Heng Ge v Commissioner of Police [2025] NSWIRComm 1012

d. paragraph 15(e) of, and the sentence starting with "to test..." on page 2 of Annexure MF-2 to, the Statement of Mark Fitzhenry dated 11 November 2024;

e. references to the NSWPF desktop computer identifier and the Applicant's NSWPF identifier in paragraphs 8, 16, 17, 18, 19, 20, 21 and 22 of, and Annexure AL-2 to, the Statement of Andrew Leeming dated 11 November 2024;

f. paragraphs 19, 20, 21, 22, 23, 44, 54, 65, 80 and 81 of the Statement of Paul Drexler dated 11 November 2024;

g. paragraph 21 of the Respondent's outline of written submissions dated 11 November 2024; and

h. the transcript of the hearing before Commissioner Muir on 2 and 3 December 2024 in so far as it refers to the information contained in paragraphs 1 (a) to (g) of these orders.

1. The applicant was a civilian employee of the respondent. He commenced employment with the respondent as Firewall Security Administrator on 8 November 2007. He remained in this position as at 15 August 2024, when he resigned.
2. It was not disputed that, despite resigning, he can pursue a claim pursuant to s 84 of the Industrial Relations Act 1996 (IR Act), consistent with the decision of the Full Bench in Zopf v Industrial Relations Secretary on behalf of the Department of Customer Service [2020] NSWIRComm 1012.
3. The applicant resigned in response to written notice of his dismissal. That notice set out that his resignation would be accepted, if he resigned before the effective date of his dismissal.
4. The respondent set out two grounds for dismissing the applicant, which can be summarised as:

(1) Breaching the respondent's policy by installing unapproved software; and

(2) Being dishonest with the respondent when questioned about the installation of the unapproved software.

1. The applicant denies that there was an express policy of the respondent which he breached in installing the software. He further says that it would be unfair to dismiss him for his inaccuracies in his account about the installation of the software because of the way he was confronted with allegations of installing the software, and because he genuinely had a lapse of memory about the details of the installation.

1. Initially, in the Applicant's Outline of Submissions (AOS), the applicant's case was that his dismissal was harsh. He submitted that the dismissal was harsh because:

(1) It was disproportionate to the gravity his misconduct; and

(2) The personal and economic consequences for him of the dismissal made it harsh.

1. Later, in his Applicant's Outline of Submission in Reply (AOSR), the applicant expressly added that his dismissal was procedurally unfair. The procedural unfairness was said to arise from various defects in the way in which allegations of misconduct were put to him, largely during the initial stages of the process.
2. While not set out expressly as procedural unfairness in the AOS, the substance of the alleged procedural unfairness was set out in the AOS. It was clearly understood by the respondent to be asserted, as the Respondent's Outline of Submission (ROS) squarely addressed issues of procedural fairness.
3. In the course of the arbitration, and in particular in cross-examination of the respondent's witnesses, the applicant also challenged the facts presented by the respondent as to the extent of his installation and use of the disputed software.

1. The fundamental task of the Commission in determining applications pursuant to s 84 of the IR Act is as set out in the in the AOS:

"6. The question before the Commission is whether the dismissal was harsh, or unreasonable or unjust ..."

1. As also set out in paragraph 7 of the AOS, an often quoted exploration of this is set out in:

"7. ... the decision of the High Court in Byrne v Australian Airlines Ltd (1995) 185 CLR 410 at 465 per McHugh and Gummow JJ.

It may be that the termination is harsh but not unjust or unreasonable, unjust but not harsh or unreasonable, or unreasonable but not harsh or unjust. In many cases the concepts will overlap. Thus, the one termination of employment be unjust because the employee was not guilty of the misconduct on which the employer acted, may be unreasonable because it was decided upon inferences which could not reasonably have been drawn from the material before the employer, and may be harsh in its consequences for the personal and economic situation of the employee or because it is disproportionate to the gravity of the misconduct in respect of which the employer acted."

1. In her ROS, the respondent, albeit with some differences in emphasis, agreed with the applicant's submissions, but also took the Commission to s 88 of the IR Act:

"15. ... the Commission must determine whether the Dismissal was harsh and/or unreasonable and/or unjust, having regard to section 88 of the IR Act, and make a positive finding to that effect. In relation to whether a dismissal is harsh, unreasonable, or unjust, the IRC must consider matters such as those identified in Byrne and make specific findings as to which of those descriptions the dismissal meets. The onus is on an applicant to establish that the dismissal is harsh, unreasonable, or unjust.

16. Section 88 of the IR Act sets out matters that the Commission 'may, if appropriate, take into account' in determining the Application. These factors include:

(a) whether a reason for dismissal and refusal for reinstatement/re-employment (if requested) is given to the Applicant;

(b) whether the applicant was given an opportunity to make out a defence or provide an explanation;

(c) the nature of the duties of the applicant immediately before the dismissal;

(d) the nature of the duties in the event the applicant was to be reinstated/re-employed; and,

(e) other matters the Commission considers relevant.

17. As is the case with the Applicant, 'harshness' of the dismissal will often be the primary contention of a dismissed employee. This involves assessing the gravity of the misconduct in its regulatory context against any mitigating circumstances and the personal or economic circumstances of the dismissed employee.

18. The regulatory context in which the employment was carried on will be a mandatory relevant consideration in assessing the seriousness of the misconduct and any mitigating circumstances. The formulation of 'the regulatory context' within which the Applicant's employment operated is, in summary, the GSE Act, the GSE Police Rules and, the Police Act."

(Footnotes omitted.)

1. The respondent expressly accepted that, where an employer relies on misconduct as the basis for dismissal, the employer bears the evidential onus to establish the facts of that misconduct.

1. In a witness statement filed on 21 October 2024, the applicant's evidence was that:

(1) He was 56 years old, a non-native speaker of English, and without strong English skills.

(2) Prior to joining the NSWPF, he had worked for 3 years with Optus and later for over 6 years with NSW Health. Some of this time had been as a "network specialist", and some, immediately before joining the NSWPF, as a "network security engineer".

(3) While employed with NSWPF, he had:

"5. ...

(a) [REDACTED]

...

(c) Provided security assessments and advice relating to IT Security threats and how they may impact NSWPF operations. This may be fielding questions from individuals to representing Security& Risk Management group in Business Technology Service (BTS) projects or externally with partner agencies.

...

(e) Overseen, implemented and troubleshooted NSWPF network Internet access and interconnectivity with partner agencies, devise and deliver information sharing solutions which protect NSWPF information and assets.

(f) [REDACTED]

...

(h) Achieved a Certificate of Appreciation of Security policy implementation for Police Electronic Infringement Notice Project using AWS cloud.

(i) I was in charge of designing and implementing Australian Federal Police Crimtrac VPN network system.

...

(k) I was in charge of designing and implementing network security infrastructure for many police projects.

