Eltrak International and Staff Pty Ltd v Collins

Background 6 After obtaining search orders of Mr Collins' home (Eltrak International and Staff Pty Ltd v Collins [2021] FCA 484) on 5 May 2021, the search orders were executed on 7 May 2021 and various items were taken into the custody of the search party, which consisted of an independent lawyer (Ms Louise Nixon), Eltrak's lawyer (Mr John Love), an independent computer expert (Mr Michael Tarnawsky) and Eltrak's computer expert (Mr Gare). 7 Eltrak subsequently filed an originating application, statement of claim and accompanying interlocutory application. The interlocutory application sought to restrain Mr Collins from disclosing or using Eltrak's confidential information. Mr Collins gave an undertaking to the Court that he would not disclose or use Eltrak's confidential information. 8 Pursuant to timetabling orders, Mr Collins had the opportunity to claim that certain electronic material captured by the search parameters were the subject of legal professional privilege or privilege against self-incrimination. 9 Eltrak alleged non-compliance with the 5 May 2021 orders and filed an interlocutory application on 14 October 2021 seeking disclosure and production of further devices asserted to be in the possession of Mr Collins as follows: INTERLOCUTORY ORDERS SOUGHT In this order: (a) 'cloud storage facility' means any online data storage facility, including email accounts, iCloud, Dropbox, Google Drive and Microsoft OneDrive. (b) 'electronic device' means any device capable of electronically storing information, including a computer, tablet device, hard drive, portable storage device, disk or smartphone. (c) 'Independent Computer Expert' means Michael Tarnawsky. (d) "Independent Solicitor" means Ms Louise Nixon of Turks Legal. (e) "Search Parameters" means the parameters set out at Annexure A to the orders of 13 May 2021. 1. [Eltrak] has leave to uplift and remove from the Court registry item 6 referred to in paragraphs 145 - 148 of the Independent Solicitor's Report dated 12 May 2021, such item having been provided to the registry on 12 May 2021. 2. On or before 26 October 2021, [Mr Collins] must produce to the Independent Computer Expert for the purpose of making a digital copy of the information stored therein: (a) any electronic device in his possession, custody or control not already produced to the Independent Computer Expert (for the avoidance of doubt, this includes any mobile phone or iPad that [Mr Collins] claims belong to his children); (b) any cloud storage facility not already produced to the Independent Computer Expert (for the avoidance of doubt, this includes the cloud storage device linked to his primary work mobile phone during his employment with [Eltrak] and the full history of his TPG account from at least August 2015); (c) the FlashDisk storage device (serial number 00000000000F5B) inserted into the HP Laptop used by [Mr Collins] between January to February 2021; (d) subject to order 1, the two USB storage devices (serial numbers 070187F6E2CC7E16 and 00018131100420145744) inserted into the HP Laptop used by [Mr Collins] on 23 March 2021. 3. If [Mr Collins] claims that he is no longer in possession, custody or control of any of the items in order 2, on or before 26 October 2021, [Mr Collins] must file and serve an affidavit deposing to: (a) when the item was last in his control; (b) what use he made of the item in the period between January 2021 to the time it was last in his control; (c) if he provided the item to someone else, why he did so and the identity of that person; (d) if he discarded the item, why he did so and the place where it was discarded; (e) if he destroyed the item, why he did so and the method used to destroy the item; (f) if he no longer has an active account with a cloud storage facility, why he stopped using that account and the date which he stopped using it. 4. On or before 5 November 2021, the Independent Computer Expert shall apply the search parameters to all items produced pursuant to order 2 and provide the electronic material captured in an enumerated form to the Independent Solicitor. 5. Upon the electronic material being provided to the Independent Solicitor pursuant to order 4, the Independent Solicitor shall inform [Mr Collins'] solicitors that [Mr Collins] and/or his solicitors may review the material. 6. On or before 19 November 2021, [Mr Collins'] solicitors shall inform the Independent Solicitor in an enumerated table of any thing which Mr Collins claims to be the subject of legal professional privilege or the privilege against self-incrimination, including the basis for such objection and in respect of which the respondent objects to inspection by [Eltrak] or its solicitors (Objection Notice 3). 7. On or before 23 November 2021, the Independent Solicitor shall provide the applicant's solicitors with: (a) a copy of the Objection Notice 3; and (b) any electronic material provided by the Independent Computer Expert that is not the subject of Objection Notice 3. 