National Hearing Centres Pty Ltd v Vic O Tech Pty Ltd
[2013] VSC 292
•12 JUNE 2013
| IN THE SUPREME COURT OF VICTORIA | Not Restricted |
AT MELBOURNE
COMMERCIAL AND EQUITY DIVISION
TECHNOLOGY ENGINEERING AND CONSTRUCTION (INTELLECTUAL PROPERTY) LIST
S CI 2012 05943
| NATIONAL HEARING CENTRES PTY LTD (ACN 075 889 262) | Plaintiff |
| v | |
| VIC O TECH PTY LTD (ACN 084 246 622) | First Defendant |
| And | |
| IRINA ANGELOVA | Second Defendant |
---
JUDGE: | VICKERY J | |
WHERE HELD: | MELBOURNE | |
DATE OF HEARING: | 22 MAY 2013 | |
DATE OF RULING: | 12 JUNE 2013 | |
CASE MAY BE CITED AS: | NATIONAL HEARING CENTRES PTY LTD v VIC O TECH PTY LTD & ANOR | |
MEDIUM NEUTRAL CITATION: | [2013] VSC 292 | |
---
PRACTICE AND PROCEDURE – Inspection from a prospective Defendant – Gibson v ANZ Banking Group Ltd (Unreported, Supreme Court of Victoria, Gobbo J, 30 August 1991) applied - Whether rr 32.05 and 37.02 of the Supreme Court (General Civil Procedure) Rules 2005 (Vic) confer on the Court a power beyond those in the Rules to make ancillary orders in aid of a party deciding to commence a proceeding (eg interrogatories and cross-examination) – Allegations of breach of pre-action discovery orders – Allegations of destruction of documents.
---
APPEARANCES: | Counsel | Solicitors |
| For the Plaintiff | Mr E Heerey | Gilbert & Tobin |
| For the First and Second Defendants | Mr J Kohn | Wisewould Mahony |
HIS HONOUR:
The Plaintiff, National Hearing Centres Pty Ltd (‘NHC’), operates a network of 126 clinics across Australia providing hearing tests and the supply of audiology devices (hearing aids) to customers.
From about 2 November 1999 until Friday 25 November 2011, the Second Defendant, Ms Irina Angelova (‘Ms Angelova’), was a senior software programmer for NHC, providing services to NHC under a contract between NHC and the First Defendant, Vic O Tech Pty Ltd (‘VOT’).
Ms Angelova and VOT assigned to NHC their ownership of any intellectual property created by her while working for NHC by a deed executed on 18 August 2005.
Ms Angelova worked within the IT department at NHC’s head office in Mulgrave, as a computer programmer.
On about 11 November 2011, Ms Angelova resigned from NHC, giving two weeks’ notice, with the result that she last worked at NHC on Friday 25 November 2011.
On the very next business day, Monday 28 November 2011, Ms Angelova commenced employment with New Hearing Pty Ltd (‘New Hearing’).
New Hearing is a competitor of NHC. It was incorporated on 9 November 2011, only two days before Ms Angelova gave notice of her resignation from NHC. New Hearing’s three directors were all former directors of NHC from 1996 until 2006. New Hearing’s head office is located about 200 metres from NHC’s head office in Mulgrave.
On 22 October 2012, NHC filed an originating process seeking orders, inter alia, to enter the Defendants’ premises for the purpose of: (a) obtaining access to; and (b) making observations including by way of non-destructive testing and making forensic images of any electronic file, program or other data derived from any computer of the Plaintiff which is stored on any of the Defendants’ desktop, laptop or tablet computers, Smartphones, USBs, external hard drives or other external storage devices.
The Defendants opposed the originating process.
The proceeding came on for hearing on 11 December 2012.
At that time the key question identified by NHC in the present case is whether Ms Angelova transferred copyright material and/or confidential information out of NHC on Wednesday 23 and Thursday 24 November 2011 to a location as yet undisclosed, so that she might use that copyright material and/or confidential information in her employment at New Hearing.
On 11 December 2012 I delivered judgment and made an order (the ‘Order’), which included orders inter alia, that:
1.The Defendants make available to the Plaintiff's solicitors by 18 December 2012 the following items for examination by the Plaintiff’s expert and the taking of any necessary copies of information derived from these items which are relevant to the issues in this proceeding:
(a) the Defendants’ desktop computer, if any;
(b) the Defendants’ laptop computer, if any;
(c) the Defendants’ tablet computer or computers, if any;
(d)the Defendants’ USBs, Smartphone (without the Second Defendant’s SIM card), external hard drives or other external storage devices, if any
(the Defendants' Computers).
2.The Defendants must provide the Plaintiff’s solicitors with any user names, passwords or other information necessary for conducting the examination referred to in paragraph 1.
3.The Defendants’ Computers are to be returned to the Defendant in good order by 4 pm on 24 December 2012.
4.By 12 noon on 21 December 2012, each of the Defendants make, file and serve an affidavit of documents disclosing whether it or she has or has had in its or her possession documents:
(a)identifying any computers outside the Plaintiff’s computer network which were connected between 23 and 24 November 2011 to the Plaintiff’s Dell OptiPlex 780 Workstation NHC reference ‘MUL-PC-001’ which was then assigned to the Second Defendant; and
(b)relating to or evidencing any downloading, emailing, copying, transferring and/or keeping by the Defendants of any electronic file, program or other data from the Second Defendant’s NHC computer or other computer of the Plaintiff.
Orders as to costs were also made on 11 December 2012.
In purported compliance with the Order, on 18 December 2012 the Defendants handed to NHC’s solicitors Ms Angelova’s laptop, three storage devices and Ms Angelova’s Smartphone.
In further purported compliance with the Order, on 18 December 2012 the Defendants filed and served an affidavit of documents. According to the affidavit:
The Defendants do not have in their possession any documents identifying any computers outside the Plaintiff’s computer network which were connected between 23 and 24 November 2011 to the Plaintiff’s Dell OptiPlex 780 Workstation NHC reference ‘MUL-PC-001’ which was then assigned to the Second Defendant.
The Defendants do not have in their possession any documents relating to or evidencing any downloading, emailing, copying, transferring and/or keeping by the Defendants of any electronic file, program or other data from the Second Defendant’s work computer or any other computer of the Plaintiff.
