Dropbox account (described as files relating to management records, marketing and business plans and specific client related documents; and giving OzCare as an example). (It is submitted by Mirus that on receipt of that letter Mr Gage knew: that litigation was likely; that delivery up of all personal devices upon which any of Mirus’ information had been located would be sought in those proceedings; and of the obligation not to destroy material which was potentially relevant in that foreshadowed litigation.) That letter demanded a full explanation as to why Mr Gage had established a Dropbox account (a competitor cloud service to Google Drive) and accessed it from work computers, in circumstances where it was asserted that there was no business need for him to do so, and demanded that he provide a full itemised list of all documents and files comprising Mirus’ business records located on his Dropbox account.

54. At 1.51pm on 28 August 2015, Mr Gage accessed Mirus’ internal Dropbox account (see [39] of Mr Khoury’s 15 January 2016 report), by, it was suggested, logging in using a password that he had from his time of employment with Mirus. (Mirus says it can be inferred that this was to “see what they had on him” – T 69.)

55. Then, on 30 August 2015 (a date to which Mirus attaches some significance since it was two days after receipt by Mr Gage of the 28 August 2015 letter of demand – see [13] and [53] above), Mr Gage’s user account “untrashed” the “Share between Mirus Drive & Personal” folder (see [76(d)], Mr Khoury’s 31 January 2017 report). That had the effect, as I understand it, that the “Share between Mirus Drive & Personal” folder would once again appear as a folder on Mr Gage’s personal Google Drive account. On the same day, Mr Gage’s user account restricted access to the file named “Ozcare Financials FY 2015.pdf” contained in the “NickSi” folder and the Ozcare Financials pdf file was moved back from the “NickSi” folder to the “Share between Mirus Drive & Personal folder” ([76(e)-(f)]). (Mirus contends that this was done to make it look as if the Ozcare Financials file was on Mr Gage’s personal Google Drive account from a time when he had shared it with himself while he was working at Mirus and that it had not been shared with Mr Wilson – see T 58.)

56. Mr Khoury’s analysis of a keyword search on Mr Gage’s devices for records containing the words “Mirus Stuff”, “NickSi” or their Google document ID’s (see [78] of the 31 January 2017 report) identified that on 30 August 2015 the PC05 computer had accessed the personal Google Drive account and downloaded the “Mirus Stuff” folder at 2.52pm and that the same computer accessed the “NickSi” folder approximately seven minutes later (at 2.59pm on 30 August 2015). Mr Khoury explains that in his searches of PC05 he identified “a type of artefact” commonly referred to as a “Shellbag” pertaining to a zip file named “Mirus Stuff-2015-08-29” which he says was created on 30 August 2015 at 2.52pm in the downloads folder located in the “Darwin virtual machine on PC05” (see [110] of the 31 January 2017 report). Mr Khoury notes that the file name format of the zip file is consistent with the naming convention format adopted by Google when a user downloads a folder from a Google Drive account. In other words, this suggests that the Mirus Stuff folder was accessed within Google Drive at that time. He says that analysis of that Shellbag artefact shows that the primary folder contained within the zip file was a folder named “Mirus Stuff” and says that this zip file was no longer present in the downloads folder on PC05 (when later inspected) and was therefore moved or deleted ([111]-[112]).

57. By reference to what now remains on the PC04 device, Mirus says that it can be inferred that, as at 17 August 2015, there was a file on Mr Gage’s personal Google Drive titled “Mirus Stuff”, which file included the Mirus CRM database and the “TFS.zip” file containing the computer coding of its programs and databases. Mirus further says that, since the “Mirus Stuff” folder was downloaded to PC05 from the personal Google Drive account on 30 August 2015, it must logically have been on the personal Google Drive account on that date (see T 9.18). 30 August 2015 is thus the earliest date that has been identified by Mirus as the possible date of the cloud storage deletions. By that stage, it must have been clear to Mr Gage from the various letters of demand that the threatened legal proceedings were now imminent and that Mirus was likely to require production of the content of his personal Google Drive account. Certainly, by that stage proceedings had been well and truly foreshadowed. The coincidence in timing of the access by PC05 to the “Mirus Stuff” and “NickSi” folders and the downloading to PC05 of the “Mirus Stuff” folder (see [56] above) is of note when it is remembered that that device was not identified as a relevant device, nor was it offered up for inspection, on 7/8 or 11 September 2015.

58. On 3 September 2015, Allens Linklaters wrote (on Mr Gage’s instructions), denying any breach and conveying Mr Gage’s instructions that neither the Surface Pro nor his computers or mobile phones contained any Mirus confidential information (see [14] above).

59. An examination later by Mr Khoury of the “volume shadow copy” taken by the Surface Pro at 4.19am on 4 September 2015 (i.e., the day after Mr Gage’s solicitors had on his instructions denied that he had any Mirus confidential information in his possession) identified that a substantial number of files and folders relating to Mirus were present on the Surface Pro (see [17] of his 15 January 2016 report). Mr Khoury says that those files and folders are no longer on the Surface Pro but that the system artefacts left by the secure deletion process that took place on 7 September 2015 (to which I will refer shortly) indicate that those Mirus related files were subject to the secure deletion process on 7 September 2015.

Events occurring on 7 September 2015

60. That brings me to the date of service of the summons and notice of motion (7 September 2015). A copy of Mr Khoury’s first expert report of 4 September 2015, together with an affidavit of Mr Robert Covino, the co-founder of Mirus, sworn 7 September 2015, was also served at that time.

61. As already noted, in the affidavit affirmed by Mr Gage on 18 November 2016 he deposed (at [14]) that he became aware at around 1pm on 7 September 2015 that his solicitors had been served with court documents. He went on to say (at [15]) that:

After I became aware of the 7 September Orders, it became apparent to me that the Court may make orders requiring me to deliver up any devices which may contain files or information related to Mirus.

62. Mr Gage deposed that he then identified four further devices (in addition to the Mirus USB) which he believed contained confidential files that had information that related to Mirus (those included the Surface Pro and PC04 – but not PC05) ([15]) and that he had identified them on the basis that they were devices that he had used within the preceding 12 months in respect of work he had undertaken in relation to Mirus ([16]). Relevantly, however, less than two weeks before Mr Gage admits he turned his mind to what devices might contain files or information related to Mirus, he had accessed both the “Mirus Stuff” and “NickSi” folders on his Google Drive account via PC05 and had downloaded material pertaining to the “Mirus Stuff” files to PC05 (see [56] above).