8. On or before 30 November 2021, [Eltrak's] solicitors are to provide a response to the objections contained in Objection Notice 3. 9. The matter be listed for a further case management hearing on the next available date after 30 November 2021. 10. Costs be otherwise reserved. 11. The parties have liberty to apply. (bold and italics in original) 10 Orders were made by consent on 19 October 2021 which dealt with the interlocutory relief sought in Orders 1, 2(c), 2(d), 3 to 11. Prior to the hearing of the application, Eltrak's solicitors provided proposed programming orders, as follows: 1. By 4.00pm on 25 March 2022, [Mr Collins] must produce to the Independent Computer Expert for the purpose of making a digital copy of the information stored therein: (a) any electronic device in his possession, custody or control not already produced to the Independent Computer Expert (for the avoidance of doubt, this includes any mobile phone or iPad that [Mr Collins] claims belong to his children); (b) any cloud storage facility not already produced to the Independent Computer Expert (for the avoidance of doubt, this includes the cloud storage device linked to his primary work mobile phone during his employment with the applicant and the full history of his TPG account from at least August 2015). 2. The Independent Computer Expert shall apply the search parameters set out at ANNEXURE A to the orders of 13 May 2021 to all things provided pursuant to order 1. 3. By 10:00am on 8 April 2022, the Independent Computer Expert shall provide the electronic material captured by the Search Parameters (Further Electronic Listed Things) to the Independent Solicitor. 4. By 4.00pm on 8 April 2022, the Independent Solicitor is to provide the Further Electronic Listed Things to the applicant's solicitors. 5. By 6 May 2022, [Eltrak] is to file and serve an amended statement of claim. 6. By 27 May 2022, [Mr Collins] is to file and serve an amended defence. 7. By 10 June 2022, [Eltrak] is to file and serve any reply. 8. Pursuant to r 28.03 of the Federal Court Rules 2011 (Cth) (sic), the proceeding be referred to a mediation by a Registrar of the Court, listed on the first available date after 10 June 2022, at a time to be advised by the Registrar. 9. Should the matter not resolve at mediation, the proceeding to be listed for a case management hearing within 14 days of the date of the mediation. 10. Liberty to apply. (emphasis in original) 11 Mr Collins claimed privilege over a device which had been seized, which was a USB device described as "Item 6". Pursuant to the consent orders dated 19 October 2021, Ms Nixon was permitted to uplift and remove Item 6 from the Registry and provide Item 6 to the Independent Computer Expert to make a digital copy of the USB device. 12 Mr Collins now also claims privilege over seven additional devices, email addresses and electronic data contained within documents described as "Objection Notice 2" and "Objection Notice 3". 13 Eltrak's position is that Mr Collins failed to comply with the Court orders to hand over to Eltrak all electronic devices in his possession containing Eltrak's confidential information or information relating to Mr Collins' employment, or proposed employment, with a competitor of Eltrak. 14 Mr Collins contended that he had deposed to handing over all such electronic devices in his possession and did not have access to any further confidential information. 15 The matter was listed for an interlocutory hearing on 17 March 2022. The parties requested limited cross-examination of witnesses at the interlocutory hearing to clarify any inconsistencies with the evidence. 16 The issues which remained in dispute were whether: (a) Mr Collins is in possession of other mobile devices which have not been disclosed; (b) the Customer List provided by Mr Collins is the entire Customer List in Mr Collins' possession; (c) there are other devices and services which have not been disclosed, such as the iPads of Mr Collins' children and the OneDrive account of Mr Collins' wife; and (d) Mr Collins made copies of Eltrak's confidential information. 17 Eltrak made submissions under a number of headings which were also used by Mr Collins, and which have been adopted in these reasons.

Findings of Credit in Interlocutory Applications 18 An interlocutory application does not finally dispose of the parties' rights. Caution must be taken when deciding interlocutory issues. 19 The Court has the power to make orders as the Court considers appropriate (s 23 of the Federal Court of Australia Act 1976 (Cth)). 20 As Kenny J held at [18] in Wu v Avin Operations Pty Ltd (No 3) [2006] FCA 1321, "[t]he Court has a discretion to permit or refuse an application made in an interlocutory proceeding to cross-examine a deponent on an affidavit that he or she has made, although the discretion to permit such cross-examination is exercised cautiously". 21 In the present matter, the parties sought leave to cross-examine Ms Lissi Whyte, Mr Collins, Mr Gare and Mr Ryan on a limited basis for the purpose of clarifying the evidence. I granted leave for limited cross-examination at the hearing.