(l) Contributed to security design, implementation for Mobile Data Terminal (MDT) project.

(m) Day-to-day BAU change request and security incident response management.

(n) Contributed to plan, design and implement of secure network infrastructure between NSW Police and government private network (GPN)."

(4) He had received multiple awards during his 17 years with the NSWPF, and prior to the events leading to his dismissal had an "unblemished employment record".

"13. I do no recall when I installed WeChat on my desktop work computer.

14. I have never been told that WeChat is non-approved software. I have never seen a list of software that not approved or that there is a list of software that approved for technical people in the command to assist their BAU or project work. In my role I had to rely on my own judgment as to whether to install WeChat. I believed that WeChat was harmless at the time I installed it. I used it daily on my personal phone, and I believe I know how it works. I thought it's harmless if I only use it as instant messenger and I don't disclose any work-related information. I did not make any configuration change of desktop to install it. I only understood the potential risk after I was interviewed.

15. [REDACTED]

16. I no longer recall why I installed WeChat in my desktop. It was some time ago. I know I used WeChat for troubleshooting and verifying intermittent internet access issues. I also used WeChat to keep contactable with my parents who are old, both of them are over 90, and they have health issues. My mum had breast cancer in 2019 and joint replacement surgery in 2022. They live in China and WeChat is the only way they can contact me. They do not have a phone that can make international calls."

"19. Around 1pm on 11 January 2004 | got a call from my team leader Mr Michael Gulliver when I bought lunch at my lunch break. Director Drexler was looking for me.

...

21. Director Drexler came to my desk and directed me to follow him and bring my NSWPF laptop, my NSWPF on call mobile, and my personal mobile with me. He did not mention any reason that I need to go with him. His appearance looked unusual in that his face was red and he looked serious. I started to be nervous and my brain started to get foggy as it was not usual to be asked to bring your laptop and mobiles to a meeting with him.

...

23. When we arrived Inspector Fizthenry was waiting for me.

24. Director Drexler questioned me if I used WeChat on any police device. I said no.

25. Director Drexler showed me evidence that I had used it in December a couple of times and there was lots of traffic in and out.

26. Director Drexler questioned if I installed WeChat on police laptop and police mobile, I denied both. He checked both and kept both devices with him. I believe they did not find any unauthorised software installed on those devices as they never mentioned those devices again. I had the police laptop for about a year. The police on call mobile is a rotated shared mobile for on call people.

27. Director Drexler questioned me if I installed WeChat on my police desktop computer, I admitted that I had.

28. Director Drexler told me that I could be fired and that he had fired multiple employees in previous positions. His threats that I could be fired added to my anxiety and an inability to think clearly.

29. Inspector Fizthenry requested me to login to my desktop computer to check. I agreed and provided him the password.

30. After I agreed to login to my desktop computer, they opened the door, and I found my desktop computer had been moved to an investigation room opposite the quiet room and there were 2 armed police officers alongside it.

31. I was shocked and felt very anxious because I never been in this situation before. I still logged into my desktop computer in front of the two armed officers. I had to try my password a couple of times to sign into my desktop. I felt disrespected and upset because it meant they took my desktop in front of all my colleagues.

32. After I signed in to my desktop, I brought up the WeChat login screen and showed them I could not login to my account.

33. Director Drexler questioned me if I used WeChat recently from my desktop computer, I denied it. I mentioned that I never login and run WeChat successfully recently.

34. The two armed officers checked my computer again and went outside the room with Director Drexler and Inspector Fizthenry.

35. Director Drexler and Inspector Fizthenry come back into the room and I was told that was to go home but I can not go back to my office. My bag was brought to me by Director Drexler. I was not allowed to collect my personal things and still have things in a drawer at my desk. I had to hand over my police access card to Inspector Fizthenry.

36. I was sent out to the main gate by Inspector Fizthenry.

37. I have not subsequently returned to the office."

(7) As to a meeting on 19 January 2024, he set out:

"38. On 19 January 2024, I was requested to attend a meeting with Director Drexler and Inspector Fizthenry that day. I was not offered a support person for this meeting.

39. Director Drexler showed me evidence of the log of my desktop WeChat client tried to access to the WeChat server.

40. Director Drexler told me I ran WeChat a couple of times in December. I told him I could not remember once running WeChat in December. He told me he could not believe I could not remember it. It happened in middle of December, He said: Why you could not remember it? I told him I really could not remember it. He started to say to me that I lie to them and that I could not be trusted.

41. I did not log into my WeChat account successfully and use it in December so I did not pay attention to remember if I once opened WeChat or not.

42. Director Drexler showed me evidence that I logged into my WeChat account around 8 months ago. I was surprised and said that I could not remember logging in successfully. That was the last time I had logged into my account from my desktop.

43. Director Drexler then said I could not be trusted. I had lied to them. I started to argue with Director Drexler.

44. I could not keep my professionalism and acted emotionally. I was even cranky and said to Director Drexler if I admitted I used the application, would you let me go? In that high pressure situation, I just want to get out of that place and let them to do what ever they want to do. I had enough of it I didn't care about it anymore.

45. I was in a bad mood at the time as I was going through some family issues at the same time. My relationship with my wife was at a low point and we were constantly arguing. I even threatened to leave the relationship.

46. At some point I started to feel that Director Drexler thought that I was a potential spy, I said I am an Australian citizen, my son is born here and an Australia citizen and my wife is an Australian citizen. I would not betray my country.

47. After the meeting I believed that there was misunderstanding between RUN and LOGGED in successfully. When I brought up the WeChat login screen, the traffic log is recorded by the security event management system but it does not mean I logged into my WeChat account.

48. On 21 January 2024 I sent an email to Director Drexler and Inspector Fitzhenry to address potential misunderstanding and provide a detailed explanation to ensure clarity on the matters discussed. ..."

(a) Regret for installing the software without authorisation;

(b) Acknowledgement of the potential risk to the organisation, and the gravity of his actions;

(c) His shock at the unexpected meeting and exclusion from the workplace; and

(d) An apology for his emotional response during the earlier meeting, providing context of the meeting and his personal circumstances as a reason for his being under strain.

(9) As to the Allegations against him, the applicant set out:

"Allegation 1 - fail to comply with policy/procedure - install non-approved software

49. I accept that I installed non-approved software being the WeChat software on my desktop computer.

50. I accept that I should not have installed the WeChat software on my desktop computer.

51. I was not aware that WeChat was not an authorised application.

52. I have not seen the NSW Police Force Information Security Manual, Digital Technology Innovation (DTI) reference: ISP-12020104-authorisation of software use policy. I have not been trained in that policy.

53. I have not seen the NSW Police Force use of resources, guidelines, facial status command reference: 5.5 - ICT (Information Communication and Technology) policy. I have not been trained in that policy.