63. On 7 September 2015, Mr Gage’s user account restricted access by Mr Gage himself to the Ozcare Financials file (see [76(g)] of the 31 January 2017 report), as a result of which Mr Khoury says the file would likely have been caused to be removed from Mr Gage’s personal Google Drive. (Thus, by 11 September 2015, when Mr Gage’s personal Google Drive was produced for imaging, the Ozcare Financials file was not present on that device.)

64. Mr Khoury’s analysis of the Surface Pro (one of the devices that Mr Gage says in his affidavit (at [15]) that he had identified on 7 September 2015 as a device he might be ordered to deliver up) identified that approximately 7,000 files and folders were deleted between 6.33pm and 7.36pm on 7 September 2015 (see [25] of Mr Khoury’s 20 July 2016 report; and [7(c)] of Mr Khoury’s 15 January 2016 report). Mr Khoury’s analysis of the volume shadow copies present on the Surface Pro showed that a folder of some 1,100 files and folders was deleted at that time, of which the term “Mirus” was located in a number of deleted folders and files (see [11]-[12], Mr Khoury’s 24 February 2016 report).

65. Mr Khoury says that those deletions occurred through the use of a Microsoft operating system – the secure erasure application called SDELETE. Mr Khoury says this makes the task of recovering names and other pertinent details about the files extremely difficult and/or impossible to retrieve “since these tools are intended to destroy data in such a way as to ensure they cannot be recovered through forensic or other specialised procedures” and that the files and their contents are subsequently unrecoverable (see [25], Mr Khoury’s 20 July 2016 report). Therefore, although the names of the folders and files deleted have been identified on a forensic inspection of the Surface Pro, the use of the SDELETE software has prevented the recovery of the actual files that were deleted.

66. Mr Khoury was, however, able to identify the specific times at which the SDELETE program was run within a folder to target the specific files containing Mirus’ code. In particular, Mr Khoury was able to analyse the “Windows Prefetch files” relating to the SDELETE program and says that it was run from three separate locations on the Surface Pro at particular times (see [35], Mr Khoury’s 31 January 2017 report; those folder locations being identified at [41] of his report). Mr Khoury identified that some of the last files accessed by the SDELETE program (by reference to the Prefetch file SDELETE.EXE-6E8F6D30.pf) were files with titles include the words “Code” and “MYAGED CAREDOWNLOADER” and “ACCREDITATION CHECK” (see [39] of the same report).

67. Later in the evening of 7 September 2015 (at 10.56pm), Mr Gage ran an internet search from the Surface Pro using the phrase “Restrict access to google drive specific devices”. Mr Khoury’s review of website activity on PC05 similarly identified a Microsoft Internet record showing a search result referencing the words “how to remove a document from activity view in google drive”, which he says indicates that Mr Gage conducted a Google search at 11.59pm on 7 September 2015 with that query (see [79], Mr Khoury’s 31 January 2017 report). Mr Khoury identified an online visit to a web page containing those words approximately 12 seconds later (see [79]-[80], 31 January report). Approximately 7 minutes later, there appears to have been a failed attempt to access the “NickSi” folder on the Surface Pro (12.06.59am on 8 September 2015 - see [78(c)], Mr Khoury’s 31 January 2017 report).

68. Therefore, on the evening before and the early hours of the very day on which Mr Gage knew he was likely to be required to deliver up devices for inspection (his own solicitors having put forward a delivery up regime to allay Mirus’ concerns) he was engaged in a process of seeking to conceal evidence on his computer devices of activity in relation to Mirus files on those devices. Even if (which strains credulity having regard to the overall history of what occurred) it were the case that Mr Gage had decided to delete confidential files from which he had only attempted to extract “non-confidential” material in order to maintain the confidentiality of the information (see [65] of his defence), that does not explain his obvious attempt to conceal any record of that activity.

Events occurring on 8 September 2015

69. The consent orders for delivery up of computer devices (not including the PC05) were made at about 2pm on 8 September 2015.

70. There is evidence of a failed login to PC04 on the afternoon of 8 September 2015 (see Mr Carson’s report of 18 November 2016 at [38], annexed to his affidavit affirmed 22 November 2016). Mr Carson reports that it appears to him that the username and password credentials stored on PC04 were no longer working. The relevance of this seems to be that Mr Carson has concluded that, by then, PC04 was no longer able to synchronise with Mr Gage’s personal Google Drive account. Mr Khoury, however, was unable to confirm whether the relevant error report “directly translates to a failed login” (see [62]-[64], 31 January 2017 report). What Mr Khoury does accept (at [65] of his report) is the conclusion by Mr Carson that there is no evidence to support a contention that PC04 had synchronised with Mr Gage’s personal Google Drive account on 8 September 2015 (see [37] of Mr Carson’s report of 18 November 2016, noting that the “sync-log.log” corroborates the file listing that “TFS.zip” was the last recorded file downloaded at 10.05pm on 17 August 2015).

71. Mirus argues, as I understand it, that it can be inferred that the unsuccessful attempt to gain access to PC04 on 8 September 2015 was an attempt to trigger a synchonisation process between it and the Surface Pro, since the latter did not automatically synchronise with Mr Gage’s personal Google Drive account. Mirus points to what is pleaded in the defence at [83(c)] (see [41] above) and says that, had that log-in worked as Mr Gage expected it to have worked, the material which was later found on PC04 would not have been found but would instead have been deleted from PC04; and if that had occurred, none of the devices which were delivered up on 11 September 2015 would have contained any of Mirus’ confidential information or intellectual property.

72. Mr Khoury identified on his analysis of internet browser records on PC04 that three Microsoft searches were undertaken later on 8 September 2015 under a user profile entitled “Nick”: at 5.28pm on 8 September 2015 (“Delete files that are deleted”); at 6.34pm on 8 September 2015 (“Clear remote desktop”), and at 6.46pm on the same day (“remove remote desktop entries windows 8”) (see [11], Mr Khoury’s 20 October 2015 report). Mr Khoury says that the combination of keywords in the first search is likely to return websites pertaining to information on how permanently to delete files from a computer system; the other two searches are likely to return websites pertaining to information on how to delete historical records relating to remote desktop connections made on a computer running a Microsoft Windows operating system (see [12], Mr Khoury’s 20 October 2015 report). (I note that those searches were conducted after orders for the delivery up of particular devices and prohibiting the deletion of, or impeding the recovery of, the confidential information on “any computer or electronic device or cloud service account” in Mr Gage’s possession custody or control were made.)