NHC was not satisfied that the Order had been complied with to the full. Consequently, on 28 March 2013 NHC filed a summons (the ‘Summons’) seeking orders, inter alia, that:
(1)The Defendants make available to the Plaintiff's solicitors within 7 days the following USB external storage devices for examination by the Plaintiff's expert and the taking of any necessary copies of information derived from these devices which are relevant to the issues in this proceeding:
(a)The three Toshiba USB storage devices with a 400GB, 500GB and 1 TB capacity respectively which were identified in paragraph 13 of the Second Defendant's affidavit sworn on 10 December 2012;
(b)Disk Ven_&Prod_&Rev_O.OO\ (serial number 09020856303050 &0);
(c)JetFlash TS128MJF2B/2L (serial number 6110425FAFAEOOEE &0);
(d)Kingston DataTraveler 2.0 (serial number 7&294ddbf4&0&001 4780BBDB3F9C155050CB4&0);
(e)Kingston DataTraveler 101 02 (serial number 001 CCOEC3467B B20B 707003 8&0);
(f)Lexar JumpDrive FireFly (serial number AARCH4IMZOH6JXC 1&0);
(g)SanDisk Cruzer Edge (serial number 200435139013E672EFF
5&0);
(h) SanDisk Cruzer Micro (serial number 3550600ED252F3A8&0);
(i) Seagate OoFlex Desk (serial number NAOLNCPQ&O);
(j) Toshiba External USB 3.0 (serial number 20120614061065&0);
(k)Western Digital My Passport 0740-Revision 1003 (serial number 575847314138313830353231&0);
(l)Kingston DT 101 02 (serial number 0019E06B7101F06197
D11249);
(m) Kingston DataTraveler 2.0 (serial number 11592);
(n) Lexar JD FireFly USB (serial number AARCH4IMZOH6JXC1);
(o)Kingston DataTraveler 02 (serial number 001372970D64EA4196 2C0018);
(p)HUAWEI Mobile Connect (serial number 7&1329e35c&0&12345 67890ABCDEF&l); and
(q) SanDisk Cruzer Blade serial number 20060876610A41B2C6F7).
…
(4)Leave be granted to the Plaintiff to file and serve interrogatories in the form attached and marked ‘A’, to be answered by the Second Defendant on affidavit to be filed and served within 42 days after service of the interrogatories.
(5)Leave be granted to the Plaintiff to cross-examine the Second Defendant on a date to be fixed by the Court on her answers to such interrogatories and on her affidavits filed to date.
These are the reasons for decision in relation to NHC’s application made on the Summons.
In support of the Summons NHC relies upon are the affidavits of Mr McKemmish, a computer expert, sworn 21 March 2013 and 26 March 2013, the affidavit of Ms Munoz-Greco affirmed 5 March 2013 and the affidavit of Mr De Souza sworn 5 March 2013.
The Defendants oppose the Summons and rely upon the affidavit of Ms Angelova filed on 17 May 2013 and the affidavit of Mr Cochrane sworn 21 May 2013.
The first question is whether the Order has been complied with by the Defendants.
Compliance with Order — Defendants’ Contentions
The Defendants submit they have complied with the Order.
The Defendants say they have made available to NHC the Defendants’ laptop computer, Smartphone and external hard drives/storage devices. Further, the Defendants say that they do not own or have in their possession any other desktop computer, tablet computers or USB devices relevant to the issues in this proceeding.
On the other hand, NHC’s computer expert, Mr McKemmish, states in his report that the devices referred to in paras 1(a) to (k) of the Summons were connected to Ms Angelova’s laptop (the ‘Home Laptop’), work computer (‘NHC Computer’) or both. The devices referred to in paras 1(l) to (q) of the Summons were only connected to the NHC Computer. The Defendants provided responses to these allegations.
Ms Angelova refers to the three Toshiba USB devices described in para 1(a) of the Summons as ‘Toshiba USB storage devices’. The Defendants say that these have been provided to NHC which has already made forensic images of the devices.
Mr McKemmish refers to these devices in the body of his report dated 21 March 2013 as:
a)A ‘Western Digital MyBook essential 1130’ external USB hard drive, serial number WCAV5K344885 (see page 7);
b)A ‘Western Digital 4000BEV’ external USB hard drive, serial number WXNY08S6D498 (see page 8); and
c)A ‘Western Digital My Passport 0740’ external USB hard drive, serial number WXW1CB1P7526.
Mr McKemmish refers to these devices in an attachment to his report as:
a)A ‘Western Digital MyBook essential 1130’ external USB hard drive, serial number 57434156354B33343483835&0;
b)A ‘Western Digital 4000BEV’ external USB hard drive, serial number 57442D57584E593038533644343938&0; and
c)A ‘Western Digital My Passport 0740’ external USB hard drive, serial number 575857314342315037353236&0.
The Defendants say that some of the devices might have been connected to Ms Angelova’s Home Laptop when her children or friends were using the Home Laptop. Ms Angelova deposes that her children and friends would connect devices to the Home Laptop to show photographs, videos or other information. Ms Angelova’s children do not have any of the devices referred to above. Further, Ms Angelova does not recall which of her friends used her Home Laptop.
Notwithstanding the above, the Defendants say that none of the devices referred to in the Summons or Mr McKemmish’s report were connected to Ms Angelova’s Home Laptop or NHC Computer on 23 or 24 November 2011 which is the relevant period in this proceeding.
The Defendants contend that, even if the devices were connected to Ms Angelova’s Home Laptop during the relevant period and were in the Defendants’ possession, which is denied, the devices are not relevant to this proceeding.
NHC alleges that the ‘TeamViewer’ program was used to remotely control and/or transfer files from Ms Angelova’s NHC Computer. Ms Angelova deposes she only has one personal computer being the Home Laptop. NHC’s evidence is that the TeamViewer program was not installed or used on Ms Angelova’s Home Laptop. In the circumstances, the Defendants say that no relevant information could have been transferred from Ms Angelova’s Home Laptop to the devices.
The Defendants say further that NHC’s allegation that the Defendants might have a second computer which has not been produced is a mere assertion, for which there is no supporting evidence. They contend that, at its highest, Mr McKemmish states in his report that two different computers were connected to Ms Angelova’s ‘WD Passport’ device. This device was primarily used to back up the files contained on Ms Angelova’s ‘WD 4000BEV’ device which stored Ms Angelova’s photographs, VOT’s financial records and other personal information. Ms Angelova deposes that the WD Passport device was probably connected to another computer for the purpose of backing up or sharing photographs. In any event, the WD Passport device has already been imaged by NHC.