The Search Order and the Search 22 The definitions of the search order are contained within Schedule A to the 5 May 2021 orders. The relevant definitions are: Listed Things 1. Any records (whether in hard copy or electronic form) or electronic communications containing [Eltrak's] confidential information. 2. Any records (whether in hard copy or electronic form) or electronic communication with, or relating to: (a) [Eltrak's] confidential information; (b) your employment, or proposed employment, with a competitor of [Eltrak]. 3. Any electronic communications between (including cc and bcc) you and any person associated with a competitor of [Eltrak]. "[Eltrak's] confidential information" for the purpose of the Schedule means: (a) customer names and contact information; (b) sales reports; (c) pricing structures; (d) discount structures; (e) margins; (f) sales campaigns; (g) correspondence with customers (such as SMS messages; WhatsApp messages, emails) including the frequency of those communications; (h) leads. 23 There was some focus on the conduct of Mr Collins and his responses at the time of the search. It was to be expected that, in the circumstances of the search, Mr Collins and his family would have been experiencing some confusion and some trepidation. The order had been made ex parte and the search was unexpected by the Collins family. Apparently, from the evidence, his family was leaving for the weekend at the time the search party arrived. 24 As to what was to be made available, the ex parte orders defined the records to be produced by reference to Eltrak's confidential information and Mr Collins' employment or proposed employment with a competitor of Eltrak. These limitations were clear on the face of the orders which were served at the time. Mr Collins said that his prospective employer was not a competitor. There is no evidence which challenges this. 25 It would be inappropriate to reach conclusions regarding credibility based upon what may have occurred on that morning. For example, Mr Collins' wife was overheard saying to one of her sons "your job is to get all your brothers' laptops and iPads together and chargers and put them together in a bag". Mr Collins deposed to the fact that his children have no laptops (but have tablet devices) and an inconsistency is sought to be drawn. Mr Collins' wife has not provided evidence. As was made clear at the time of the hearing, cross-examination of the witnesses who were called was on a very limited basis. 26 Mr Collins maintained that he did not know the passcodes to any of his children's electronic devices and that none of them were under his control. Mr Collins asserted that later, having had the opportunity to seek advice from his solicitor, he made further electronic devices available to the Independent Computer Expert and the Independent Lawyer, including his wife's laptop (and the corresponding OneDrive account) and his children's iPads and iPhones. Mr Collins deposed that they were inspected on 17 May 2021. 27 Additionally, Mr Collins maintained that any electronic device which had not been provided did not fall within the terms of the search orders as it would not contain Eltrak's confidential information. 28 Criticism was made by Eltrak under the heading "Non-compliance with search orders". Reference was made to Mr Collins' wife's TPG account, laptop, mobile phone; "any other device or cloud where documents may have been created or stored"; and the fact that Mr Collins had provided his son's mobile number to Eltrak as his future contact point. It seems that those electronic devices were provided later. It is also possible that, during the search, it may have been assumed that those electronic devices would not have contained material relating to Eltrak's confidential information and therefore did not need to be provided. In addition, the assertion by Eltrak, that there was non-compliance as a result of having not provided a copy of the employment proposal from Oxworks, would not fall within the ambit of the search orders, provided Oxworks was not a competitor (as Mr Collins suggested). This conclusion (about whether Oxworks was a competitor) might of course be challenged, and it would be expected that many of these matters would be explored at the hearing. 29 Given the state of the evidence, it would not be appropriate to draw any inferences now.

Use of USB Devices 30 Mr Gare conducted a review of the HP Laptop when it was handed back to Eltrak. Mr Gare's analysis concluded that only three USB devices had been installed in the seven and a half years the HP Laptop had been used, and all three of those USB devices were only used in the lead up to Mr Collins' departure, between January and March 2021. Mr Gare was able to identify the USB devices by reference to the serial number. 31 There has been no evidence from the Independent Compute Expert as to the review of that HP Laptop. 32 Mr Collins deposed that he had connected more than three USB devices to the HP Laptop, both for work and personal reasons. In relation to the personal USB devices, Mr Collins referred to the fact that he would often connect a USB device with movies for his children. Mr Collins said that one of Eltrak's suppliers would provide him with USB devices so that he could transfer "flyers, brochures, catalogues and price lists" and that these USB devices were inserted into the HP Laptop and should have shown up. 33 As to the three USB devices identified by Mr Gare, Mr Collins said that he did not want the first USB device to fall into the "wrong hands" and destroyed it in the presence of an Eltrak employee, Mr Montgomery; that the second USB device did not work and was discarded; and that the third USB device was provided to the Court and was referred to as Item 6. 34 Eltrak asserted that Mr Collins' explanations as to the three USB devices identified leading up to his resignation was illogical and improbable. As to the three USB devices, it seems it will be necessary to call evidence from Mr Montgomery, who would deal with the first USB device and the third USB device that has been provided to the Court. That leaves the second USB device, to which the evidence of Mr Collins is relevant. If there are issues about those three USB devices, they will need to be dealt with in a more thorough way as the proceedings continue. 35 Eltrak submitted that if Mr Collins had connected more devices to the HP Laptop, they should have been provided. Of course, if the other devices did not contain either Eltrak's confidential information or information relating to Mr Collins' employment or proposed employment with a competitor, under the terms of the search orders, there was no obligation to hand over the device. 36 There is a conflict of evidence. In the circumstances outlined, I am not in a position to draw conclusions relating to that evidence.