54. I am unaware of any negative consequences resulting from WeChat being installed on my desktop.

55. I am very apologetic for my actions and now I understand the potential risk that it could have posed to NSWPF. I hope my sincere remorse comes through so that I can ensure the NSWPF that I would not expose them or myself to this type of situation again and I am willing to participate in regular training on this matter. I can assure you that I will try my hardest to align my actions with the Police policies in the future.

Allegation 2 - Dishonesty - untruthfulness

56. I was very anxious during both meetings with Director Drexler and my brain was foggy. I felt misunderstood and untrusted. I had not intent to deceive or be dishonest at any point. I simply felt under pressure and trapped in a room with armed officers and did not have proper time to think about my responses and cross-check them in my mind. I was also going through family issues at the time and had bad memory under the pressure.

57. I am an honest and conscientious hard-working employee.

58. I apologise for my slip of judgment, however, I was under extreme duress at the time."

(10) As to the later process in which formal allegations were put to him, the applicant set out:

"Allegation Process

59. On 20 June 2024, I received a letter of allegations. ... .

60. By letter dated 8 July 2024, I responded to those allegations. ... My son helped me write my response as my English is not very good. The response to allegation 2 says that I was escorted by armed police officers. This did not occur and should not have been included in my response. I corrected this in my response to the show cause letter. The response also says that my statements which were not 100% accurate or truthful were a result of my mental state which was under huge pressure at the time. I did not mean to say that I lied but that rather that my answers did not clearly explain what I had done and particular the difference between running WeChat and logging into my WeChat account.

61. By letter dated 16 July 2024, I received a 'Show Cause letter'. ...

62. By letter dated 31 July 2024, I responded to the 'Show Cause letter'. ... My son again helped me write my response as my English is not very good.

63. By letter dated 7 August 2024 which I received on 12 August 2024 | was informed that I would be dismissed with an opportunity to resign by 16 August 2024. ...

64. On 15 August 2024 I resigned. ..."

(a) Acceptance that he installed WeChat and logged into his personal WeChat account several times while on duty;

(b) Set out that he used WeChat "a couple of times" for trouble shooting for work purposes, and previously for keeping contact with his parents when his mother was unwell;

(c) Reiterated that the circumstances of his being confronted with the installation allegations caused him "brain fog", and because of the pressure he was unable to recall using the application. He set out that he was "... usually an honest and conscientious hard-working employee ..."; and

(d) Set out reasons why dismissal would be too harsh given the overall circumstances.

(12) The applicant also set out his willingness to undertake further training and to be the subject of enhanced supervision, should he return to his job.

(13) The applicant then set out the impact of his dismissal on him personally:

"Impact

66. I have lost the benefit of a salary of $2,552.40 per week (gross). I have over $1 million mortgage on my house which I cannot afford to pay.

67. My long tenure with the government has equipped me with specialized skills tailored to public service roles, and I currently lack the necessary skills to transition effectively into a new position outside of the government sector.

68. Additionally, as a non-native English speaker, I face additional barriers in the job market.

...

70. I have applied for a few jobs in the public sector and health sector but the result is negative. I have unsuccessfully applied a few jobs including ACIC NSW, St Vincent's hospital, NSW Education Standards Authority, NSW Reconstruction Authority. I have lost confidence and feel that it is hard to find another job because of my age, my 17 years of experience in the specialized IT infrastructure area of NSWPF is for infrastructure that is quite old.

71. Socially, I don't want to go out to with people, I just want to stay at home. I want to be by myself. I once tried to contact my colleagues, but they were informed not to contact me.

72. Emotionally, I haven't slept well since I was suspended. I always think of work issues of the police. I feel no confidence and eat a lot to try to reduce my depression. I have put on lots of weight."

1. In a further witness statement in reply to the respondent's evidence, dated 18 November 2024, the applicant:

(1) Denied several statements from Sergeant Andrew Leeming in which Sergeant Leeming had asserted that the applicant had logged into a WeChat account on various dates;

(2) Denied a statement by Sergeant Leeming that the applicant was logged into his desktop on 1 November 2022 and that the records referred referenced by Sergeant Leeming showed that on that date the applicant had installed and uninstalled and then reinstalled WeChat. The applicant also denied that he was ever in the office using his desktop at "UTC 1:30 PM (12:30 AM Sydney time)";

(3) Acknowledged whilst he was able to bring up the WeChat login screen in the presence of Mr Drexler and Inspector Fitzhenry, denied that he was able to log into his WeChat account;

(4) Denied that he had "taken any deliberate steps to bypass" the respondent's IT security systems "as he had administrative privileges";

(5) Asserted that anyone with a police account could use his desktop computer;

(6) Denied that he was offered an opportunity to have a support person present during his interviews and further denied that he was offered the opportunity to provide a written statement or the opportunity to contact the EAP during the interview on 11 January 2024;

(7) In respect of the 11 January 2024 meeting, said that he could not recall saying the words "I never used it", and then went on to explain that for him "using" WeChat means being able to log into his account not running the software to get to the login screen. He also gave evidence that he had explained to Mr Drexler that log records showing that WeChat was communicating data to its servers may not have meant that the applicant had used WeChat successfully. It might only mean that he had been able to bring up the WeChat login screen;

(8) Set out that "I did use WeChat to troubleshoot multiple internet link access issues, web browsing unstable issues and ... proxy issues. I recall that I explained this in the interview on 11 January 2024", and that "WeChat is my most familiar software to verify if internet link access issues, web browsing unstable issues, and ... proxy issues are caused by a police application software issue or a by network infrastructure setting up issue."

(9) Set out that [REDACTED] was an authorised working tool to troubleshoot Internet connections and Internet browsing issues since he joined the New South Wales Police Force and that he had never been subsequently told that [REDACTED] is not authorised.

(10) Denied becoming concerned or worried in the meeting, but rather that he was embarrassed as he did not remember that he had logged into his WeChat account until he saw the evidence. He was "frustrated" because Mr Drexler did not believe this explanation.