73. Mr Khoury has also identified (from an analysis on the virtual machine contained within PC05 named “DARWIN”) that at 5.38pm on 8 September 2015 (i.e., again, after the delivery up orders were made and, not insignificantly, after the injunction was made restraining Mr Gage from the conduct referred to at order 1(5) of the orders as set out above), the application “CCleaner” was installed on “DARWIN”. At 6.30pm on 8 September 2015, PC04 connected to “DARWIN” (the virtual server within PC05) via a remote desktop connection (see [6] of Mr Khoury’s 20 October 2015 report).

Events occurring on 11 September 2015 and the PC05 deletions

74. Then on 11 September 2015, various of Mr Gage’s devices were delivered up for inspection (including the PC04 and Surface Pro but not PC05). No Mirus “Intellectual Property” was identified as stored on Mr Gage’s personal Google Drive account nor were the “Mirus Stuff” and “NickSi” files present on the personal Google Drive account. Those folders were, however, present on PC04.

75. At 11.36pm on 11 September 2015, after the forensic imaging process had commenced on the devices delivered up that day and after the conversation had taken place between Ms Stuckey-Clarke and Mr Ratu at which Mr Gage was present (referred to at [22] above), the application “CCleaner” was installed and run on PC05.

76. Mr Khoury has explained that CCleaner is commonly used for cleaning temporary files and other residual data that accumulates on a computer over time, such as temporary internet files generated by the Windows operating system. Mr Khoury accepts that one of its uses is for the purposes of optimising a computer and freeing up disk space but he says that it is also able to perform other deletion activities such as: securely wiping free space on a hard drive; securely wiping information about files and folders that have been accessed by a user; securely wiping internet browsing activitiy; and securely cleaning the Windows Registry and wiping Volume Shadow Copies (see [115]-[116] of Mr Khoury’s 31 January 2017 report).

77. Then at 11.46pm on 11 September 2015, the application “Recuva” was installed and run on PC05 (see Mr Khoury’s report of 20 July 2016 at [15]-[16]; [40(a)]). That had the effect of securely deleting some 9,650 records from PC05 ([40(a), Mr Khoury’s 20 July 2016 report). Mr Khoury explained (at [12] of his 20 July report) that when examined in chronological order the deleted file artefacts on PC05 “demonstrated a pattern of activity consistent with a secure file erasure process performed on PC05”.

78. Mr Khoury has deposed (at [117], 31 January 2017 report) that, unlike CCleaner, the Recuva application is not intended to be used as a system optimisation tool nor as a tool for removing temporary data:

The primary application of Recuva is to scan a computer in order to identify previously deleted files that remain dormant in free space and are no longer visible to the end user.

The Mirus CRM database

79. The relevant chronology of events in relation to the Mirus CRM database can be more briefly addressed.

80. On 15 July 2015, Mr Gage gave Mr Wilson access to share the folder “NickSi” (admitted at defence [66(b)]). On 21 July 2015, Mr Gage downloaded the Mirus CRM database to his personal Google Drive account (statement of claim at [64]-[66]; defence at [65]). Mr Khoury notes (at [16] of his 4 September 2015 report) that examination of internet browser records created by Mr Gage’s computer (that is, PC01) indicate that from around 6pm on 21 July 2015 the computer was used to download records contained within the Capsule CRM database and that around the same time a Google search was undertaken for the term “add group to google contacts more than 205” ([17]; [31(d)] of the same report).

81. At 6.07pm on 21 July 2015, Mr Gage’s computer (that is, PC01) was used to access an email titled “[Capsule] Your Exported Data – [email protected] – Mirus Australia Mail (“Exported Capsule Data”)” (see [18]; [31(e)], Mr Khoury’s 4 September 2015 report). That email is no longer present in Mr Gage’s Mirus email account. Mr Khoury notes that immediately after the email was accessed on Mr Gage’s computer a data file titled “capsule export-2015-7-21.zip” was opened on the computer and that this zip was still present on PC01 in the downloads folder and contained approximately 400,000 records relating to client contact details and over 300 job opportunity records (see [19]; [31(f)], Mr Khoury’s 4 September 2015 report).

82. Mirus says that the database files, converted into comma separated value (CSV) files, were copied first to Mr Gage’s personal Google Drive account and then copied from his personal Google Drive account to the Surface Pro (T 66). (In support of this contention, Mirus points to certain findings in the report of Mr Khoury of 15 January 2016 concerning the Surface Pro. Mr Khoury identified (at [16]) the names of files and folders impacted by deletion activity through examination of the volume shadow copy backups made by the operating system on Mr Gage’s Surface Pro. Mr Khoury notes (at [18]) that a file titled “export-2015-07-21.zip” in the relevant downloads folder was found within the volume shadow copy.)

83. On 9 August 2015, Mr Gage ran internet searches on his Surface Pro, searching for “backupify” (at 11.49am) and “import zoho crm capsulecrm” (at 6.32pm) (see [35], Mr Khoury’s 15 January 2016 report). Mr Khoury explained that “Backupify” is an internet based cloud to cloud backup application which allows users to find, restore and manage any google apps data ([36], Mr Khoury’s 15 January 2016 report).

84. The contents of the zip archive file titled “capsule export-2015-07-21.zip” (namely, 5 CSV text files) were extracted to a particular folder (namely, “Downloads/capsule export-2015-07-21”) on Mr Gage’s Surface Pro on 9 August 2015 (see [8], Mr Khoury’s 24 Februry 2016 report). Both this zip file and the particular folder containing the extracted CSV files were deleted by 7.05pm on 7 September 2015 – the time of the next volume shadow copy of the Surface Pro; see [9], Mr Khoury’s 24 February 2016 report.

85. In his 15 January 2016 report, Mr Khoury describes (at [24]-[25]) the creation on 14 August 2015 of new folders and files relating to business contacts drawn from the “contacts.csv” file, which was located in the “Downloads/capsule export-2015-07-21” folder on Mr Gage’s Surface Pro. Two files were created (namely, “contacts-a-m.csv” and “contacts.n-z.csv”) at 12.19pm and 12.25pm on 14 August 2015, which appear to have contained the contact details of organisations commencing with the letters A to M and N to Z (see Mr Khoury’s report of 15 January 2016 at [24]-[25], see also his report of 20 July 2016 at [35]). There is also evidence of a data import process that occurred at or around 12.33pm on 14 August 2015 (see Mr Khoury’s report of 20 July 2016 at [19(e)], in relation to a website address “Aged Care HQ CRM”). Mirus says that the contacts csv files were created into a new Aged Care HQ Capsule (access to which was shared with Mr Wilson) (see [23]-[24] of Mr Khoury’s report of 20 July 2016).