According to Mr McKemmish, an ‘Eraser’ program was used on the following dates:
Date
Time
Owner
Event
22/05/2012 6:12:00 PM Undetermined Eraser was present on the Home Laptop. 31/10/2012 12:05:39 PM Irina.Angelova.NEW HEAR Eraser version 6.0.1 0.2728 was successfully installed. 31/10/2012 12:24:44 PM Irina.Angelova.NEW HEAR Activity associated with the Eraser program recorded in the Windows registry. 31/10/2012 12:24:45 PM Irina.Angelova.NEW HEAR Activity associated with the Eraser program recorded in the Windows registry. 31/10/2012 12:24:49 PM Irina.Angelova.NEW HEAR Activity associated with the Eraser program recorded in the Windows registry. 31/10/2012 12:27:27 PM Irina.Angelova.NEW HEAR Activity associated with the Eraser program recorded in the Windows registry. 19/11/2012 6:50:02 PM Irina.Angelova.NEW HEAR Activity associated with the Eraser program recorded in the Windows registry. 19/11/2012 7:06:57 PM Irina.Angelova.NEW HEAR Activity associated with the Eraser program recorded in the Windows registry. 19/11/2012 7:08:45 PM Irina.Angelova.NEW HEAR Windows event log records that an error occurred whilst trying to install an earlier version (6.0.10.2620) of Eraser. 19/11/2012 7:13:48 PM Irina.Angelova.NEW HEAR Shortcut files for the Eraser program are created. 19/11/2012 7:13:48 PM Irina.Angelova.NEW HEAR Shortcut files for the Eraser program are created. 19/11/2012 7:13:52 PM Irina.Angelova.NEW HEAR Windows event log records that the installation of an earlier version (6.0.1 0.2620) of Eraser was successful. 20/11/2012 9:14:08 AM Irina.Angelova.NEW HEAR Activity associated with the Eraser program recorded in the Windows registry. 20/11/2012 8:13:32 PM Irina.Angelova.NEW HEAR The Windows registry shows that the ‘Times executed entry’ for Eraser has been modified. It currently shows a value of 24. 21/11/2012 11:05:58 AM Irina Activity associated with the Eraser program recorded in the Windows registry. 21/11/2012 11:05:58 AM Irina Activity associated with the Eraser program recorded in the Windows registry. 21/11/2012 11:05:58 AM Irina Activity associated with the Eraser program recorded in the Windows registry. 21/11/2012 11:05:58 AM Irina Activity associated with the Eraser program recorded in the Windows registry. 21/11/2012 11:06:14 AM Irina Activity associated with the Eraser program recorded in the Windows registry. 16/12/2012 10:13:57 PM Undetermined The Eraser program is run. 16/12/2012 11:06:07 PM Undetermined The Eraser program is run. 16/12/2012 11:06:09 PM Undetermined The Eraser program is run.
However, the Defendants say that the use of the Eraser program on Ms Angelova’s Home Laptop does not give rise to an inference that the Defendants in fact deleted documents relating to or evidencing any downloading, emailing, copying, transferring and/or keeping by the Defendants of any electronic file, program or other data from Ms Angelova’s NHC Computer or any other computer of NHC.
Ms Angelova deposes that the Eraser program was used between 31 October 2012 and December 2012 after her employment with NHC ceased, for the purpose of deleting all information which she believed belonged to NHC. Ms Angelova states that the Eraser program was not used when her employment ceased with NHC. Ms Angelova bases this on her evidence that she did not have any information on her Home Laptop belonging to NHC.
Further, Ms Angelova says that the Eraser program was used in December 2012 for the purpose of deleting private information of VOT and photographs.
Compliance with Order — NHC’s Contentions
NHC contends that the Defendants have failed to comply with the Order, and further, have conducted themselves dishonestly in undertaking steps in purported compliance with the Order.
NHC submits that by reason of:
(a) Ms Angelova’s failure to comply with the Order made on 11 December 2012;
(b)her erasure of so many files during the conduct of this litigation, before and particularly after the Order made on 11 December 2012;
(c) her attempt to conceal such erasures by use of the ‘plausible deniability’ function of the Eraser program;
(d) her complete failure to inform NHC or the Court of any such erasures, or to provide any explanation for them, until her most recent affidavit filed on 17 May 2013 in response to the present application;
(e) her failure to disclose her use of a ‘Lexar JD FireFly USB Device’, which was connected to her NHC Computer just one day before she resigned from NHC and was connected to her Home Laptop only four days before she ceased working for NHC,
the purpose of the Order made on 11 December 2012 has been frustrated and NHC has been denied the proper opportunity provided by r 37.02 of the Supreme Court (General Civil Procedure) Rules 2005 (‘SCR’) to enable it to decide whether to commence a proceeding in this Court.
In such circumstances, to enable NHC to make the decision contemplated by r 37.02, it says that it ought to be entitled:
(a) to serve interrogatories in the form annexed to the present Summons dated 28 March 2013, to be answered on affidavit by Ms Angelova; and
(b) to have an opportunity to cross-examine Ms Angelova on her answers to such interrogatories, and any other matters set out in her affidavits filed to date, on a date to be fixed.
However, in light of the information provided in Ms Angelova’s most recent affidavit filed on 17 May 2013 in response to the present application, NHC no longer presses a number of the interrogatories sought in its Summons.
Compliance with Order — NHC’s Evidence
NHC relies on the following factual material, which it says is made out on the evidence.
Unexplained use of Lexar JD FireFly USB Device
On 10 November 2011, (just one day before Ms Angelova resigned from NHC), a ‘Lexar JD FireFly USB Device’ was connected to her NHC Computer.
Mr McKemmish’s recent investigations have revealed that, on 21 November 2011, (11 days after Ms Angelova had announced her resignation and only four days before she ceased working for NHC), this same Lexar JD FireFly USB Device was connected to Ms Angelova’s Home Laptop.
The fact that the Lexar JD FireFly USB Device was connected to both Ms Angelova’s NHC Computer and her Home Laptop allows the inference that it was in her possession and control.
The fact that the Lexar JD FireFly USB Device was connected to Ms Angelova’s NHC Computer just before she announced her resignation from NHC, then was connected to her Home Laptop shortly before she ceased working for NHC and commenced working for New Hearing, raises the obvious possibility that she used that USB device:
(a) to download NHC’s data onto that USB device; and
(b) to copy NHC’s data from that USB device to her Home Laptop.
Until 17 May 2013, Ms Angelova had never explained to NHC the existence or use of this Lexar JD FireFly USB Device. This was despite NHC’s repeated requests to identify such storage devices in correspondence dating back to a letter from NHC’s solicitors of 30 August 2012.
Nor did Ms Angelova make this device available to NHC’s solicitors by 18 December 2012 for examination, as required by para 1(d) of the Order made by this Court on 11 December 2012.
In her affidavit, filed on 17 May 2013, Ms Angelova asserts for the first time, that she previously owned such a Lexar device ‘which I lost in or around September 2012’. She explains further that:
Sometimes, I would download material from the internet such as papers and case studies on recent developments in software development, store it on a USB device and take the device to and from work. I did this to improve my skills and knowledge.
This explanation is not only extremely late, but inherently implausible. It suggests that she was only able to download such materials from the internet while working at NHC and not on her Home Laptop, yet it is clear that her Home Laptop also had access to the internet and she could have downloaded any such materials at home.
In the circumstances, NHC submits that it ought to be able to cross-examine Ms Angelova on this aspect of her evidence.