1. The applicant was assisted by a translator when he was sworn in as a witness. It was soon apparent that the interpreter was unlikely to be necessary. The applicant frequently answered in English, without waiting for a translation into Chinese. Eventually, the services of the translator were dispensed with entirely and the applicant directly answered, in English, questions put to him in English.
2. It was put to the applicant that he did not need a translator for his evidence to the Commission. It was also put to him that he had not needed a translator during his employment with the respondent. The Commission did not understand these questions to impugn the applicant's honesty in seeking the use of a translator, but strictly as to the need for the translator.
3. Nothing turns on the applicant's initial request to be assisted by a translator. It is understandable that an applicant whose first language is not English might consider he would benefit from the use of a translator. In the event it proved unnecessary.
4. The Commission considers some minor accommodation might be made for expressions in English made by the applicant, including that the Commission should be cautious in adopting the literal meaning of statements made by the applicant in circumstances where the applicant is a non-native English speaker.
5. That said, it appeared to the Commission that the applicant's command of English was strong. While there were some minor grammatical irregularities in the way in which he expressed his answers, it was clear that he understood both the question being asked and gave intelligible and nuanced answers.
6. Flowing from questions as to the applicant's command of English, there were a series of questions put to him as to what assistance he had received in preparing his witness statements. Initially, the applicant gave evidence that his son had assisted him and that he had used ChatGPT. This was almost immediately contradicted by him asserting he had used neither form of assistance.
7. Later, the applicant's evidence again changed to having used ChatGPT to correct grammar.
8. Neither at the time, nor in re-examination, was there any explanation by the applicant as to the inconsistency, or as to which version was correct.
9. Each of the written statements, emails and letters in the evidence before the Commission, and apparently authored by the applicant, are on their face in standard Australian English, with only the kind of minor errors which one might find in any lengthy document.
10. During cross examination, the applicant conceded that an ordinary member of the New South Wales Police Force without his access privileges would not have been able to download WeChat and have it connect to the internet, because the program would have been blocked by the New South Wales Police Force IT proxy. The applicant conceded he had been able to connect WeChat to the internet because he was able to customise the proxy connectivity. That proxy that would otherwise have blocked access.
11. While asserting he did not think about the security risks at the time, he conceded that he should have considered the security risks from installing WeChat.
12. He did not concede that inaccurate statements about his use of WeChat to Mr Drexler were lies, maintaining his position that when he was asked, he did not recall having used WeChat.
13. The applicant was asked a series of questions which flowed from his statements that WeChat was his most familiar software. The following exchanges are reproduced:

"Q. You also say there at the end of that paragraph that 'WeChat is my most familiar software to verify if internet link access issues, web browsing unstable issues, and REDACTED issues.' When you say, 'Most familiar,' it seems from this statement, Mr Ge, that you use WeChat a lot to assist you in your role; would you accept that?

A. WITNESS: Not for - because I only use WeChat daily. It most like a - like a social medium, like Facebook or whatever, so I know this software quite well.

Q. But here at this paragraph where you're saying that it's your most familiar software to use to verify the link access, or you go on to say, REDACTED issues are caused by a police application software.' So here, it's saying it's your most familiar application that you use in the course of your job; is that correct?

A. WITNESS: Because we have a similar client-based software for the police to use in the desktop, and when I troubleshooting that, I need to simulate the issue. And also, at that time, the browser is not stable; we have two signs, like a primary and secondary link; then we have internet issues, or we have - we need to isolate is the internet ISP issue or is the REDACTED issue, or is it REDACTED issue, or is the firewall issue. So these two - the two is like kind of test in application level; not the IP level.

Q. And so, your evidence, though, is that you would regularly use - daily use WeChat to do that?

A. WITNESS: No, of course not. Of course not, because we don't have problems all the time.

Q. No, but whenever a problem comes up, would you feel comfortable using WeChat?

A. WITNESS: No, because we don't have that issue all the time.

Q. But I take it here from paragraph 17 that when it does come up, you do use WeChat to assist you in troubleshooting?

A. WITNESS: If I need to simulate that similar apps like to why that app's not working for the police apps, so just pretty in the app level application layer is pretty like, because that I use that because I know that software well."[1]

"Q. You've also given evidence that WeChat is your most familiar app for troubleshooting?

A. WITNESS: Mm-hmm.

Q. And that, you use it during the course of your job to troubleshoot certain things?

A. WITNESS: Yes; yes.

Q. So I suggest to you that saying to the Commission and to Mr Drexler, even, that you did not recall whether or not you had used WeChat was a lie.

A. WITNESS: No, I only admit after I see that evidence on the second interview, I only - when I see the May - only for May - 23 May, I didn't admit it, and then, I send that email to them to say I apologise to them for - I can't remember, like this one is like nearly eight months ago. I could not recall that at that time. I do send email to them - both of them - and Inspector Fitzhenry. At this rate I can't recall that. But I don't agree I deny I can login another days. This only days I login successfully, because only based on this information. To be honest, I can't remember any­­"[2]

1. The applicant was asked a series of questions in relation to his search for alternative employment. From his answers to these questions the Commission has determined that the applicant has made limited efforts at finding alternative employment totalling no more than five or six applications.
2. As at the hearing date the applicant had a number of outstanding applications, including at least two of which he had further interviews scheduled. The applicant's answers in response to this series of questions again demonstrated his relatively sophisticated grasp of English. He was, for example, able to identify immediately that St Vincent's Hospital was a private-sector employer during an exchange with counsel for the respondent about whether he had applied to any private sector employers.

1. A number of aspects of the applicant's evidence were problematic.
2. The first of these is the inconsistent account given by the applicant as to the reason he downloaded the WeChat software. Both before the Commission, and in correspondence with the respondent before his dismissal, the applicant has at different times said that he used the software to maintain social contact with his parents, as a tool for testing issues relating to the respondent's IT systems, and yet that he was unable to login and have the program operate properly. There was no explanation offered by the applicant as to these inconsistencies.
3. The applicant at various points described the WeChat software as his most preferred and well understood software for work related issues, and yet maintained that he was unable to recall having use the software when asked directly about it.
4. There is of course the inherently problematic case put by the applicant that he was a network security engineer of some nearly two decades standing, and yet he apparently downloaded software to his computer without so much as a second thought as to the security implications of doing so. This issue is distinct from whether he was aware of respondent's relevant policy, and the details of that policy.
5. In his evidence in chief, the applicant set out that did not take any deliberate steps to bypass the respondent's proxy in order to make the WeChat program function properly.
6. Under cross examination he contradicted this directly, stating that he had taken such steps. He also gave evidence that, because of his privileged access to the respondent's IT system, he did not need to make any such changes to bypass the respondent's proxy. The former, would expose his original evidence as simply untrue; while the latter would tend to expose his original evidence as consciously misleading.
7. It is apparent from the applicant's own evidence that at each step of both his interviews with his managers, and in the course of his evidence before the Commission, he has admitted only those elements of the allegations against him for which there was proof provided to him. His explanation is that it was the proof which reminded him, and indeed on occasions exceeded his memory.
8. Some concern should be observed about his evidence that anyone with a police IT account could have used that to log into his computer. The statement is undoubtedly true as such. However, given he admits he did install WeChat, and otherwise did not attempt to assert anyone else had installed WeChat to his computer, the statement has the flavour of statement designed to distract or mislead.
9. Finally, it is of concern that the applicant's direct evidence, and the cross examination of the respondent's witnesses, clearly walked back matters in the applicant's letters of 21 January 2024 and 8 July 2024.
10. The first letter appears to admit logging into WeChat, with the latter clearly admitting having logged into WeChat. This contradiction is consistent with the Commission's observation that applicant is a witness who is reluctant to make concessions and does not do so unless there appears to him to be no other option.
11. The Commission concludes that there has never been a concession by the applicant as to any wrongdoing for which the respondent does not have evidence. The Commission is not persuaded that the applicant is a forthright witness.