Cloud Storage Facility 37 Eltrak required all national staff to use a system referred to as the "Customer Relationship Management [CRM] system" to manage client information. Mr Collins maintained that he rarely entered information in the CRM system and was "never censured for his non-use of the CRM". Instead, Mr Collins managed his clients on his mobile phone and advised Eltrak upon his departure that the customer contact information (which has been described as the Customer List) was stored on the cloud account attached to the iPhone 6 in the form of a contact list. It seems that this cloud account relates to the iCloud1 email. 38 Mr Collins deposed to attempting to assist Eltrak in locating this Customer List, but was unable to do so as he required an authentication code from the iPhone 6 (which was in the possession of Ms Whyte at that time and who did not pass on any authentication codes that were received). Ms Whyte's evidence is that she did not receive any requests for authentication codes. 39 The Independent Computer Expert contacted Apple Support as an alternative method of gaining access to the cloud storage facility and redirected the authentication code on 17 May 2021 so that the code would be sent to Mr Collin's mobile phone. The Independent Computer Expert requested an export of the data contained in the cloud storage facility from Apple Support as "[a]t the time Apples security measures rejected direct access to the account via the forensic tool and as such it became necessary to revert to requesting a data export of all available iCloud data using Apples own methodology". 40 Neither Eltrak nor the Independent Computer Expert was able to identify the customer contact information during the execution of the search orders. Eltrak submitted that none of the accounts or devices provided during the search orders contained the Customer List now provided by Mr Collins. 41 Mr Gare's affidavit of 21 January 2022 referred to an iCloud account identified by the Independent Computer Expert which had not had its password provided (iCloud3 email). After reviewing Mr Gare's affidavit, Mr Collins was able to log into his iCloud2 email account. Mr Collins found and downloaded customer contact information (which was described as the Customer List) from the iCloud2 email account. The Customer List was then provided to Ms Whyte. The Customer List is a spreadsheet which showed the first name, last name, display name, home phone, mobile phone and organisation of customers and contacts of Mr Collins. 42 In relation to the iCloud 3 email, Mr Collins deposed that he did not have control of that email, that it was not his and that he had attempted to nevertheless log into the iCloud3 email account in the presence of the independent computer expert to no avail (by answering the security questions). 43 During the interlocutory hearing, Mr Collins handed up a letter from Eltrak's solicitors to the Independent Computer Expert which relate to the Independent Computer Expert not being able to locate the Computer List during the search. The Independent Computer Expert was requested to clarify the following: 1. Did you telephone Mr Collins every night over a period of a "few weeks" following 17 May 2021 to see if Mr Collins had received a code? 2. Did you redirect the number linked to the [iCloud2] account back to Mr Collins' phone? If so, when did this occur? 3. Have you been given access to the [iCloud2] account? Also enclosed with this letter is a spreadsheet document Mr Collins has provided, via his solicitor, which is the original electronic version of the document marked annexure 'BC 1' in paragraph 7 (as extracted in Schedule 1). Please advise whether this document BC-1 is contained in the iCloud download and search which you performed. (emphasis omitted; errors in original) 44 With respect to the first question, the Independent Computer Expert responded as follows: Yes. It was necessary to do so due to two-factor authentication security requirements in order to access and download the data. Due to Apple security refusing access to forensic tools, I had requested an export of the iCloud account data for the [iCloud2] account via the Apple methodology on 17 May 2021. During this process, it typically takes Apple some time to compile the requested data, however they do not provide a time frame and it can often range from 1 day to a week to receive notification. I contacted Mr Collins up to twice daily in the late afternoon/ evening to request the required 2-factor authentication code which would then allow me to log into the account and check if the data export was ready to be download. Due to the two-factor requirement (being Mr Collins phone) it was necessary to contact Mr Collins on each occasion that I logged in to check if the data became available. The data became available on 25 May 2021 and I downloaded it. (error in original) 45 With respect to the second question, the Independent Computer Expert responded as follows: Yes, the two-factor authentication phone number was set to Mr Collin's phone number on 17 May 2021 to allow the required secure access whilst we were attempting to access the account in the BDO office using forensic tools. At the time Apples security measures rejected direct access to the account via the forensic tool and as such it became necessary to revert to requesting a data export of all available iCloud data using Apples own methodology. (errors in original) 46 With respect to the third question, the Independent Computer Expert responded as follows: Yes access was provided on 17 May 2021 and subsequently up until 25 May 2021 when the iCloud account data download was available, and the data collected. 