Unidentified computer connected by TeamViewer to Ms Angelova’s NHC Computer on 23–24 November 2011
There remains the unanswered question as to the identity of the unknown computer which was connected via TeamViewer to Ms Angelova’s NHC Computer on 23 and 24 November 2011.
NHC submits that there is a strong prima facie case that Ms Angelova was the person who was using TeamViewer on her NHC Computer on 23 and 24 November 2011, particularly in the 32 minute period between 4:48 pm and 5:19 pm on 23 November 2011 during which TeamViewer was downloaded and installed on the NHC Computer and used to connect to an unidentified second computer (the ‘Second Computer’).
NHC relies on the following particulars:
(a) four property listings were viewed on the website on Ms Angelova’s NHC Computer on 23 November 2011, all of which were near Ms Angelova’s current home address in Cheltenham;[1] and
(b) Each of the nine other people who were working in NHC’s IT department at that time has given direct evidence that he or she did not use Ms Angelova’s NHC Computer to look at the website in November 2011 for real estate listings in Cheltenham.
[1]Affidavit of Michael Anthony Smith sworn 19 October 2012 at [12]. Ms Angelova’s address is also sometimes described as being in Highett, which is a locality within Cheltenham.
Ms Angelova has never denied that she was the person looking up Cheltenham property listings on her NHC Computer on 23 November 2011. Rather, she swore on 10 December 2012 (over a year later) that she had ‘no recollection’ of doing so.
If it is assumed for argument’s sake that Ms Angelova was the person viewing those Cheltenham property listings on her NHC Computer, then the question is who was the person using TeamViewer on her NHC Computer during that same 32 minute period between 4:48 pm and 5:20 pm on 23 November 2011.
Within that 32 minutes the following activity took place on her NHC Computer:
(a) At 16:48:47 hrs, somebody accessed the TeamViewer website;
(b) At 16:49:15 hrs, somebody downloaded the TeamViewer program from the TeamViewer website;
(c) At 16:49:45 hrs, somebody installed TeamViewer;
(d) At 16:49:49 hrs, somebody connected Ms Angelova’s NHC Computer to the First Computer using TeamViewer;
(e) Three minutes later, at 16:52:53 hrs, somebody accessed the Hotmail website;
(f) Five minutes later, at 16:59:47 hrs, somebody remotely accessed the file ‘development2.csv.bak’ by a file share, not by TeamViewer;
(g) Thirteen seconds later, at 17:00 hrs, somebody created a file named ‘import.txt.lnk’ in the folder ‘C:\Documents and Settings\irinaa\Recent\’ within the C drive;
(h) Six and a quarter minutes later, at 17:06:13 hrs, Ms Angelova accessed the real estate website and a half minutes later, at 17:09:54 hrs, somebody ended the TeamViewer connection between Ms Angelova’s NHC Computer and the First Computer;
(j) One second later, at 17:09:55 hrs, somebody connected Ms Angelova’s NHC Computer via TeamViewer with the Second Computer, and that connection lasted almost 19 hours until 11:00:26 hrs on 24 November 2011;
(k) Twenty-one seconds later, at 17:10:16 hrs, Ms Angelova viewed a property on at 1/3 Evergreen Circuit in Cheltenham;
(l) At 17:13:04 hrs, Ms Angelova viewed a property on at 3/5–7 Hall Street in Cheltenham;
(m) At 17:13:42 hrs, Ms Angelova viewed a property on at 2/204 Charman Road in Cheltenham;
(n) At 17:17:15 hrs, Ms Angelova viewed a property on at 7/49 Wilson Street in Cheltenham; and
(o) Two and a quarter minutes later, at 17:19:33 hrs, somebody accessed the webmail page for the user account [email protected] (this Hotmail address includes ‘Irina’ spelt backwards).
In particular, the explanation that someone other than Ms Angelova used her NHC Computer to connect to the Second Computer via TeamViewer involves a highly implausible series of events in a period of 21 seconds (between 17:09:55 hrs and 17:10:16 hrs), within which:
(a) the other person would have been sitting at Ms Angelova’s NHC Computer and connected Ms Angelova’s NHC Computer via TeamViewer with the Second Computer;
(b) that other person then vacated Ms Angelova’s NHC Computer;
(c) Ms Angelova returned to sit at her NHC Computer to resume her earlier inspection of without her noticing that other person’s presence at her NHC Computer in the preceding 21 seconds.
NHC submitted that, when viewed objectively, the most compelling conclusion is that Ms Angelova was the person who sat at the NHC Computer and undertook all those activities within that 32 minute period between 4:48 pm and 5:20 pm on 23 November 2011.
It was also submitted that the evidence is also compelling that Ms Angelova was the only person who undertook the activities recorded on her NHC Computer on Thursday 24 November 2012.
Mr McKemmish has concluded, and Mr John Macaulay, Director of Forensics at KordaMentha Melbourne, has not disputed, that the following activities took place on Ms Angelova’s NHC Computer on Thursday 24 November 2011:
(a)at 09:25 hrs a file named ‘IndiaStats.pjx.lnk’ was created in the folder, ‘C:\Documents and Settings\irinaa\Recent\’ within the C drive;
(b)from 09:28:33 hrs files were accessed that are associated with a software program Fox Pro, consistent with the work pattern of a senior software developer;
(c)at 09:33 hrs a file named ‘nzstatsmonthly.pjx.lnk’ was created in the folder, ‘C:\Documents and Settings\irinaa\Recent\’ within the C drive;
(d) at 10:13:45 hrs the immigration website was accessed;
(e)between 10:55 hrs and 10:59 hrs 443 files located in the folder ‘C:\Program Files\Cisco Systems\CTIOS Client’ were created and modified;
(f)at 10:57 hrs 168 files located in the directory ‘C:\WINDOWS\assembly\GAC_MSIL’ were created;
(g) at 11:00:26 hrs the TeamViewer program was correctly shut down; and
(h) at 12:02:43 hrs the Hotmail website was accessed.
Ms Angelova cannot point to a colleague, Mr Chakrabarty, undertaking these activities on her NHC Computer on 24 November 2011 — he flew back to Sydney the night before.
Ms Angelova has admitted that she was working on the files ‘IndiaStats.pjx.lnk’ and ‘nzstatsmonthly.pjx.lnk’ even if she cannot specifically recall accessing these files on 24 November 2012. She has also admitted viewing the website from time to time and has conceded ‘in light of this, it is likely I used [the NHC Computer] at different times on 24 November 2012.’
Mr McKemmish has concluded, and Mr Macaulay has not disputed, that between 3:00 pm on 23 November 2011 and 12.00 pm on 24 November 2011, there were 838 files which are shown as being owned by the ‘irinaa’ account name or the associated SID S-1-5-21-212786385-3084165865-1568137020-1240, which includes the files referred to above.