86. Mr Khoury’s report dated 20 July 2016 refers to his analysis of internet records relating to the “Insightly CRM product”, that being a competitor product to Capsule (the customer relationship management database that was used by Mirus) and various websites on which the Aged Care HQ Capsule CRM was then created. In that report, Mr Khoury refers (at [27]-[34]) to Powershell script files that he says show apparently unsuccessful attempts to extract records from the “contacts.csv” file but which he says demonstrate that Mr Gage was attempting to extract these Mirus CRM records into a useable format to be loaded into another application. Mr Khoury concludes (at [31]) that it is probable that any attempts made to extract client related files failed “due to the fact that the data in the “contacts.csv” file extracted from the Mirus CRM database contains a complex text field wthin each record”.

87. As noted earlier, Mr Khoury examined the volume shadow copy taken of the Surface Pro at 4.19am on 4 September 2015 and identified that a substantial number of files and folders relating to Mirus were present on the Surface Pro but (by the time of inspection after the Surface Pro was produced on 11 September 2015) those files and folders were no longer present (just the system artefacts left by the secure deletion process carried out on 7 September 2015) (see [17] of the 15 January 2016 report; and Mr Khoury’s reports of 24 February 2016, 31 January 2017).

88. Mr Khoury also identified an Xcopy application being run on the Surface Pro on 7 September 2015, which he says is commonly used to transfer files from a source location to a specified destination (but says he has been unable to identify the files copied or transferred using that application (see [26] of his 15 January 2016 report)).

89. Also on 7 September 2015, after Mr Gage was served with the summons and notice of motion in these proceedings (and, as he has acknowledged, after he was aware of the commencement of proceedings and that he might have to deliver up his Surface Pro), Mr Gage used the SDELETE application on the Surface Pro. Mr Khoury says that the SDELETE application specifically targeted the Capsule CRM data (see Mr Khoury’s 31 January 2017 report at [35]-[45]) .

90. Mirus places weight on the fact that Mr Khoury’s initial report of 4 September 2015 was served on Mr Gage, together with the affidavit of Mr Covino (executive director of Mirus) on 7 September 2015, at the time that Mr Gage was served with the summons and notice of motion. It says that it would then have been apparent to Mr Gage (who up to that stage had denied being in possession of any confidential information of Mirus) that Mr Covino had identified specific incidents of downloading of the CRM database and that the expert had identified that Mr Gage had the Mirus CRM database in his possession.

Joint expert report – 28 April 2017

91. The experts were asked various questions. Their responses were recorded in the joint expert report. They may be summarised as follows.

92. There was disagreement as to question 1 (namely as to whether the Google drive activity log for shared files and folders only maintains records of files and folders shared from one user to another while they are being shared – as per [18] of Mr Carson’s report of 5 April 2017). Mr Carson found that the effect of this was that, when using the Google Drive web application, there was no visible activity log relating to shared files once they were removed ([18]; [20]); and that the activity log was not useful for detecting activity of files being shared and then removed by a recipient ([21]). Mr Khoury disagreed. He maintained that activity records would remain visible within the activity log even after the files and folders are “unshared” and maintained that it was important to note that activity records relating to both the “Mirus Stuff” and “NickSi” folders were contained in Mr Gage’s personal Google drive account – referring to [76] of his 31 January 2017 report – notwithstanding the absence of both the “Mirus Stuff” and “NickSi folders” from Mr Gage’s personal Google Drive account. Mr Khoury said that activity log records are maintained in Google Drive irrespective of the sharing status of a file or folder. In this regard, Mr Carson accepted that a “limitation” of his findings was that he did not test the activity logs when a shared folder was added to the recipient’s Google drive account.

93. The experts were, however, agreed as to the following questions:

• question 2 – the conclusions reached by Mr Khoury in respect of the internet history records relating to deleting Google Drive activity logs ([79]-[80] Mr Khoury’s report of 31 January 2017; see [67] above).

• question 3 – as to a number of questions posed in relation to partial synchronisation (namely, that it can and does occur between a Google Drive desktop application and the Google Drive web application; that the circumstances under which it occurs are where a connection is made with valid login credentials but the connection is interrupted before the synchronisation is complete (see [33] of Mr Carson’s report of 5 April 2017; [65] of Mr Khoury’s report of 31 January 2017); that when a password to a Google Drive account has been changed Google Drive will no longer synchronise on computers linked to that account; and that if a synchronisation had commenced on a computer and was suddenly interrupted then no further synchronisation would occur until the issue that cause the interruption was remedied (see [35]-[36] of Mr Carson’s report of 5 April 2017)); see [70] above; and

• question 4 – that the folders “Mirus Stuff” and “NickSi” do not exist in Mr Gage’s Mirus Google Drive account (see [83]-[85] of Mr Khoury’s report of 31 January 2017); see [48] above.

94. Mr Carson did not examine (and accepted in the course of the concurrent oral evidence that he could therefore neither agree or disagree as to) the matters set out in [87]-[93] and [95]-[103] of Mr Khoury’s report of 31 January 2017, leading to Mr Khoury’s conclusion that it could not be said that the “Mirus Stuff” and “NickSi” folders were created or ever existed in Mr Gage’s Mirus Google Drive account and therefore that it could not be said that they were shared from that account.

95. Mr Carson agreed with the explanation by Mr Khoury of the uses of CCleaner ([115]-[116] of Mr Khoury’s report of 31 January 2017) but says he did not examine the matters relating to the installation of the CCleaner application on PC05 on 8 September 2015 or the downloading and subsequent deletion of the zip file “Mirus stuff” on PC05. Nor did he examine the matters in relation to the Recuva application.

96. As to the conclusion that the “TFS” folder and the “capsule export-2015-07-21” folder were individually targeted as part of the deletion process that occurred on the Surface Pro on 7 September 2015 (see [6(f)]; [32]-[46] of Mr Khoury’s report of 31 January 2017); and that the SDELETE secure deletion application was not used to delete any content from a “TTA” folder on that day (see [6(g)]); [21]-[30] of that same report), again Mr Carson did not examine those questions and could not agree or disagree with Mr Khoury’s conclusions.

The “explanations” given by Mr Gage as to deletions

97. In his defence, Mr Gage asserts (at [65]) that the deletion of material from the Surface Pro was to maintain its confidentiality. As to the later deletion of files from PC05, the explanation that Mr Gage gave in his affidavit of 18 November 2016 for this was, in essence, that: he had delivered up a number of his personal computing devices to his lawyers on 9 September 2015; he was aware that he would not have access to any of those devices for at least 4 weeks; the only other device of which he could have sole use was PC05; he had not undertaken any optimisation to remove junk files and applications and to free up disk space on that computer between “around September 2013” and 9 September 2015; and that, as he expected he would he using PC05 as his main computer for the following weeks, on 11 September 2015 he installed two applications “to delete redundant files on the NEWTON and DARWIN devices” (those being the CCleaner and Recuva applications) and he ran those applications on 12 September 2015 as he was aware that there were a large number of files on PC05 that had been deleted using the basic deletion method or that he was no longer using and “cookies, temporary files, web browser history, cached internet files, registry files and various other unusued data” that were consuming the operating system’s disk space (see [96]-[99] of his affidavit).