47 With respect to the attached spreadsheet, the Independent Computer Expert responded as follows: The document BC-1 is not present in the iCloud data export which I downloaded. I have identified twenty eight vCard formatted contacts (.vcf files) responsive to the search terms, these should have been identified as responsive by the forensic tool used to search the data extract during the initial process however they were not due to the file type (vcf) not being interpreted by the forensic tool. These vCards contain the contact details equivalent to twenty eight rows in the document marked BC-1. I have reviewed the logs from the forensic tool and despite it not reading the vcf file type, no error messages were recorded. As a further quality assurance measure, I have also reprocessed the data with the same result. In order to identify the vCard files responsive to the provided search terms, I have now processed them again after renaming them as plain text (txt as opposed to vcf) files. It appears that this was a programming issue with the forensic tool and I will lodge a support ticket with the vendor. I then applied the search terms and the tool identified the twenty eight vCards containing one or more of the search terms. Attached is a version of the BC-1 document with the rows matching the contents of the twenty eight vCards. As a further precaution, I reviewed the remainder of the processed iCloud archive files, and can confirm that the issue was limited to the handling of vCard files during processing the 80 responsive documents originally identified were provided to you in case "Cloud_B". A review of the other iCloud evidence examined ([iCloud2] "Cloud_A") which was captured directly from iCloud using the forensic tool (I.E. not using the Apple methodology) confirmed that it did not contain any vCard files. (errors in original) 48 I believe the spreadsheet document BC-1 referred to in the letter is the Customer List. The letter of the Independent Computer Expert indicates that a technical issue with the forensic tool used meant that the vCards were not identified. 49 Ms Whyte stated that Mr Collins was directed to provide the Customer List upon his departure but did not do so. Ms Whyte also disputed that the Customer List "is a fulsome copy of any contacts contained in Mr Collins' personal mobile phone", for the following reasons: (a) A number of the individuals listed are persons who have never been and could not be expected to be customers of [Eltrak]. These appear to be friends, family and other acquaintances of Mr Collins. Examples of this are Mr Collins' family members including … (Mr Collins' son) and … (Mr Collins' wife). (b) A number of organisations whom I know personally to be customers of [Eltrak] serviced by Mr Collins during his employment do not appear. Ms Whyte identified entries in the Customer List which were out of date and were no longer valid phone numbers. An example of this included her own entry in the Customer List, which listed a phone number Ms Whyte had not used in more than 10 years. 50 Mr Collins was cross-examined about the Customer List. Mr Collins reiterated that he did not find the Customer List until reviewing the affidavit of Mr Gare and clarified that the Customer List was no more than an exported contact list from his iPhone. 51 Mr Collins was asked about the accuracy of the list, noting Ms Whyte's observation that her entry in the Customer List displayed a number which she had not used in a long time. Mr Collins stated that there were 281 phone numbers in the Customer List, of which 155 were customer contacts or staff from Eltrak and the rest were personal entries. Mr Collins also drew the Court's attention to the fact that there were two entries in the Customer List for Ms Whyte with different phone numbers: one under the name "Lissi" and another under the name "Lissi Whyte". 52 Eltrak referred to a document sent by email from Mr Collins' wife to Oxworks titled "Invoice 18006". Eltrak was unable to locate the original document on Mr Collins' wife's laptop and noted that the file appeared in one of Mr Collins' affidavits as being located on a OneDrive. Eltrak submitted that this indicated the existence of another device and OneDrive account which had not been disclosed. 53 Mr Collins said that his wife generated the invoices for his consultancy work with Oxworks and that "Invoice 18006" was such an invoice. Mr Collins said that "Invoice 18006" was created from an internet template on his wife's laptop and was duplicated when used again in the future. I take it that this is intended to suggest that no copy was retained, as the template was used each month, which would explain the absence of a copy. Both the laptop and the OneDrive account of his wife was provided to and examined by the Independent Computer Expert. 54 Mr Collins swore to having supplied all the customer names and contact information in his possession. Neither the Independent Computer Expert nor Mr Gare identified any evidence that Mr Collins had not supplied his full Customer List, such as it is. It is not in dispute that the iCloud1 email account does not contain the customer list. 55 The iCloud1 email account did contain, separately, the contact information for 28 persons which were not discovered by the Independent Computer Expert during the initial search. The Independent Computer Expert has explained that this was due to an unexpected technical error of the forensic tool used. However, none of the contact information identified by the expert on the iCloud1 email account did not appear in the Customer List which had been provided by Mr Collins after logging into his iCloud2 email account. Mr Collins has said that he is not in control of the iCloud3 email account. On the current evidence, I am no prepared to make any findings to the contrary. 56 There is not sufficient evidence at this point in time to conclude that Mr Collins has another cloud storage facility under his control that has not already been provided to Eltrak.