It follows that there is a strong evidentiary basis to place Ms Angelova at her NHC Computer for each of the activities identified at [59](a), (b), (c), (d), (e) and (f) above. This then puts her at the NHC Computer only a minute and a half before someone used that computer to correctly shut down TeamViewer at 11:00:26 hrs.
Given the direct sworn evidence of each of the nine other people who were working in NHC’s IT department at that time that he or she did not download, install or use TeamViewer on Ms Angelova’s NHC Computer on 23 or 24 November 2011, there is a very strong prima facie case, so NHC submitted, to find that she was the person who did that.
Mr McKemmish’s analysis of Ms Angelova’s Home Laptop did not identify any instance of the TeamViewer software having been installed or used on that Home Laptop. Nor did Mr McKemmish find any indication of the various user accounts or TeamViewer IDs found on Ms Angelova’s NHC Computer, as identified in Mr Foster’s 30 August 2012 report.[2]
[2]Mr Foster is a colleague of Mr McKemmish.
It follows, on the basis of the strong prima facie case, so NHC submitted, that Ms Angelova was the person who used TeamViewer to connect her NHC Computer to the Second Computer on 23 November 2011 and to shut down that connection on 24 November 2011, there is also a strong prima facie case that:
(a) the Second Computer was not Ms Angelova’s Home Laptop;
(b) Ms Angelova knows the identity of the Second Computer, and has deliberately refrained from informing NHC and the Court of the identity of the Second Computer.
In the circumstances, NHC submits it ought to be able to cross-examine Ms Angelova on this aspect of her evidence.
Ms Angelova put on notice not to destroy evidence
On 2 July 2012, NHC’s solicitors first wrote to Ms Angelova to express NHC’s concerns. Amongst other things, that letter put Ms Angelova on notice not to destroy relevant evidence, as follows:
Please note you and VOT must preserve and not destroy any files, documents or information (be they in hard copy or soft copy format) that may be relevant to any proceedings commenced by NHC in relation to any of the above matters. Should files, documents or information be destroyed there may be serious legal consequences for you and any other person or entity involved.
On 9 July 2012, by her solicitor’s letter, Ms Angelova stated that she had never ‘removed, accessed, downloaded or transferred any files, software or other information belonging to [NHC].’ NHC submitted that it is clear, from at least this time, that she understood that the allegations put against her by NHC related to this type of conduct.
On 27 August 2012, Ms Angelova instructed her solicitors to send a letter which offered to have an independent IT expert conduct a computer forensic analysis of her Home Laptop. NHC submitted that here can be no doubt that, from at least that time, Ms Angelova understood that the information on her Home Laptop was centrally relevant evidence in this proceeding.
Ms Angelova’s failure to disclose her use of the Lexar JD FireFly USB
On 30 August 2012, NHC’s solicitors put Ms Angelova further on notice that, in addition to the unexplained use of TeamViewer on her NHC Computer in the last two days she worked at NHC, there was a prima facie case that she had ‘connected external storage devices to the computer onto which she could have transferred documents and information from NHC’s business.’
That letter enclosed a report by Mr McKemmish’s colleague Mr Foster, which identified the Lexar JD FireFly and seven other USB devices as having been connected to Ms Angelova’s NHC Computer.
NHC said that what was not known to it at that time, or ever disclosed by Ms Angelova to NHC or the Court, was that the Lexar JD FireFly USB Device had been connected not only to Ms Angelova’s NHC Computer on the day before she resigned, but also had been connected to Ms Angelova’s Home Laptop computer on 21 November 2011, which was:
(a) 10 days after Ms Angelova had announced her resignation from NHC; and
(b) only four days before she ceased working for NHC.
NHC’s solicitors’ letter of 30 August 2012 requested that Ms Angelova identify ‘all computer storage devices to which she had access at the time of the activity [23–24 November 2011], including the devices connected to [Ms Angelova’s NHC Computer] at the relevant time, verified by statutory declaration.’
Ms Angelova has never provided any such identification. Her solicitor’s letter of 6 September 2012 sidestepped the issue by pointing out that Mr Foster’s report ‘makes reference to a number of USB devices which predate the relevant period of 23 and 24 November 2011.’
NHC submitted that this was clearly a disingenuous explanation of Ms Angelova’s use of the Lexar JD FireFly USB Device in question only two days before ‘the relevant period’, particularly in light of the fact she did not disclose that she had also connected that USB to her Home Laptop on 21 November 2011.
Ms Angelova’s affidavit filed on 17 May 2013 asserts, for the first time, that she ‘lost’ this USB ‘in or around September 2012’.
NHC submits that there are several reasons to doubt the sincerity of this explanation:
(a) the explanation is provided very late, and was not included in any of the three other affidavits Ms Angelova swore since this USB was identified in the report provided by NHC’s solicitors on 30 August 2012;
(b) her recent explanation of her use of this USB is inherently implausible for the reasons set out above: she suggests that she used it to download material from the internet such as papers and case studies on recent developments in software development to take it to and from work, yet she had access to download such materials from the internet on her Home Laptop; and
(c) the alleged loss took place conveniently soon after the receipt of the enquiry by NHC’s solicitors on 30 August 2012, and after she had been put on notice of her obligation to preserve and not destroy any files, documents or information (be they in hard copy or soft copy format) that may be relevant to any proceedings commenced by NHC in relation to any of these matters.
In the circumstances, NHC submitted that it ought to be able to cross-examine Ms Angelova on this aspect of her evidence.
Ms Angelova’s erasure of information on her Home Laptop on 31 October 2012
On 26 October 2012, NHC commenced these proceedings by way of summons seeking orders, inter alia, against the Defendants for access to and the making of forensic images of any of the Defendants’ computers, Smartphones and/or external storage devices.
On 23 October 2012, NHC filed the vast majority of its affidavit evidence, including the affidavits of Ms Angelova’s co-workers and its forensic computer expert, Mr McKemmish.
On 31 October 2012, the Defendants filed a notice of appearance. By that time, Ms Angelova had been legally represented for over three months, and her legal advisers had had over a week to digest NHC’s affidavit evidence and to advise Ms Angelova of her position.
By that time, as a litigant in a proceeding before the Supreme Court having the benefit of professional legal representation, in the context of an application for access to make forensic images of her computers, it was submitted by NHC that Ms Angelova ought to have been squarely on notice of her obligation not to delete information on her Home Laptop. Such information was the obvious subject of the litigation.
It was further submitted by NHC that indeed, Ms Angelova had been put on notice of her obligation not to destroy evidence since receipt of NHC’s solicitors’ letter dated 2 July 2012.