(1) Sergeant Andrew Leeming, who was the Operations Supervisor of the Digital Forensics caps unit in the High Tech Crime Branch of the Forensics Evidence and Technical Services Command;

(2) Inspector Mark Fitzhenry, who was the Staff Officer of the Technology and Communications Services Command; and

(3) Mr Paul Drexler, who was the Director of Network Security Platform Services in the Technology and Communications Services Command.

(1) He had analysed the applicant's hard drive and found substantial evidence of the use of WeChat, including:

(a) That on various dates the program had been installed, uninstalled and reinstalled; and

(b) That the applicant used WeChat on several occasions, connecting through a browser from his desktop computer on at least 7 specified dates.

(1) He was the Staff Officer, and so in charge of people management in the Technology Command;

(2) In January 2024 the issue of the applicant potentially using WeChat in breach of Police policy, including by the applicant using his administrative privileges, arose and an investigation was begun;

(3) On 11 and 19 January 2024 he met with the applicant and others about this issue. He attached his notes of the meetings;

(4) In preparation for the meetings he spoke to administrative support staff, as he was more familiar with processes for investigation of sworn police officers than for civilian employees;

(5) He asked the applicant if he wanted a support person, and says that the applicant said he did not needed one;

(6) The applicant admitted to downloading the WeChat program, and the applicant said this was to test security of the Police IT system;

(7) He was not carrying a gun, and that Mr Drexler is not issued with a gun, so neither of them wore a gun to their meeting with the applicant;

(8) Following the meeting he was instructed by the Assistant Commissioner in charge of the Command to suspend the applicant due to risks to the IT system, and escorted the applicant out of the building; and

(9) In the 19 January meeting, after Mr Drexler showed the applicant evidence of downloading and using WeChat, the applicant admitted using the program and by-passing security and proxies to do so. The applicant said he wanted to use WeChat on a bigger screen rather than on his mobile.

(1) The applicant was always employed as Firewall Administrator, except when on temporary assignments;

(2) A firewall is technology to protect computer networks from unauthorised intrusion and unauthorised access. As Firewall Administrator, the applicant's primary duty was to implement and maintain the firewall;

(3) To do his job, the applicant was given privileged access, meaning elevated levels of access to the system, and the ability to by-pass certain security controls. This included the ability to bypass certain of the controls securing access from within the system to the internet;

(4) The applicant's personal file indicated the training the applicant had undertaken four named courses, being:

a. training on the 'Appropriate Use of Social Media' in 2021;

b. 'Security of Information' in 2015;

c. the 'Code of Conduct and Ethics' in 2013; and

d. 'Information Security Awareness' in 2012 and 2015.";

(5) In general NSWPF users can't add programs to their computer and need permission to add them. He set out a policy that said as such:

"26. ... This can be done with approval, as the NSWPF's Information Security Management Manual, IPS-12020104 - Authorisation of Software Use (the Manual), states:

'It is a requirement that all employees not download, install or execute any software or files from external sources without formal approval in accordance with the DTI Change Management Policy. Some users may need to download and install software on their computer systems frequently due to the nature of their work. Such users should submit a request for approval through RASP. The following conditions are required to be satisfied:

1. The request should be justified

2. The computer systems on which the software will be installed should be identified

3. The types of software being downloaded and installed should be identified

4. The users in the department that are authorised to perform the download and installation are required to be identified.'

27. The Manual is a lengthy document that addresses all aspects of Information Security Management for the NSWPF."

(6) The meeting of 11 January 2024 proceeded largely as the applicant had set out, with Mr Drexler setting out that:

(a) The applicant was offered a support person but agreed to continue without one;

(b) The meeting was friendly initially;

(c) He asked the applicant two questions;

(i) Did you download an unauthorised application?

(ii) Did you download WeChat?

(d) The applicant thought carefully about his answers, saying he did download it, but never used it;

(e) The applicant said he never got the application to work; and

(f) The applicant said he downloaded it to use to test IT security. Mr Drexler said this was a nonsense explanation and not a part of the applicant's job.

(7) In the meeting of 19 January 2024, the applicant at first denied using the application, but later became worried and emotional. The applicant spoke of his length of service, and admitted to using the application while at work, and admitted to by-passing part of the proxy. The applicant said he installed the application to talk to his parents.

(8) The applicant's email of 21 January 2024 admits to installing WeChat without authorisation, and that the applicant understood the potential risks of doing so.

(9) Set out serious risks from installing the WeChat application.

1. Extensive portions of the evidence of each of the respondent's witnesses proved problematic as a result of cross examination.
2. Little of Sergeant Leeming's evidence remained useful after cross examination.
3. When pressed to explain how the various attachments to his witness statement demonstrated the facts which he asserted in that statement, Sergeant Leeming was exposed as having very little understanding of the attachments.
4. He could not explain how the records demonstrated the installation, uninstallation and reinstallation of the WeChat program, agreed that the reports did not show whether the applicant was able to log in to a WeChat account, and eventually conceded that the reports attached to his statement could not be understood and explained by him to support the facts he asserted in his witness statement.
5. Inspector Fitzhenry's evidence was of little better assistance to the respondent than Sergeant Leeming's evidence.
6. In cross examination, Inspector Fitzhenry conceded that certain details, as to matters which he asserted as facts, did not appear in the notes he made of the meetings with the applicant. Inspector Fitzhenry had not recorded that the applicant had been offered a support person, or that the applicant was not required to answer questions. Further, he had not recorded the specific policies which it was said the applicant's conduct breached, or that a particular allegation was put to the applicant.
7. The Inspector conceded, reasonably and without equivocation, that people can forget things, even things which have been done relatively recently. He further agreed that in such circumstances it is understandable that someone might be embarrassed when shown evidence of something that they had forgotten they had done.
8. When the Inspector was taken to his views about the applicant's transferable skills, it became apparent that the views expressed in the Inspector's witness statement were not his own but were in fact opinions expressed by Mr Drexler to the Inspector.
9. Mr Drexler's evidence survived cross examination to a greater extent than his colleagues. That said, there were still aspects of Mr Drexler's evidence which were problematic following cross examination.
10. The first of these related to whether documents attached to his witness statement demonstrated the installation and uninstallation of WeChat. Mr Drexler initially asserted with confidence that certain information was set out in the attachments, but when taken to those attachments, and in particular attachments PD4 and PD5, was forced to concede that the information he was referencing was not set out in those attachments.
11. Despite it having been pointed out in the applicant's evidence in reply, it was apparent that Mr Drexler was not aware that certain times set out in the attached reports translated to 12:30am Sydney time. Mr Drexler conceded that his witness statement did not attach any evidence that the applicant was at work at that time.
12. Mr Drexler identified a training course undertaken by the applicant, which he asserted covered the instruction to employees not to install any software without authorisation. He conceded that he had not included a reference to the training course in his witness statement. He also conceded that he had not included anything in his witness statement setting out the material covered by that course.