Mobile Phones 57 The evidence was not conclusive and not at all clear. 58 Mr Gare reviewed Eltrak's mobile phone history records and determined that Mr Collins was initially issued with an iPhone in 2014. That iPhone failed in April 2015 and was replaced with an iPhone 5C (the 2015 mobile phone). Mr Gare did not have any records of the 2015 mobile phone being returned. Mr Gare reviewed Eltrak's mobile phone records which showed that Mr Collins was in the possession of a different iPhone from 2018 (the 2018 mobile phone). Mr Gare noted that the 2018 mobile phone was not returned by Mr Collins. There were no further records of any other changes to the mobile phones held by Mr Collins. Mr Gare was of the view that Mr Collins had been issued with the 2018 mobile phone, but Mr Collins had not returned it. Mr Gare did not have any record of Mr Collins being issued the iPhone 6. 59 Ms Whyte made enquiries of Mr Josh Whyte and Ms Fiona Wilcocks (the National HR Manager), neither of whom had any recollection of Mr Collins returning any iPhone, or reporting at any time that a company-issued mobile phone had ceased to function, nor of receiving an email from Mr Collins requesting confirmation that a returned mobile phone had been received. Neither Mr Whyte nor Ms Wilcocks were called to give evidence. Ms Whyte was of the view that, had Mr Collins reported that his mobile phone stopped working, Eltrak's standard practice meant that he would have received an email detailing arrangements to replace the mobile phone. Of course, that is not direct evidence as to what actually happened. 60 With respect to the iPhone 6, Mr Collins said that: I advised Vater that my iPhone ceased to function, I hired the iPhone from Hire Intelligence. I believe that I received the Vater Spare iPhone 6 which had the handwritten label "Vater Spare iPhone 6" affixed to it, on or about Friday 28 February 2020 (I put my own protective plastic cover over the Vater Spare iPhone 6, and kept the handwritten label on the phone). I returned the hired iPhone to Hire Intelligence. I then returned my broken iPhone to Vater. I restate that the "Vater Spare iPhone 6" that I returned to [Eltrak] was the iPhone that was issued to me by [Eltrak] as a replacement iPhone. 61 Mr Collins said that Hire Intelligence's records indicated that Mr Collins had collected the Hire iPhone on 25 February 2020 and hired it until 28 February 2020, when he received the iPhone 6. Mr Collins deposed to speaking to Hire Intelligence to return the Hire iPhone on 2 March and Hire Intelligence's records indicated the Hire iPhone was returned on 4 March 2020 (there is an approximate 24 hour return time). 62 Ms Whyte said that the Hire Intelligence invoice for the Hire iPhone listed the start date as 26 February 2020 and the end date as 27 February 2020. 63 These facts are broadly consistent with what Mr Collins says. 64 Ms Whyte referred to the fact that Mr Dave Farrow, an employee of Eltrak, received Mr Collins' iPhone 6 on 23 March 2021, the last day of Mr Collins' employment. Ms Whyte stated that Mr Farrow informed her that the iPhone 6 had been factory reset and had all its stored data permanently deleted. Ms Whyte then ordered a new sim card with Mr Collins' work number and a new mobile phone so that she could see any text messages sent, and receive any telephone calls made, to Mr Collins' work phone. 65 Mr Gare said he received the iPhone 6 and the HP Laptop on 25 March 2021. From his records, Mr Gare confirmed that the iPhone 6 was one which he had held from 11 November 2017 until 14 January 2020, and which had been wiped by Mr Gare before being returned by Ms Whyte to Eltrak's head office on 17 February 2020. Mr Gare was aware that Eltrak maintained spare mobile phones that could be issued to staff members on a temporary basis and was of the view that the iPhone 6 was one of those spare mobile phones after 14 January 2020. Mr Gare confirmed that the handwritten label "Vater Spare iPhone 6" was his handwriting. 66 Mr Collins said that he deleted all information off his iPhone 6 in accordance with his employment contract, which relevantly provided: Upon cessation of your employment, you must: … b.1.2 delete (and provide reasonable proof to us of the deletion) all Confidential Information held electronically in any medium in your control. 67 Mr Collins says that he backed the information up onto an iCloud storage account associated with the iPhone 6. 68 Eltrak asserted that Mr Collins' evidence is contrary to that of Mr Gare. That is not strictly correct. From Mr Gare's evidence, the Eltrak mobile phone history records do not account for the return of the 2015 mobile phone, although they do record Mr Collins having possession of a different iPhone from 2018. They also do not record the return of the 2018 mobile phone or the allocation to Mr Collins of the iPhone 6. However, apparently Mr Farrow received Mr Collins' iPhone 6 on 23 March 2021, the last day of Mr Collins' employment. 69 It seems to follow that the 2018 mobile phone would not have been supplied if the 2015 mobile phone was working. The logical conclusion is that the 2015 mobile phone must not have been functional, and so was replaced (and likely would have been returned). 70 It must have been the case that Mr Collins was issued with replacements for both the 2015 mobile phone and the 2018 mobile phone. He returned the iPhone 6. Eltrak advanced an explanation for this, which was that Mr Collins was being dishonest. Another possible explanation may be that the records were not completely up-to-date. At this stage, these matters have not been fully explored. 71 Mr Collins has said consistently that he did not use any other mobile phone issued by Eltrak. Based upon the current state of the evidence, I am not prepared to draw the conclusions urged by Eltrak.