Mr McKemmish’s recent investigations have revealed that, on the same day that Ms Angelova entered her appearance, 31 October 2012:
(a)the ‘WD My Passport USB’ was connected for the first time to Ms Angelova’s Home Laptop (at 11:21 am); and
(b) a particular version of the software program called ‘Eraser’ was installed and run on Ms Angelova’s Home Laptop by the user ‘Irina.Angelova.NEWHEAR’.
As noted by Mr McKemmish, Ms Angelova’s Home Laptop has a user account ‘Irina.Angelova.NEWHEAR’ which provides access to the New Hearing network, either when the Home Laptop is connected directly or by remote connection.
It was submitted by NHC that the user name ‘Irina.Angelova.NEWHEAR’ which installed and ran the Eraser program on 31 October 2012 was Ms Angelova acting in her capacity as an employee of NHC’s competitor New Hearing.
NHC explained that, as its name suggests, the ‘Eraser’ program is designed to and does permanently and irretrievably delete files that a person does not want others to read or access.
One of the optional settings on the ‘Eraser’ program allows the user to replace erased files with other files ‘to allow plausible deniability’. When this option is active the following occurs:
(a) The content of each selected file and/or folder is overwritten a number of times with random data. This makes recovery of all or part of the data impossible.
(b) The file and folder names are replaced with random letters, thereby preventing the file or folder name, which may be descriptive of the content, from being discovered. In replacing the file or folder name, the exact number of characters that make up the name are used in the overwriting process.
(c) The file extension is replaced with random data, thereby preventing someone from determining what type of file has been erased.
(d) The file or folder creation, last access and last modified date and time values are removed from the filing system (referred to as the ‘file system date and times’). Again, this prevents a person from trying to learn something about the file or folder after being erased.
Mr McKemmish found that when the Eraser program was used on Ms Angelova’s Home Laptop the ‘plausible deniability’ option had been activated, yet when Ms Angelova provided her Home Laptop for examination the ‘plausible deniability’ option had been deactivated.
NHC pointed to Ms Angelova’s most recent affidavit which asserts that
I used the Eraser program on these devices on 31 October 2012 after my employment ended with my new employer for the purpose of deleting all information which I believed belonged to it.
NHC submitted that it followed that:
(a) Ms Angelova admits that there was information on her Home Laptop for the purposes of her employment by New Hearing;
(b) Ms Angelova had been on notice for several months:
(i) that this proceeding concerned an allegation that there were copies of NHC’s information on her computers;
(ii) that she was obligated not to destroy evidence relevant to the proceeding; and
(c)Ms Angelova admits that she deleted such information on the same day that her solicitors entered an appearance for her in this proceeding.
NHC submitted that the net result is that by deleting this information Ms Angelova has deleted the key evidence which the Court could compare with NHC’s information to determine whether Ms Angelova had taken any of NHC’s information.
It was observed that if the information which Ms Angelova deleted from her Home Laptop showed no copying of NHC’s information, there was no need to delete it. On the contrary, the information would have been exculpatory and might have provided a compelling answer to NHC’s allegations.
The fact that Ms Angelova took the further, optional, step of activating a ‘plausible deniability’ function on the program she used to delete such information, and later took the step of deactivating that function, indicates that she was conscious of a need not only to delete such information, but to delete it in a way that she hoped NHC would not detect. It was submitted by NHC that such conduct is plainly consistent with a consciousness of guilt.
For these reasons NHC submitted that it ought to be able to cross-examine Ms Angelova on this aspect of her evidence.
Ms Angelova’s further erasure of files after Court hearing on 16 November 2012
Mr McKemmish has found that, on 14 November 2012, Ms Angelova’s WD My Passport USB was connected to an unknown computer other than Ms Angelova’s Home Laptop.
At a hearing on 16 November 2012, I gave directions, inter alia, requiring the Defendants to file any affidavits by 3 December 2012 and setting a hearing date of 11 December 2012.
NHC submitted that Mr McKemmish’s recent investigations have revealed that:
(a) on 17 November 2012 at 17:05 hrs, the WD My Passport USB was connected to a Windows 7 computer and files were deleted from it via the normal Windows recycle bin functionality;
(b) on 19 November 2012, the user ‘Irina.Angelova.NEWHEAR’ opened the Eraser Software manual on Ms Angelova’s Home Laptop;
(c) by 20 November 2012, the Eraser program had been run 24 times on Ms Angelova’s Home Laptop; and
(d) on 21 November 2012, the user ‘irina’ further operated the Eraser program on Ms Angelova’s Home Laptop.
NHC pointed out that, as noted earlier, Mr McKemmish found that when the Eraser program was used on Ms Angelova’s Home Laptop the ‘plausible deniability’ option had been activated, yet when Ms Angelova’s Home Laptop was provided for examination the ‘plausible deniability’ option had been deactivated.
Ms Angelova never disclosed her erasure of this information to NHC or the Court in the affidavits she swore on 4, 10 or 18 December 2012.
In her most recent affidavit filed on 17 May 2013, she has stated: ‘Whilst I do not specifically recall, it is possible that I used the Eraser program at different times up until about late November 2012 for the purpose of deleting information.’
NHC submitted that this explanation is very vague and very late, and that it ought to be able to cross-examine Ms Angelova in this regard.
Ms Angelova’s affidavits dated 4 and 10 December 2012
On 4 December 2012, Ms Angelova swore an affidavit. NHC pointed to that affidavit failing to deal at all with:
(a) the question of USBs connected to her NHC Computer;
(b) the fact that she had connected at least one of those same USBs to her Home Laptop;
(c) the existence of other USB devices which she had recently connected to her Home Laptop; and
(d) the fact that she had recently operated the Eraser program:
(i) on her Home Laptop; or
(ii) on the WD My Passport USB connected to her Home Laptop.
On 6 December 2012, NHC filed the remainder of its evidence, including its written submissions.
On 10 December 2012, Ms Angelova filed a second affidavit.
In para 13 of her 10 December 2012 affidavit she stated that she owned three Toshiba USB storage devices, with a 400 GB, 500 GB and 1 TB capacity respectively.
The parties are in dispute as to whether these three Toshiba 400 GB, 500 GB and 1 TB USBs identified in her 10 December 2012 affidavit are the same as the three Western Digital 380 GB, 750 GB and 1 TB USBs which Ms Angelova subsequently provided to NHC’s solicitors for inspection on 18 December 2012. Mr McKemmish explains that Toshiba and Western Digital are different and unrelated brands.
In para 14 of her 10 December 2012 affidavit Ms Angelova swore: ‘I do not have any other external storage devices in my possession, custody or control.’
In para 16 of that affidavit she swore further: ‘I have no other … USBs, external hard drives or other external storage devices other than the items identified in this and my earlier affidavit.’
Ms Angelova’s further erasure of files after Order made on 11 December 2012
At a hearing on 11 December 2012, the Court made the Order set out above. That Order was entered on 13 December 2012.