Mirus’ contentions as to the deletions

Submissions as to coding

98. The submission put for Mirus in relation to the deletion of the coding information is, in summary, as follows.

99. First, that the files of Mirus’ coding information were removed from its control on 6 August 2015, first being downloaded to Mr Gage’s personal Google Drive account. As a result of Mr Gage’s admitted deliberate destruction of files on his personal Google Drive account, Mirus says it is not possible for it to know “what, if any, modifications or use of those files as they were stored on the Google Drive” has occurred at any time since 17 August 2015 (T 65).

100. Second, Mirus says that, on 13 or 14 August 2015, Mr Gage moved that data onto his Surface Pro and that on 7 September 2015, he used the SDELETE function, specifically targeted at that data, to delete it after (and because) he knew about the commencement of these proceedings (T 65). Mirus says that one of the inferences to be drawn from the activity in relation to the Ozcare Financials file is that, by 25 August 2015, Mr Gage had focused on what conclusions would be drawn about the content of his personal Google Drive account should it be produced for inspection and that he was seeking to create a false impression of what the facts were concerning the document “Ozcare Financials” (see T 58).

101. Third, Mirus argues that Mr Gage moved that data from his personal Google Drive account to PC05 on 30 August 2015 and destroyed all record of it on PC05 by the running of Recuva at 11.46pm on 11 September 2015 (PC05 being a device that was not examined as at 11 September 2015) (see T 65). The installation and running of the CCleaner and Recuva applications on PC05 occurred late in the evening of the day that PC04 and the Surface Pro were delivered up for examination by Mirus’ forensic expert; and after Mr Gage had attended at his lawyers’ offices during that process and had been party to the conversation with Ms Stuckey-Clarke referred to earlier. Mirus says that an inference should be drawn, from the Stuckey-Clarke conversation to which Mr Gage was a party in the afternoon of 11 September 2015, that he then came to understand how focussed the forensic examination would be – hence the process undertaken by him later that evening. Mirus argues that the use of CCleaner combined with Recuva is significant because the only relevant purpose of Recuva is “to shred everything to do with the file” so that one can never recover anything to do with it (T 62).

102. By reference to [83(a)] of the defence, Mirus argues that the reason that CCleaner and Recuva were not run on PC04 (which, unlike PC05, was delivered up for inspection on 11 September 2015) is that Mr Gage had deleted all of the relevant files from his personal Google Drive account before the interlocutory injunction was granted on 8 September 2015 and believed that, by so doing, that would flow through to all devices which were set to synchronise with his personal Google Drive account. Since Mr Gage in his defence says it was by “oversight” that the personal laptop (PC04) had not synchronised, Mirus argues that it should be inferred that when Mr Gage produced the PC04 device for inspection on 11 September 2015 he thought there would be nothing on it.

103. Mirus says that it is also clear that, whatever the date of the Google Drive image that was found on PC04, it does not reflect any of the changes that were made on the Surface Pro (the reason being that the Surface Pro was not synchronising with Mr Gage’s personal Google Drive account), but rather, the data was “downloaded to the Surface Pro on 13 August and then was manipulated on the Surface Pro until it was deleted from the Surface Pro on 7 September 2015” (T 63-64). Thus, Mirus’ position is that it suffers a forensic disadvantage in that it knows that whatever was on Mr Gage’s personal Google Drive account in the “Mirus Stuff” folder on 30 August 2015 was downloaded to PC05 on that date but it has no idea what that was or what was done with it between 30 August 2015 and when the Recuva program was run on 11 September 2015 “shredding everything” on PC05 (T 64).

104. As already noted, Mirus accepts that a full synchronisation could not have occurred on 8 September 2015 (which was the last time PC04 was connected to Mr Gage’s personal Google drive account) and therefore that it cannot be concluded that the Mirus related files present in the PC04 local Google Drive cache were deleted from the Google Drive cloud storage service between 9.30pm on 8 September 2015 and 4.24pm on 11 September 2015 as Mr Khoury had originally thought. That said, Mr Khoury adheres to the opinion that an analysis of PC04 identifies that Mirus-related files were present within PC04’s local Google Drive cache folder, the majority of which were not present onMr Gage’s personal Google Drive account as at 4.24pm on 11 September 2015.

264. Pausing there, however, what is pleaded at [72] of the defence goes further than a mere denial of [72] of the statement of claim. Mr Gage goes on to answer this allegation by repeating his answers to [62]-[71] of the statement of claim (some of which as noted above should be struck out) and then asserts that he has not reviewed or used any of the information since the termination of his employment with Mirus and has not disclosed/provided any of the information to any other person since then. Those assertions cannot in my opinion be made in circumstances where the evidence of what, if anything, was done with the information has been deliberately deleted. Accordingly, at least that part of [72] should be struck out.

265. As to [73] of the defence, this responds to the allegation of breach of the obligation not to disclose the confidential information to any other person except, in certain circumstances, where required for proper performance of his duties. Mr Gage points out that it is not alleged that there was any use made of that information by Mr Gage or Mr Wilson. That, however, is not to the point in circumstances where what he is here denying is breach of an obligation not to disclose the information.

266. Counsel for Mr Gage submits that the information which has been deleted from the personal Google Drive account and from the Surface Pro does not have the “important evidential value” sought to be placed on it by Mirus with respect to the particular allegations of breach of confidentiality at [72] and [73], and submits that the question as to what use was made of the material is “only of very marginal relevance at best” to these particular pleadings (see T 104).

267. Counsel for Mr Gage argues that, as pleaded, the loss and damage is that suffered by a breach of confidentiality obligations where that breach is not with respect to how the material was used but simply with respect to the fact that Mr Gage copied/disclosed it and it is submitted that this would reduce the scope of any permissible loss or damage that might be able to be claimed. That may well be so but it does not answer the difficulty that Mirus now faces in proving the allegations of loss and damage as a result of such breach.