TPG Account 72 Eltrak raised the existence of a TPG account that was not initially disclosed by Mr Collins. 73 Eltrak referred to the fact that Mr Collins' wife's TPG email address was not initially provided as circumstantial evidence in favour of making the orders sought. 74 Mr Collins had previously said that that TPG email address "was only used by [him] to receive [his] wage slips from [his] employer". It was also suggested that it was the family email account. 75 Of course, if the TPG email address was used as a family account, or only to receive wage slips from Mr Collins' employer, it would not have contained Eltrak's confidential information or information as to Mr Collins' employment, or proposed employment, with a competitor. If that is correct, there was no obligation to produce it. 76 When Eltrak was given access to Mr Collins' wife's TPG email account, Mr Gare deposed that only emails between 26 March 2021 and 12 May 2021 (just over 45 days) were accessible. He deposed that "[n]o email history of any kind was found on that account when accessed on 17 May 2021. This means that no data has been accessible from this account, labelled by Mr Collins as his family's primary email account, for the period 18 April 2015 to 26 March 2021". 77 Mr Collins deposed that TPG only stored emails for 45 days until they are deleted and provided screenshots from the TPG website indicating as such. Mr Collins' solicitor made enquiries with TPG's "Internet & Home Technical Support" Department, who confirmed that emails were deleted after 45 days and, once deleted, were not retrievable. This was not challenged. 78 Mr Gare was of the opinion that it was very unlikely that a family would be using an email service that deleted emails after 45 days. Mr Collins' solicitors objected to this opinion. While Mr Gare may claim knowledge with matters relating to information technology, Mr Gare has not asserted any expertise or knowledge in relation to the use by a family of an email service. He is not qualified to comment on that issue. His opinion on that issue does not assist the Court. 79 In circumstances where there were clearly no emails older than 45 days, an order requiring Mr Collins to produce the full history of the TPG email address from at least August 2015 would appear to be futile. 80 There appears to be no evidence that Mr Collins' family used a different email address as their primary email address.

Copied Folders 81 Mr Gare deposed that Mr Collins accessed a number of sensitive folders in the lead up to his leaving Eltrak, including folders containing sensitive and critical product development information, performance information, costing information and sales documents. The folders of interest Mr Gare identified were referred to as: Pricing 2021, Z Drive, Eltrak, 2021 Targets, BlueScope, Jeremy and Brett. 82 Mr Collins deposed that he had not copied or shared any of the identified folders. Additionally, Mr Collins deposed that: (a) Pricing 2021: this folder contained Excel spreadsheet templates used by staff to customise client pricing. After deciding to leave Eltrak, Mr Collins decided to update the templates and customer files to ensure they were "up to date". (b) Z Drive: this folder was shared and accessed by the whole Eltrak team nationally. The folder Mr Gare specifically mentioned was one titled "Automation" which Mr Collins deposed contained "how to" guides and troubleshooting information which he frequently searched and used to assist customers. (c) Eltrak: this folder contained the product range and was commonly used by all staff. There was no password protection or other restrictions on this folder. (d) 2021 Targets: this folder related to Eltrak's main competitor. (e) BlueScope: Mr Collins did not explain what this folder was. (f) Jeremy: Jeremy is another sales representative of Eltrak. Mr Collins transferred certain accounts to Jeremy which were difficult for Mr Collins to reach (such as Cairns, Townsville and Mackay). (g) Brett: Mr Gare deposed that this file was not found on Eltrak's network and the folder's last event was on 8 February 2021. Mr Gare was of the opinion that this folder was deleted at the time. Mr Collins does not recall deleting the folder at that time. Mr Collins was of the view that the contents of the folder would have been transferred to other Eltrak staff. 83 Mr Ryan and Mr Gare were called to give evidence at the hearing, in their capacity as experts. 84 Mr Ryan, the Managing Director of Monocera, studied business majoring in management at the Queensland University of Technology, graduating in 2012. Mr Ryan worked from 2006 to approximately 2010 as a senior network officer at UNITAB at Albion. Mr Ryan is the sole founder of Monocera, founded in 2012. 85 Mr Gare is the proprietor of People Oriented Systems (Australia) Pty Ltd. Mr Gare holds a Bachelor of Applied Science in Computer Studies, a Master of Business Administration and a Certificate III in Investigative Services and a South Australian Investigation Agents License. Mr Gare has over 35 years' experience in the information technology industry, supporting the legal profession for 25 of those years in a technical capacity. 86 Mr Ryan created eight videos for the purpose of demonstrating the behaviour of the "Recent Files" folder in a default Windows 10 environment. Mr Ryan and Mr Gare gave evidence concurrently. Video demonstrations were played in Court with Mr Ryan and Mr Gare providing commentary. 87 Video recordings 1 to 6 were largely identical. The first video recordings showed whether any entries had been created in "recent items" when a folder located on a network location was copied to an external hard drive (such as a USB device). The second video recording only differed from the first in that the contents of the folder had been copied individually (instead of the whole folder) to the external hard drive. Mr Ryan and Mr Gare agreed that the remaining video recordings behaved similarly and did not consider it necessary to view the remaining video recordings. Mr Ryan confirmed that no entries had been created in the "recent items" when any folder or file was copied. 88 Video recording 7 demonstrated whether any entries are created in "recent items" when opening a document. Video recording seven showed two new entries, the first being the document opened and above it the folder the document is contained in. 89 Video recording 8 showed whether any entries were created when creating a new folder. Video recording 8 also showed two entries in the "recent items", the newly created folder and above it the folder in which the folder was created. 