1. The respondent dismissed the applicant for installing software that was not approved, and for dishonesty. In such a case it would be expected that the respondent's evidence would establish at least the following:

(1) That there was a clear policy against the installation of unauthorised software; and

(2) That employees generally, and presumably the applicant specifically, were trained in that policy, or otherwise aware of its existence and clarity.

1. Cumulatively, the respondent's evidence does establish the existence of a relevant policy. Much less clear is a basis on which the Commission can conclude that the applicant was aware of the existence and clarity of that policy.
2. In the face of the applicant's denial that he was aware of such a policy, and putting aside for now the particular role in which the applicant was employed, it was incumbent on the respondent to prove on the balance of probability that the applicant was aware of that policy.
3. Mr Drexler was able to identify a training course through which he asserted the applicant would have become aware of the relevant policy. Not only was the content of the training course not in evidence before the Commission, Mr Drexler only referenced that course as having trained the applicant in the relevant policy during cross examination. This is despite the applicant's position all along being that he was unaware he should not install the relevant software.
4. Because the applicant conceded that he installed the software, the respondent does not need to establish the fact of the installation.
5. It was unclear to the Commission whether the respondent sought to rely on the use, as opposed to the installation, of the WeChat software as a basis for the dismissal, rather than simply as context for its reliance on the dishonesty of the applicant in his response to the allegation that he install the software.
6. It is unnecessary for the Commission to resolve that uncertainty because the evidence advanced by the respondent does not go to demonstrate the use of the software.
7. The Decision deals elsewhere with apparent, albeit contradicted, admissions by the applicant as to use of the software, and what should be made of those. In so far as the respondent's witnesses attempted to demonstrate the use of that software, the Commission was not persuaded by their evidence. This was because of the inability of the respondent's witnesses to explain the reports attached to their witness statements which they asserted demonstrated the use of that software.

(1) He is 56 and as a non-native English speaker will find it difficult to find alternative employment.

(2) Aside from the allegations which led to his dismissal, he had an unblemished employment record of over 16 years and had received multiple awards.

(3) He had been given was given no warning of the nature of the 11 January 2024 meeting, which was in fact an investigation meeting. He was not offered the opportunity to bring a support person.

(4) As set out in his AOS, he submitted :

"12. In the meeting Henry Ge admitted that he had installed WeChat on his desktop computer. He denied that he had been able to log into his personal WeChat account from his desktop computer in December 2023.

13. Henry Ge was then denied access to his office, required to hand over his access card and required to leave his workplace.

14. On 19 January 2024 there was a second meeting during which Henry Ge maintained that he could not log into his WeChat account from his desktop computer in December 2023. Again Henry Ge was not offered a support person. The meeting was heated and Henry Ge regrets that he lost his composure. Director Drexler showed him a record that he had logged into his personal WeChat account 8 months ago. He did not recall logging in 8 months ago. This was the last time that he had logged into his personal WeChat account.

15. On 21 January 2024 Henry Ge sent an email apologising for his emotional reaction during the meeting on 19 January 2024.

16. The 2 allegations that led to his dismissal need to be seen in the context that:

(a) Henry Ge was never trained in the NSWPF policies - NSW Police Force Information Security Manual, Digital Technology Innovation (DTI) reference: ISP-12020104-authorisation of software use policy or NSW Police Force use of resources, guidelines, facial status command reference: 5.5 - ICT (Information Communication and Technology) policy.

(b) Henry Ge's desktop computer was audited by Director Drexler in either September or October 2023 and no issues were raised with him. Indeed his computer had been audited roughly once a year since he commenced employment in 2007 without any issues being raised with him.

(c) There is no evidence that the installation of the WeChat software on the desktop computer Henry Ge resulted in any loss or damage to NSWPF or its IT infrastructure."

"Procedural unfairness

2. The relevant procedural requirements are set out in Pt 8 of the Government Sector Employment (General) Rules 2014 (NSW) (GSE Rules). Rule 38 is about the initial stage of handling such allegations. The person exercising employment functions - labelled 'the employer' - is required to make an initial assessment as to whether to proceed with a matter. If such a decision is made, the employee is to be advised 'of the details of the allegation of misconduct', and 'of the action that may be taken under section 69(4) of the Act against the employee' (r 38(3)). The employee then 'is to be given a reasonable opportunity to make a statement in relation to the allegation' (r 38(4)). The employer may, as a result of any such statement, decide whether to proceed with the matter or not (r 38(5)).

3. Rule 39 empowers the employer to conduct such inquiries as thought appropriate for the purpose of determining whether misconduct has occurred.

4. Rule 40 provides for the making of findings.

5. The GSE Rules thus provide for a multi-stage process:

(1) an initial assessment stage, where the employer decides whether to proceed with addressing an allegation of misconduct pursuant to the prescribed process;

(2) if a decision has been taken to proceed, an investigation and findings stage involving notification to the employee, giving them a reasonable opportunity to make a statement (after receipt of which the employer may decide to take the matter no further), combined with such other inquiries as the employer considers appropriate, leading then to the making of findings as to whether there has been misconduct;

(3) if misconduct is found, a penalty stage where the employee is to be notified of any proposed action to be taken under s 69(4) of the GSE Act and given a reasonable opportunity to respond prior to the making of a decision on the appropriate act.

6. These procedural requirements should be read consistently with the general legal requirements of procedural fairness which presumptively apply as a matter of statutory construction in the absence of clear statutory intent to the contrary.

7. In this case the respondent conducted the initial assessment prior to 11 January 2024. (Statement of Fitzhenry at [14].) The respondent was required to squarely put the allegations of misconduct to Henry Ge at the first meeting which occurred on 11 January 2024. This did not happen. Instead, Henry Ge was asked by his manager's boss (Mr Drexler) to come to speak with him without any context or notice as to the nature or purpose of the meeting. He was then invited to a second meeting on 19 January 2024.

8. The respondent did not squarely put the allegations of misconduct to Henry Ge until 20 June 2024, contrary to the requirements of rule 38.

9. Henry Ge was also not offered a support person to be present at either the meeting on 11 or 19 January 2024. He was not advised of the purpose of either meeting in advance.

10. The process by which the respondent dealt with the allegations of misconduct was inconsistent with the requirements of Part 8 and procedurally unfair. This is sufficient for the Commission to find the dismissal was unfair."

(6) In respect of his personal circumstances, as set out in his AOS, the applicant submitted that his age, language skills and his extended period in public sector roles all made it more difficult for him to find alternative employment. He also pointed to the significant financial losses he had suffered from his dismissal.