268. It is accepted by Counsel for Mr Gage that it may be open to Mirus to run a case along the lines that, because the information was taken, the confidentiality of the security of this software has been compromised and that this has resulted in some form of loss (whether that be measured by reference to the value of the business or, for example, Mirus had to take steps subsequently to address the question of security of its confidential information). However, he submits that the quantum of that loss and what that loss or damage is does not arise from anything that Mr Gage subsequently did with the particular material. It is submitted that this is largely admitted by Mr Gage and, to the extent that it is not admitted or there is any issue about that, it can be clearly identified by reference to the material which was ultimately found on PC04, which indicated what Mr Gage actually had done.

269. I am not persuaded that deletion of evidence of whatever use (if any) has been made of the files, and any record of activity in relation thereto, would not potentially be relevant to the issue as to whether there was a failure to maintain the confidence of the relevant material or to the issue as to whether there has been disclosure of the material in breach of the contractual obligations in question. One surely fails to maintain the confidentiality of information not only by downloading or copying it but also by making use of it with or disclosing it to third parties. And in any event there is no admission by Mr Gage that he breached these obligations even if the conduct were understood to be conduct limited to the dowloading or copying of the information. Accordingly, evidence of use of the material would potentially be of relevance to the issue of breach raised in these paragraphs of the statement of claim.

270. Moreover, I am not persuaded that any evidence of use would not potentially be relevant to the allegations of loss and damage. Extent of the use of the material (say by any compilation of the material into other material proposed for use in the Aged Care HQ business) might also be relevant to the ambit of the relief to be given; as might the question of disclosure of that information (particularly in light of the potential exposure to loss of business from clients as a consequence of any unauthorised access to or disclosure of the information).

271. As already noted, [72] makes positive averments about the lack of review or use of the material that cannot now be determined from a forensic analysis of the devices in light of the deletions. At the very least [72(a)-(c)] should be struck out since they repeat allegations elsewhere struck out and make allegations as to lack of use/disclosure that cannot forensically be tested in light of the deletions. I would not strike out the opening words of [72] on the basis that it should be open to Mr Gage to argue that the conduct he has admitted does not breach his contractual obligations to take all steps necessary to maintain the strict confidentiality of the confidential information. What he should not be permitted to do is to maintain the denial of breach by reference to assertions as to, among other things, his lack of use of the material and his asserted purpose in making the deletions (see [65]).

272. As to [73], again insofar as it calls in aid matters pleaded elsewhere in the defence that I have decided should be struck out, the incorporation of reference to those paragraphs should be struck out from [73] but it should be open to Mr Gage to argue that the conduct he has admitted or, to the extent he does not admit this, any established sharing of access to Mirus confidential files by providing Mr Wilson with log-in details for access to particular folders, nevertheless does not amount to a breach of the contractual obligation not to disclose confidential information to any person other than as directed by Mirus and where required for the proper perforamnce of his duties. Therefore I would not strike out the opening words of [73] of the defence but simply the repetition in that paragraph of parts of the defence to be struck out in accordance with these reasons.

273. In other words, Mr Gage should not be permitted to deny conduct where the deleted material might have shed light on that conduct and hence should not be permitted to maintain his denials of breach by reference to assertions as to, among other things, his lack of use of the material and his asserted purpose in making the deletions (see [65]). He can, however, argue that such conduct as is pleaded against him would not constitute a breach of the said contractual obligations.

Paragraphs [87], [90]-[91], [92] – allegations of dishonest conduct

275. Paragraphs [87], [90]-[91] and [92] of the statement of claim make allegations of dishonest conduct on the part of Mr Gage or (in the case of [91]) of a refusal to deliver up any of Mirus’ confidential information.

276. As to [87] of the defence, this responds to (and denies) the allegation that Mr Gage dishonestly represented to Mirus (between 27 July 2015 and 7 August 2015) that he had handed back all information referred to at [86] of the statement of claim (being all information including Confidential Information and Intellectual Property the subject of a request made by Mirus that this be handed back). Mr Gage admits the representation was made but denies that the representation was dishonest and “otherwise” denies the paragraph.

277. Mirus says that in circumstances where the evidence of the information in his possession other than the Google Drive has been destroyed he ought not be permitted to put that in issue (T 84).

278. Counsel for Mr Gage accepts that the allegation at [87], which relates to the time at which Mr Gage was still employed by Mirus, is relevant both to the breach of fiduciary claim ([93]) and the breach of statutory duty claim which ([104]) (T 105).

279. Paragraph [90] of the defence responds to the allegation that Mr Gage declined (by an unsigned letter received on 26 August 2015 by Mirus) to deliver up confidential information and dishonestly represented that he maintained absolute loyalty. Mr Gage admits sending the letter, denies that in that letter he declined to deliver up confidential information, admits he stated he had absolute respect and loyalty and denies that this statement was misleading or dishonest and “otherwise” denies the allegation.

280. Paragraph [91] of the defence responds to the allegation that Mr Gage refused to deliver up any of Mirus’ confidential information (by reference to the 3 September letter from his lawyers). Mr Gage admits the letter was sent, denies the refusal to deliver up, admits the statement made by his solicitors in that letter that he had no confidential information or intellectual property belonging to Mirus in his possession now and “otherwise” denies the paragraph.

281. Finally, [92] responds to the allegation that Mr Gage, on 24 July 2015, dishonestly deleted an email from his Mirus email account “for the purpose of seeking to prevent Mirus Australia from detecting the Gage Capsule CRM Export” (that being a reference to the download of the Mirus CRM database). This is denied by Mr Gage with a repetition of [65(d)-(h)] of the defence (parts of which paragraphs are to be struck out in accordance with these reasons).

282. Counsel for Mr Gage submits that the question whether Mr Gage dishonestly represented that he had handed back all information, and whether or not he had dishonestly refused to deliver up confidential information which he knew he had in his possession, can be decided entirely on the basis of the documents that remain accessible (in particular, by reference to what remains on PC04) and the various admissions which Mr Gage has made throughout the course of the defence as to what he downloaded or copied on 6 August 2015 (T 105). It is submitted that the question whether Mr Gage then, during the period between 17 August and 8 or 11 September 2015, tried to use those particular files and tried either to download contacts or compile new software from those files is irrelevant to the particular allegations made in these paragraphs.

283. In effect, the conduct denied in these paragraphs appears now largely not to be in issue (other, perhaps, than the denial of deletion of the email the subject of the allegation at [92] and what is left to be denied by the formulaic inclusion of the “otherwise denies” sub-paragraphs).

284. Broadly speaking, what appears to be denied in these paragraphs is the allegation of dishonesty, i.e., that when certain statements or representations were made they were knowingly false or (in the case of [92] that the deletion was made dishonestly for a particular purpose). There may, however, be other aspects of the allegations that Mr Gage is seeking to put in issue (such as whether the denial by his solicitors that he was in possession of any confidential information amounted to a refusal to deliver up the information that it was there asserted he did not have – see [91]).