90 Mr Ryan confirmed that the tests were created on a standard version of Windows 10 installed on a computer. 91 Mr Gare agreed that the behaviour observed correlated to a standard version of Windows 10 installed on a computer. However, Mr Gare said that Eltrak's advanced group policies and event audit logging is different from the default Windows 10 settings and takes place in a Microsoft Remote Desktop Services environment. 92 Mr Gare gave evidence that Eltrak did not use Windows and instead used Microsoft Remote Desktop Services to which a connection was made through virtual machines. Eltrak configured the group policies and directory domain policies which applied to a person connecting to the servers running the Microsoft Remote Desktop Services. The security settings in the policies had been increased after an incident in 2014 which caused all events to files and folders across the entire network to be captured. Mr Gare did not consider the video recordings to apply in the present matter for that reason. However, Mr Gare did not record any video in reply to Mr Ryan's videos, stating that he was prevented from doing so by Eltrak's security policy. 93 Mr Ryan responded that the evidence of Mr Gare was received the day before the hearing and he did not have an opportunity to replicate the environment as described by Mr Gare. Mr Ryan was also of the view that he would have expected more detailed security event logs. 94 Mr Gare confirmed that by the time they investigated the security event logs, they had "rolled" and were unable to be retrieved. I take that to mean that the security event logs had expired and been overwritten - so they were not in existence and the contents were not available. 95 Mr Ryan also said that the screenshots of the security policies did not show any date or time when they were taken and might not be representative of the security policies at the time Mr Collins left Eltrak. Mr Gare deposes that the screenshots of the settings were taken by the third-party server's provider, Wireless Computers, who had been contracted to provide the services since before 2014. 96 Mr Ryan was unable to confirm whether, in his view, changing the security settings to capture all events would capture folders being copied in "recent items'. 97 Mr Gare confirmed that the shortcuts in "recent items" do not describe what type of event created the shortcut. A shortcut created for opening a file will appear identical to one created for renaming the file. Mr Gare stated that he concluded the event was the copying of a folder for the following reasons: there were sequential folder shortcuts with no file in between, so the event must have only applied to a folder; the folders were still there so it could not have been a deletion event; the folders was not moved so it wasn't a cut event; the names are the same so it was not a renaming event; by eliminating all alternatives, a copy event is the only event which could have occurred. 98 The Court is being asked to conclude that Mr Collins copied Eltrak's confidential information based upon shortcuts created in the "Recent Files" list. The shortcuts in the "Recent Files" list do not state what event caused the shortcuts to be created, nor what time the shortcuts were created. Inferences have to be drawn based upon the position of the shortcut with other shortcuts to determine what action may have created it. The Court also has no information as to the reliability of using "Recent Files" for the purpose of determining whether a folder was copied. Nor does the Court know whether the shortcuts in "Recent Files" can be tampered with or deleted. 99 There is no evidence about those matters before the Court from an independent expert. 100 As I outlined earlier, the purpose of an interlocutory application is not to finally dispose of the parties' rights, and caution should be taken when dealing with interlocutory issues. The interlocutory issue which is the subject of the current application relates to discovery. This allegation regarding folders being copied (particularly the allegation that Mr Collins copied Eltrak's confidential information) goes to the core of the claim, and is something which will be dealt with comprehensively at the hearing. 101 Mr Collins has provided explanations for why he may have accessed most of the folders in question and deposed that he did not copy any of the folders. Additionally, the two witnesses did not explore how files interacted in Eltrak's environment. I can not reach the conclusion on the evidence, that an analysis of the "Recent Files" demonstrated that Mr Collins copied Eltrak's confidential information.

Conclusion 102 Mr Collins has repeatedly denied that there are any devices which have not been provided. Eltrak is, through this application, asking me to go behind the evidence of Mr Collins and order the further production of devices and documents. 103 I am not satisfied that there is sufficient doubt on the evidence relied upon by Eltrak that Mr Collins has not complied with the discovery orders made on 19 October 2021. Nor is there sufficient evidence to go behind Mr Collins' evidence. Mr Collins has provided explanations for the events which have transpired. Eltrak is relying upon circumstantial evidence to assert Mr Collins' non-compliance. 104 At the time of the hearing of this application, I asked counsel for Eltrak what the utility for this application was. Eltrak's counsel responded that it was that Eltrak wanted a "firm order from the court compelling this to happen because any requests that have been made by [Eltrak] have fall[en] on deaf ears". The "flip side" to this point made by Eltrak is that Mr Collins swears on oath that he has complied with the order. That is on the record. If he has complied with the orders, it is not surprising that it would appear that requests have "fallen on deaf ears". If, during a final hearing, or as more evidence comes to light, it becomes clear that Mr Collins has not provided all the documents in breach of the orders of the Court, there are remedies for that. No doubt Mr Collins' lawyers have made him aware of his duties and the consequences for ignoring an order of the Court. 105 I will order that the interlocutory application filed on 14 October 2021 be dismissed. I certify that the preceding one hundred and five (105) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Thomas.