NHC points out that Mr McKemmish’s recent investigations have revealed that:
(a)on 13 December 2012, the Eraser program was used to erase 43 files from Ms Angelova’s Western Digital My Passport 0740 external storage device;
(b)on 14 December 2012, each of the following ten USB devices was unplugged from Ms Angelova’s Home Laptop:
(i) Disk Ven_&Prod_&Rev_0.00\;
(ii) JetFlash TS128MJF2B/2L;
(iii) Kingston DataTraveler 2.0;
(iv) Kingston DT 101 G2;
(v)Lexar JD FireFly (which Ms Angelova now asserts she lost in about September 2012);
(vi) SanDisk Cruzer Edge;
(vii) SanDisk Cruzer Micro;
(viii) Seagate GoFlex Desk;
(ix) Toshiba External USB 3.0; and
(x) Western Digital My Passport 0740 – Revision 1003;
(c)on 16 December 2012, the Eraser program was run three times within a one hour period on Ms Angelova’s Home Laptop;
(d)on 17 December 2012 at 09:46 hrs, the WD 4000BEV external USB hard drive was connected to Ms Angelova’s Home Laptop;
(e)on 17 December 2012, the Western Digital My Passport USB was connected to Ms Angelova’s Home Laptop and a file was erased from the USB using the Eraser program; and
(f)on 17 December 2012 at 10:14 hrs, the WD My Book 1130 external USB hard drive was connected to Ms Angelova’s Home Laptop.
NHC pointed out that, as noted above, Mr McKemmish found that when the Eraser program was used on Ms Angelova’s Home Laptop the ‘plausible deniability’ option had been activated, yet when Ms Angelova’s Home Laptop was provided for inspection the ‘plausible deniability’ option had been deactivated.
Mr McKemmish also found that the ‘plausible deniability’ option had been activated when it was used on the Western Digital My Passport 0740 device.
Ms Angelova did not disclose her erasure of this information to NHC or the Court in the affidavits she swore on 18 December 2012.
In her most recent affidavit filed on Friday 17 May 2013, she states: ‘in or about December 2012, I used the Eraser program on these devices to delete, to the best of my recollection, some private information including financial information of the First Defendant and private photos.’
Mr McKemmish states that this explanation for Ms Angelova’s use of the Eraser program is not supported by what he has observed about the file structure of the files stored on the Western Digital My Passport 0740 device. Within Ms Angelova’s ‘PRIVATE’ folder, in one sub-folder called ‘vt’ containing financial and business information specific to VOT, Ms Angelova only deleted six files and left 75 files undeleted. In another sub-folder called ‘ph’ containing primarily photographs, Ms Angelova deleted only one out of 6059 photographs.
Outside of Ms Angelova’s ‘PRIVATE’ folder, Ms Angelova deleted an additional 23 files using the Eraser program on 13 December 2012, and the location of those 23 files does not suggest to Mr McKemmish that they related to VOT’s financial information or Ms Angelova’s private photographs. Moreover, each of these deleted 23 files have a naming convention which is inconsistent with the naming convention for photograph files.
On this basis, NHC submitted that it has sound grounds to doubt the sincerity of the late explanation provided by Ms Angelova as to her erasure of files after the Court made the Order on 11 December 2012.
In the circumstances, NHC submits that it ought to be able to cross-examine Ms Angelova in this regard.
Failure to comply with Order made on 11 December 2012
On 18 December 2012, Ms Angelova attended the offices of NHC’s solicitors in Melbourne and produced the following items purportedly in compliance with para 1 of the Order made on 11 December 2012:
(a) a Dell Latitude E6510 laptop computer (being the Home Laptop);
(b) three Western Digital external storage devices, namely:
(i) Western Digital MyBook Essential 1130 external USB hard drive which, as noted above, had been connected to Ms Angelova’s NHC Computer and had been connected Ms Angelova’s Home Laptop on 17 December 2012;
(ii) Western Digital ‘4000BEV’ external USB hard drive which had also been connected to Ms Angelova’s NHC Computer and had been connected to Ms Angelova’s Home Laptop on 17 December 2012; and
(iii) Western Digital ‘My Passport 0740’ external USB hard drive from which, as noted above:
1.files had been deleted on 17 November 2012 when connected to another unidentified Windows 7 computer;
2. 43 files had been erased on 13 December 2012; and
3.a further file had been erased on 17 December 2012 when connected to Ms Angelova’s Home Laptop; and
(c) an Apple iPhone 4.
In her most recent affidavit filed on 17 May 2013, Ms Angelova states that the three Toshiba storage devices with 400 GB, 500 GB and 1 TB capacity referred to in her affidavit sworn 10 December 2012 are the same as the three Western Digital devices which she provided to NHC’s solicitors on 18 December 2012.
However, NHC submits that Mr McKemmish’s evidence makes clear that this explanation is simply not plausible, for the following reasons:
(a) the three devices provided by Ms Angelova for examination were Western Digital branded devices and not Toshiba devices;
(b) the Windows Registry on Ms Angelova’s Home Laptop would have recorded each of these three devices as ‘Western Digital’ devices, if they had been. He explains that, if they had been Toshiba branded devices, the Windows Registry would have recorded them as ‘Toshiba’; and
(c) Toshiba and Western Digital are different and unrelated brands, and Mr McKemmish has never heard of those brands being used in respect of the same hard drive.
Accordingly, NHC submits that if Mr McKemmish’s expert evidence is preferred to Ms Angelova’s explanation, the result is that Ms Angelova has failed to comply with the Court’s Order made 11 December 2012 by failing to provide for inspection the three Toshiba devices referred to in her 10 December 2012 affidavit.
On 18 December 2012, the Defendants filed an affidavit purportedly in compliance with para 4 of the Order made on 11 December 2012, set above.
Ms Angelova’s 18 December 2012 affidavit denied possession of any documents identifying any computers referred to in para 4(a) of the Order.
As to para 4(b) of the Order, Ms Angelova’s 18 December 2012 affidavit stated at para 7:
I have reviewed the computer devices which I have provided to the Plaintiff’s solicitors. Following from my review, I cannot identify any documents that either I or the First Defendant have had in our possession relating to or evidencing any downloading, emailing, copying, transferring and/or keeping by the Defendants of any electronic file, program or other date from my NHC computer or any other computer of the Plaintiff. Further I have no recollection of any such documents ever being in my possession or the possession of the First Defendant.