285. The position of Mirus seems to be that, having acted deliberately (as I have concluded Mr Gage did) in making the deletions, Mr Gage cannot now be heard to say that he was not dishonest in so doing. I am not persuaded that (other than [92]) these paragraphs should be struck out. Whether there was a dishonest representation that all relevant material had been handed back to Mirus; or a dishonest representation of loyalty to Mirus; or a refusal to hand back or deliver up confidential information, are matters to which potential evidence of use of the downloaded/copied material seems not likely to be relevant.

286. Paragraph [92] of the defence is in a different position since it goes to the issue whether Mr Gage deleted the email on 24 July 2015 dishonestly and for the pleaded purpose and he has in that paragraph repeated what is asserted as to his purpose in [65(d)-(h)]. Consistently with the ruling in relation to [65(d)-(h)], I would delete the reference to those paragraphs at [92] of the defence but would permit Mr Gage to put in issue whether the deletion was dishonest.

Paragraphs [93]-[94] – breach of fiduciary obligations; paragraphs [103]-[104] - breach of statutory duties

287. These paragraphs can be considered together.

288. Paragraphs [93]-[94] of the statement of claim allege that in breach of his fiduciary obligations to Mirus, Mr Gage engaged in certain conduct (that specified at [62]-[65], [68]-[71], [84], [87], [90]-[92]) for Mr Gage’s own benefit (see [93]) and engaged in certain of that conduct ([65]) and the conduct specified at [66] for both Mr Gage’s and Mr Wilson’s benefit (see [94]).

289. Mr Gage denies the allegation at [93], repeating [60]-[71], [83], [84], [87], [90], [91] and [92] of his defence; and denies the allegation at [94], repeating the matters pleaded at [60]-[71] of his defence.

290. Paragraphs [103]-[104] allege breach of the duty imposed by s 182 of the Corporations Act not improperly to use his position as an employee to obtain an advantage for himself or someone else. Various paragraphs of the statement of claim are pleaded as the conduct on which those allegations are based. Mr Gage has denied both those paragraphs, repeating his defence at [60]-[71] (and in the case of the allegation at [104] also repeating his pleaded defence at [87]).

291. Mirus emphasises that the allegation at [94] raises the issue as to the purpose that Mr Gage had in downloading the Mirus CRM database and sharing it with Mr Wilson, namely that it was for their personal benefit. Counsel for Mirus notes that it is alleged at [66] and [67] that Mr Gage shared the information by giving access to Mr Wilson to that information. He says that what Mirus can show from the documents that are available is that access was given to Mr Wilson to something; and it can invite the inference from the series of dealings that that something included data sourced from the Mirus CRM database; but says that without the documents that have been destroyed, Mirus is not able to point to particular data sourced from its CRM database to say that has been shared with Mr Wilson, nor is it able to engage with specifics in order to prove the allegation at [94].

292. Counsel for Mirus points to [83]-[86] as part of the background to the allegation of loss and damage; and [93] as to the allegation that Mr Gage engaged in the conduct for the purpose of using the information downloaded by him for his own benefit or for the benefit of a third party and for the purpose of his being able, if and when he so chose, to use the information downloaded by him for his own benefit or for the benefit of a third part. He submits that the destroyed documents are squarely relevant as to whether each of those downloads was for the purposes alleged at [93]. A similar issue is said to arise with respect to [103]-[104], the breach of statutory duties.

293. Insofar as the allegations at [103]-[104] require a finding as to the purpose of the alleged conduct being for Mr Gage to obtain a benefit for himself or for someone else, I accept Mirus’ submission that, in circumstances where any evidence of use cannot now be established by reference to the deleted electronic data, Mirus will be prejudiced in a real sense in establishing its allegations as to the purpose for which the conduct was undertaken. I would therefore strike out [103] and [104]. As to the denial of breach of fiduciary obligations, I would permit that to stand but would strike out the references at [93]-[94] of the defence to any paragraphs of the defence to be struck out in accordance with these reasons.

Paragraphs [107]; [109] – Allegations of loss and damage

294. That brings me to the allegations of loss and damage.

295. Paragraph [107] of the defence responds to the broad allegation that Mirus has suffered loss and damage by reason of the matters aforesaid. Mr Gage denies breach of any statutory, legal or equitable obligations owed to Mirus, repeats [59]-[106] of his defence and denies that Mirus has suffered loss or damage.

296. Paragraph [109] of the defence responds to the (similar) allegation that Mirus has suffered loss and damage and will continue to do so unless restrained from using or disclosing Mirus confidential information and compelled by order to deliver it up and delete it. Mr Gage simply denies the paragraph and repeats [59]-[102] of his defence.

297. Mirus says that, in circumstances where the core of the causes of action claimed is destruction of confidentiality of intellectual property and confidential information and where the evidence of what has been done with that information has been destroyed, Mr Gage ought not be permitted to put in issue that he has caused Mirus to suffer loss and damage or what damage he has caused, though Mirus accepts that it will still have to establish the quantum of that loss and damage.

298. Mirus accepts that if these paragraphs of the defence are struck out this would still leave the same allegations in relation to Mr Wilson. It says that what would then remain in issue as between Mr Gage and itself would be, first, whether the information was Mirus’ intellectual property and was confidential to it and second, the quantification of the damage caused (the fact that such damage having been cause being not able to be disputed).

299. In oral argument, what was foreshadowed by Counsel for Mirus was that the quantification of the damage might be established by reference to the difference between the notional value attaching to the business on the assumption that Mr Gage had not had access to the coding (i.e., wthout the risk posed to the security of the confidential information arising from his unauthorised access to it) and the notional value of the business in circumstances where Mr Gage had accessed that information after termination of his employment (T 85). In that regard, Counsel for Mr Gage accepted that one way that damage on the breach of confidence claim might be able to be identified would be by reference to valuations of the value of the company, if the security or the confidentiality of its intellectual property has been impaired in some way but he submitted that such evidence would not be relevant to the assessment of loss or damage with respect to the claim for breach of the non-compete covenants (noting that on the defendants’ case they were only in a start-up position and had not marketed the business before the injunction was granted on 8 September 2015) and that the restraint ceased on 6 November 2015 (see T 88).

300. Counsel for Mr Gage submits that, whatever else might be struck out, it should remain open to him to deny any loss and damage in relation to the alleged breach of the non-compete covenant. On that issue it is submitted that the question of any such loss lies within the knowledge of Mirus and that that none of the documents or files deleted by Mr Gage would go to that particular issue (see T 89).