1. As set out in her ROS, the respondent submitted:

"3. The Dismissal came as the result of a misconduct investigation under Part 6 of the Government Sector Employment (NSW Police Force) Rules 2017 (the GSE Police Rules) by the NSWPF's Administrative Officer Conduct Units that found the Applicant:

(a) failed to comply with policy and/or procedure by installing non-approved software on his NSWPF computer (Allegation One); and,

(b) acted dishonestly by providing untrue and dishonest answers to direct questions from senior officers on 11 and 19 January 2024 (Allegation Two).

4. The Applicant expressly admits Allegation One.

5. The Applicant appears to concede Allegation Two, that he did not tell the truth when questioned by Mr Paul Drexler, Director Network Security Platforms, Technology and Communications Services Command (the Technology Command), and Inspector Mark Fitzhenry, Staff Officer, Technology Command, about Allegation One at a meeting on 11 January 2024 (the 11 January Meeting) and 19 January 2024 (the 19 January Meeting) but attempts to justify his conduct. The Applicant states that he '...felt under pressure and... did not have time to think about my responses and cross-check them in my mind', stating that he had been in a 'state of confusion and disorientation' at the time because he was 'trapped in a room with armed officers'.

6. Respectfully, the Applicant's position with respect to Allegation Two must be rejected as an ex post facto attempt to minimise his conduct and justify being caught in a lie. At no stage on 11 January 2024 was the Applicant 'trapped in a room with armed officers.' Further, the Applicant had just over a week after the 11 January Meeting to correct his position (that he had used the WeChat application at least five times between 6 February 2023 and 21 December 2023 and not just downloaded it) if it had been a case of a 'bad memory under pressure' or brain fog. However, it was not until NSWPF showed the Applicant evidence that WeChat had in fact been used (which was not obtained until 18 January 2024) at the 19 January Meeting that he then attempted to correct his position before then attempting to explain it away as a result of duress.

7. The Applicant was employed by NSWPF as a Firewall Security Administrator for just over 16 years: he was, in a very real and practical sense, an experienced administrator within the Technology Command. In his role, the Applicant was in a particular position of trust and confidence vis-à-vis the NSWPF's computer systems. To that end, NSWPF had to have absolute confidence in the Applicant for him to remain in his position - a position in which he had privileged access to NSWPF's most critical computer systems and most sensitive data.

...

B. LEGAL PRINCIPLES

9. Members of the public service are appointed pursuant to statute and their rights must be ascertained by reference to the relevant provisions. The Applicant was appointed as an administrative employee in the NSWPF. Pursuant to s 3 of the Police Act 1990 an administrative employee means a member of the NSWPF other than a police officer.

10. Relevant to the Applicant's Dismissal, s 7 of the Police Act states, inter alia, that each member of the NSWPF is to act in a manner which:

(a) places integrity above all,

(b) upholds the rule of law, and

(c) ensures that authority is exercised responsibly.

11. Allegations One and Two are inherently antithetical to the NSWPF Statement of Values as set out at s 7 of the Police Act, contrary to NSWPF policy and procedure (including the NSWPF Code of Conduct and Ethics and the Standards of Professional Conduct (the Code of Conduct)), and amount to misconduct under the GSE Act.

Misconduct under the GSE Act 12.

12. Where employment was terminated by reason of 'misconduct' pursuant to s 69(4)(b) of the GSE Act, the following matters arise for consideration:

(a) Did the misconduct occur? The onus is on the Respondent to establish this.

(b) Did the misconduct warrant dismissal in all the circumstances?

(c) Were the procedural requirements contained in Part 6 of the GSE Police Rules met before taking any action pursuant to s 69(4)(b) of the GSE Act.

13. Where the elements above have been satisfied, based on objectively proven facts, in the sense described in Selvachandran v Peteron Plastics Pty, it will generally be the case that there is a valid reason for the employee's dismissal. In those circumstances, there will be limited scope to suggest that there is a procedural deficiency which has rendered the dismissal decision unfair.

Dismissal under s 69(4) of the GSE Act

14. Pursuant to s 69(4) of the GSE Act, once there is a finding of misconduct by and employee of a government sector agency, then the person who exercises functions in relation to the employee may take one of a number of actions in the range set out in that provision. The action that may be taken ranges from termination of employment without the opportunity to resign (the most severe) to a caution or a reprimand (the least severe).

...

23. Prior to the Dismissal, the Applicant was employed as a Firewall Security Administrator, who had the necessary administrative privileges to set up the WeChat configuration.

24. On 11 January 2024, the Applicant attended a meeting with Mr Drexler and Inspector Fitzhenry. During this meeting, the Applicant admitted that he installed WeChat on a NSWPF device but denied (on multiple occasions) logging into WeChat or using it. The Applicant also said that the application 'never worked'. On 11 January 2024, the Applicant was suspended with pay.

25. On 19 January 2024, the Applicant met with Mr Drexler and Inspector Fitzhenry again. During this meeting, the Applicant continued to deny that he used his administrative privileges to make WeChat work. The forensic evidence was then produced, after which the Applicant admitted to:

(a) installing the application for personal use;

(b) manipulating the configuration software to make WeChat work; and

(c) using the application on a number of occasions.

26. From on or around 5 February to late March 2024, the Applicant took a period of approved annual leave to visit China.

27. Between March and May 2024, the NSWPF considered whether the Applicant should be prosecuted for committing an offence under s 308H of the Crimes Act 1900 (unauthorised access to or modification of restricted data held on a computer). NSWPF decided in or around May or June 2024 that the Applicant should not be criminally prosecuted. The matter then continued as an internal disciplinary matter.

D. DID THE MISCONDUCT (ALLEGATIONS ONE AND TWO) OCCUR?

28. The Commission would be satisfied that the COP has established, on the balance of probabilities, that Allegations One and Two occurred in circumstances where:

(a) the Applicant expressly admits Allegation One. Using the Applicant's own words, the Applicant accepted that he installed the non-approved software 'WeChat' onto his NSWPF desktop computer and used his personal WeChat account and whilst on duty logged on to WeChat several times; and,

(b) the Applicant impliedly admits Allegation Two. Merely providing excuses after the fact by way of 'explanation' for the statements he made to Mr Drexler and Inspector Fitzhenry during the 11 January Meeting.

29. The Commission would be satisfied, on the face of the Applicant's admissions and the evidence of Mr Drexler, Inspector Fitzhenry, and Mr Leeming, that Allegations One and Two are made out in full.

E. DID THE MISCONDUCT (ALLEGATIONS ONE AND TWO) WARRANT DISMISSAL?

...

31. The NSWPF Technology Command is responsible for supporting frontline police officers with contemporary communications and business technology systems. In his capacity as a Firewall Security Administrator, the Applicant was at the front line of protecting all information that was going in and out of the NSWPF, as well as, protecting the NSWPF computer systems from malicious activity or unauthorised access.