Mr McKemmish’s subsequent investigation provides strong reasons to doubt the reliability of this statement by Ms Angelova, including that the statement:
(a)says nothing to address the obvious inconsistency with paras 12, 14 and 16 of Ms Angelova’s 10 December 2012 affidavit, where she swore that she had no USBs other than three Toshiba devices, none of which she produced on 18 December 2012 if Mr McKemmish’s evidence is accepted;
(b)says nothing about the many erasures undertaken on Ms Angelova’s devices using the ‘plausible deniability’ function of the Eraser program, during the conduct of this litigation and particularly after the Order was made on 11 December 2012, culminating in a flurry of erasures on the day before she produced only some of those devices for inspection; and
(c)only addresses the devices which she provided to NHC’s solicitors — she says nothing at all about the 16 USBs which she had not produced or otherwise identified, 10 of which had been connected to her Home Laptop only four days earlier, six of which had been connected to her NHC Computer, and one of which had been connected to both her NHC Computer and Home Laptop shortly before she ceased working for NHC.
Interrogatories and cross-examination
In light of the matters set out above, NHC submitted that Ms Angelova has not complied with the Order made on 11 December 2012, and ought to be compelled to comply with that Order.
Further, NHC submits that for the reasons set out above, the purpose of the Order made on 11 December 2012 has been frustrated and NHC has been denied the proper opportunity provided by r 37.02 of the SCR to obtain discovery from Ms Angelova to enable it to decide whether to commence a proceeding in the Court.
In such circumstances, to enable NHC to make that decision, NHC submits that it ought to be entitled:
(a)to serve interrogatories in the form annexed to the Summons, to be answered on affidavit by Ms Angelova; and
(b)to have an opportunity to cross-examine Ms Angelova on her answers to such interrogatories, and any other matters set out in her affidavits filed to date.
NHC submits that the task of answering the proposed interrogatories would not be unduly onerous in the circumstances, particularly given Ms Angelova’s own familiarity with the subject matter given her occupation as an IT consultant, and her preparedness to answer some of the interrogatories already by her affidavit filed 17 May 2013.
It recognises that it is of course an unusual step to require Ms Angelova to answer interrogatories in the context of a preliminary discovery application. However, NHC submits that Ms Angelova has created the need for such a remedy by her own actions in failing to comply with the Court’s Order made on 11 December 2012 and by covertly erasing so many files both before and after that Order was made.
Defendants’ Submissions on Court’s Power to Grant Leave to Serve Interrogatories and Order Cross-Examination of Ms Angelova
Rule 30.02 of the SCR provides:
(1)Subject to the other paragraphs of this Rule, any party may serve interrogatories on another party relating to any question between them in the proceeding.
(2) ...
(3)Where paragraph (2) does not apply, the Court may order that any party may serve interrogatories on any other party.
According to Williams’ Civil Procedure: Victoria, discovery by written interrogatories is not available on preliminary discovery or discovery from a non-party under O 32 of the SCR.[3] The Defendants submit that the same rule ought to apply for inspection from a prospective defendant under O 37.
[3]LexisNexis, Williams’ Civil Procedure: Victoria (5 June 2013) [30.01.0].
If interrogatories are permissible under O 37 of the SCR, the Court would retain a discretion as to whether to order them. The Defendants submit it is not appropriate to grant leave to serve interrogatories or to cross-examine Ms Angelova as this would be contrary to the purpose of preliminary discovery.
The purpose of preliminary discovery is to provide what is reasonably necessary to enable a decision to be made whether to commence proceedings, not to assist in strengthening or enhancing a decision to commence proceedings.[4]
[4]Matrix Film Investment One Pty Ltd v Alameda Films LLC [2006] FCA 591 (19 May 2006).
NHC’s subjective opinion that it does not have enough information to decide whether or not to commence proceedings is insufficient. It must be shown as an objective fact that NHC lacks sufficient information to enable a decision to be made whether to commence proceedings.[5]
[5]Alphapharm Pty Ltd v Eli Lilly Australia Pty Ltd (1996) 69 FCR 149.
In the present case, NHC has not advanced any evidence as to why the information it has obtained is deficient such that it is unable to decide whether or not to commence proceedings against the Defendants.
Additionally, NHC has not advanced any evidence as to why the interrogatories, or the information that it seeks to elicit from cross-examining Ms Angelova, will assist it in deciding whether or not to commence proceedings against the Defendants.
In light of the above, the Defendants submitted that leave should not be granted to serve interrogatories or to cross-examine Ms Angelova.
Conclusions as to Power to Order Interrogatories and Cross-Examination in the Circumstances
In my opinion, the Court does not have power to order the delivery of interrogatories or order cross-examination in aid of the power provided for in rr 32.05 or 37.02 of the SCR to assist a party to determine whether or not to issue proceedings.
The purpose of these rules is to enable a person to determine whether or not he or she has a good cause of action against an identified prospective defendant. The procedure enables such a person to make an informed decision on the question before a proceeding is commenced, rather than having to first commence a proceeding and then use the ordinary processes of discovery.
The processes are quite limited. They provide a facility on the one hand for discovery (r 32.05) and on the other hand for the preservation of property (r 37.02) for the stated purpose.
Gobbo J said in Gibson v ANZ Banking Group Ltd:[6]
In my view, the gist of the rule is directed to knowing not whether the case is a strong one or a weak one, not whether it is incidentally supported or what the full range of other material is, but whether the applicant has sufficient information to enable that applicant to decide whether to commence a proceeding.
[6](Unreported, Supreme Court of Victoria, Gobbo J, 30 August 1991) 4.
The power to make the necessary orders is squarely founded in the Rules of Court, and is not a power which otherwise arises under the inherent jurisdiction of the Court.
In my opinion, the power conferred on the Court by rr 32.05 and 37.02 does not extend beyond the terms of those powers as they are defined in the Rules to enable the Court to make ancillary orders of the nature sought in this case, namely the service of interrogatories and cross-examination, in aid of a party deciding whether to commence a proceeding against a person.
In any event, in this case, I am not persuaded that such steps will do more than assist NHC to know whether the case is a strong one or a weak one, or whether it is incidentally supported, or what the full range of other material may be, rather than enabling NHC to decide whether it has sufficient information to decide whether to commence a proceeding.
The fact that there are very suspicious circumstances surrounding the conduct of the Defendants and their purported compliance with the Order of the Court may well give rise to other remedies for NHC, for example under the Civil Procedure Act 2010, if proceedings are ultimately issued, and may well provide a forensic basis for the drawing of adverse inferences against the Defendants, if the allegations are ultimately made out. Further, if destruction of documents by the Defendants is ultimately proven to the requisite criminal standard of proof, this conduct may have serious consequences arising from a contravention of s. 254 of the Crimes Act 1958. However, in my opinion, the circumstances, given the gravity of the allegations, have not been proven to the necessary Briginshaw standard[7], and even if they did meet that standard, in any event provide no legal basis for expanding upon the powers specifically provided for under rr 32.05 or 37.02.
[7]CF. Briginshaw v Briginshaw [1938] HCA 34.
For these reasons, the application should be dismissed.
---
4
0