301. In that regard, there are breach of confidential information cases where what is sought is the delivery up and destruction of material into which confidential information has been imported in the sense that use has been made of it to create a new product and what is sought is destruction of that new product (see, for example, Ormonoid Roofing and Asphalts Ltd v Bitumenoids Ltd (1930) 31 SR (NSW) 347, discussed in Ansell Rubber Co Pty Ltd v Allied Rubber Industries Pty Ltd [1967] VR 37 at 43). It may be that that is what this paragraph of the pleading would contemplate and that is what is made difficult or impossible to ascertain by reason of the deletion of the material. In other words, insofar as it could be established that the new client relationship database for Aged Care HQ had been developed or contained information that was confidential information wrongfully taken by the defendants, then it is possible that there might have been an application for the destruction of that database, which might mean that the defendants would be put to the expense of having to recreate their own database without the benefit of the information obtained from Mirus. The allegations as to the period of time it would otherise have taken Mr Gage to develop a competing product appear to raise this kind of issue. That said, conclusions as to what, if anything, was used of Mirus confidential information in the development of the Aged Care HQ database or any Aged Care HQ computer product would presumably be possible to be drawn by a comparison of the material on PC04 and the newly created electronic database/files.

294. It is submitted for Mr Gage that if the defendants had attempted to contact Mirus clients by reference to a client relationship database downloaded from Mirus, those contacts would be available by means of other documents; and that insofar as what is alleged to have been destroyed is a client relationship database created by Mr Gage and subsequently shared by Mr Wilson for the purposes of the new business (i.e., not the Mirus CRM database itself but a new database established as a result of use or manipulation of the information downloaded from Mirus), that new cloud based client relationship database should remain accessible. It is submitted that there has been no suggestion that that particular client relationship database has been destroyed by Mr Gage or by Mr Wilson.

295. As to [109(a)] of the statement of claim, which alleges that loss will continue to be suffered unless the defendants are restrained from using or disclosing the confidential information, Counsel for Mr Gage points out that a restraint order was made by Hallen J on 8 September 2015 and that it remains in place. As to [109(b)] of the statement of claim which alleges that loss will continue to be suffered unless the defendants are compelled to deliver up or delete all copies of the confidential information, Counsel for Mr Gage points out that a series of orders have already been made requiring delivery up of various devices as they have become identified. It is accepted that there may be some ancillary order that Mirus might be entitled to as a form of final relief with respect to what is alleged in this subparagraph but it is submitted in this regard that the information that was deleted either on Google Drive or on the Surface Pro is “at best of only marginal relevance” to that particular issue (T 106).

296. As to Mirus’ submission that, because of those deletions, it does not know whether that material has been copied elsewhere and therefore that Mirus is at a forensic disadvantage in seeking to ensure that the appropriate orders are made for delivery up and for deletion of all confidential information, Counsel for Mr Gage argues that there is no expert evidence as to what one would be able to tell from the information which was deleted (i.e., whether one would be able to ascertain from the deleted material whether or not there was copying of this particular material or whether anyone else was given access to that particular material).

297. That said, it is accepted for Mr Gage that what cannot be discerned is what Mr Gage may have done with it in terms of compiling new software or new source code, or as to precisely what information Mr Gage tried to export to the Capsule CRM database. Counsel for Mr Gage accepts that if [109] were to be struck out, that would only have the effect that, if the allegations in relation to the information being confidential were to be established, his client might be liable to an order to deliver up copies of the confidential information (T 107).

298. I would not strike out the bare denial of loss and damage at [107] or [109]. I consider that in circumstances where it will remain necessary for Mirus to establish what loss and damage has been sustained in order to quantify its claim for loss there is no purpose to be served in striking out the bare denial of loss and damages having been caused. I would, however, strike out [107(b)] and that part of [109] of the defence insofar as those paragraphs repeat paragraphs of the defence that are to be struck out in accordance with these reasons.

Conclusion

307. For the reasons above I am satisfied that Mirus has established beyond reasonable doubt that Mr Gage has committed a contempt of court by the conduct set out in charge 1 and that his actions in making the various deletions from his electronic devices amounted to an abuse of process, the proportionate response to which is to strike out various parts of his defence as indicated above.

308. In circumstances where his conduct amounted both to a contempt of court and to an abuse of process I am of the view that Mr Gage should pay the costs of the present applications on an indemnity basis but otherwise I do not propose to make costs orders at this stage in respect of the proceedings to date.

Orders

309. I make the following orders:

1. Declare that the first defendant was in contempt of this Court by engaging in the conduct in the circumstances described in Charge 1 of the Amended Statement of Charge.

2. Order pursuant to rule 14.28 of the Uniform Civil Procedure Rules 2005 (NSW) that [60]-[61] of the first defendant’s defence filed on 12 November 2015 be repleaded in accordance with these reasons and that the following paragraphs or part paragraphs of the said defence be struck out as an abuse of process of the Court: [60(b)]; those parts of [63]-[73] in which the first defendant “otherwise denies” the allegation to which the paragraphs respond (such as [63(e)]); [64(d)-(h)]; [65(b)]; [65(c)]; [65(d)] (the words in the chapeau “in order to do so” and subparagraphs (v)-(vii)); [65(e)]; [65(f)] (the words “in order to maintain the confidentiality of the information”); [65(g)] (the words “and again attempted” through to the end of that sub-paragraph); [65(h)] (the words “in order to maintain the confidentiality of the information”); [65(i)-(j)]; [66(c)-(e)] (insofar as they are intended to apply to Mr Gage’s defence); [66(f)]; [67]; [68(d)]; [69(c)-(e)]; [70(d)]; [71(d)]; [71(g)]; those parts of [72] which repeat answers to [62]-[71] that are to be struck out; [72(a)-(c)]; those parts of [73] which incorporate reference to parts of the defence that are to be struck out; those parts of [92] which repeat those parts of [65(d)-(h)] which are to be struck out; those parts of [93]-[94] which incorporate reference to paragraphs of the defence to be struck out; [103]-[104]; [107(b)] and that part of [109] of the defence insofar as those paragraphs repeat paragraphs of the defence that are to be struck out.

3. Direct the first and second defendants each to file an amended defence within 14 days, noting that the first defendant’s amended defence must accord with these reasons in relation to the paragraphs or part paragraphs of the defence the subject of the order in 2 above.

4. List the matter before me at 9.30 am on 18 August 2017 for further directions as to the filing of evidence and listing of the matter for a sentencing hearing in respect of the contempt of court committed by the first defendant.

5. The first defendant to pay the plaintiff’s costs of the respective notices of motion on an indemnity basis.

**********

Decision last updated: 11 August 2017