32. NSWPF trusted the Applicant to act with honesty and integrity in the course of his employment. It was vital that the COP have absolute confidence in the Applicant, as he was given privileged access to NSWPF's most critical computer systems and sensitive data.

33. Allegations One and Two, independently and when taken together, caused a breakdown in the trust between the NSWPF and the Applicant such that it was no longer possible for the COP to trust the Applicant to perform his duties in accordance with his employment obligations.

F. WAS THE DISMISSAL PROCEDURALLY FAIR?

34. Yes, the Applicant's dismissal was procedurally fair as all the requirements of Part 6 of the GSE Police Rules were complied with. Specifically, the Applicant was provided with the details of Allegations One and Two and the action that may have been taken, he was given the opportunity to make a statement in relation to the allegations, and was notified of the Commissioner's decision to proceed under s 69(4)(b) of the GSE Act.

35. At its highest, the Applicant suggests that the Dismissal was procedurally unfair because he was not warned about the 11 January Meeting or offered the opportunity to bring a support person. Respectfully, these submissions ought to be rejected. The Applicant was offered the opportunity to obtain a support person or speak to his union representative on 11 January 2024, he declined the offer and elected to proceed with the interview. There is no positive obligation on the NSWP to provide a support person under the GSE Police Rules or the IR Act. The Applicant elected to participate in the 11 and 19 January Meetings without a support person.

36. The 11 January Meeting and 19 January Meeting were conducted as part of the initial stage for dealing with allegations pursuant to rule 44 of the GSE Police Rules. As set out above, the Applicant was given sufficient understanding of and opportunity to respond to the allegations. Any suggestion that the Applicant's Dismissal was procedurally unfair must be rejected.

G. THE DISMISSAL WAS NOT HARSH, UNJUST, OR UNREASONABLE

37. In the above premises, the dismissal of the Applicant was not unjust or unreasonable as there was a valid reason for his dismissal which he admits to. Further, the dismissal of the Applicant was not harsh taking into consideration, inter alia:

(a) the crucial role that the Applicant's department, Technology Command, plays in supporting frontline police officers in the NSWPF;

(b) the requirement that all members of the NSWPF place 'integrity above all', which is reflected in the NSWPF Code of Conduct;

(c) the position of Firewall Security Administrator is one of absolute confidence, given the privileged level of access a person in that role has to NSWPF's most critical computer systems and sensitive data; and,

(d) that NSWPF had lost trust in the Applicant's ability to appropriately exercise his administrative privileges.

38. The Applicant's conduct is incompatible with the continuance of his employment with the NSWPF.

39. The Applicant primarily relies on his personal and economic circumstances in support of his position that the Dismissal was not the appropriate response to the misconduct. Specifically, the Applicant claims:

(a) his loss of income means he can no longer pay his mortgage (which is over 1 million dollars) or meet the financial demands of living in Sydney;

(b) he is now uniquely suited to government employment, particularly the NSWPF computer systems55, and a non-native English speaker, all of which cause additional barriers to seeking new employment in the current markets; and

(c) he has unsuccessfully applied for a few jobs and that his age is a barrier to re-employment

40. The Applicant's age, and length of employment are factors that weigh in his favour when considering his personal and mitigating factors. Further, the COP acknowledge that the Dismissal had an impact on the Applicant's personal and economic circumstances. However, on balance, the matters weighing in favour of the Dismissal outweigh any finding that the Dismissal was harsh, unreasonable or unjust.

41. The Applicant's Dismissal was a response which was open to the COP given the seriousness of the Applicant's misconduct and the importance of the regulatory context within which the Applicant was employed."

(Emphasis in original. Footnotes omitted.)

1. For reasons set out below, the Commission has determined that the respondent did not sufficiently establish that the applicant breached a specific policy by installing the software.
2. For reasons also set out below, the Commission has determined that the respondent did persuade the Commission that the "untruths" expressed by the applicant in meetings to discuss installation of the software were the product of a guilty mind. Further, these were expressed in circumstances where the respondent was entitled to expect honesty, both because of the nature of the respondent's operation, and of the applicant's employment with the respondent.
3. Modern workplaces, especially of the kind found in large public service organisations such as the respondent, have complex information technology systems through which most of an employee's work is achieved. In order to protect those systems, employers have in place both defensive measures, such as firewalls, and a range of rules as to the kinds of software which can be installed on their information technology systems.
4. An employer may have in place rules prohibiting the installation of certain types of software, or a rule which bans employees from installing any software regardless of the nature of that software. An employer may go to the extent of implementing a system-based rule which prevents the installation of software without appropriate permissions, permissions which are not held by most employees.
5. It was the position of the respondent that she had in place all of these rules, which the applicant's installation of WeChat on his computer breached or by-passed.
6. The respondent's position was undermined, or unsupported, for several reasons:

(1) No evidence was led by the respondent, and neither was it suggested to the applicant in cross examination, or in the course of considering his dismissal, that there was a system level bar on installing software, which had been bypassed by the applicant. It was put to the applicant, both in his show cause process and during cross examination, that he had installed WeChat so as to bypass part of the firewall in place protecting the respondent's information technology systems. The Commission is not satisfied that what was put to the applicant would allow the Commission to conclude, on a proper evidentiary basis, that the applicant had bypassed a system level bar on installing software.

(2) The respondent's witnesses uniformly agreed that no list of prohibited (blacklisted) software existed, and that equally no list of acceptable (whitelisted) software existed.

(3) No evidence was led before the Commission as to the content of any training course undertaken by the applicant which would have supported the respondent's position.

(4) There was evidence before the Commission of a single line extracted from the NSWPF Information Security Manual policy to the effect that "[i]t is a requirement that all employees not download, install or execute any software or files from external sources without formal approval ...". Given its importance to the case of the respondent, the Commission is unable to conclude that this part of the policy was sufficiently put to the applicant during the show cause process.

(5) The respondent's witnesses were unable to explain the attachments to their witness statements, which they asserted demonstrated the use of WeChat.

(6) It was exposed during cross examination that one of the occasions on which it was said WeChat had been used was time stamped at 12.30am. There was no evidence before the Commission that the applicant was working at that time, and it appears inherently unlikely that he would have been working at that time.

1. The Commission has concluded that there is not a sufficient basis to impugn the credit of the respondent's witnesses to the extent an adverse inference should be drawn against their willingness to be truthful. When pressed they did not dissemble, and readily conceded that they could not sustain their evidence based on matters put to them.
2. However, as set out above, the value of their evidence was significantly diminished by their inability to explain the attachments, or to have sufficiently read their attachments so as to have noticed that crucial components on which they relied occurred at a time when it was inherently unlikely the applicant was at work.
3. Against this is the paradox of a senior employee, engaged in a role charged with protecting the respondent's information technology systems, asserting that he was unaware that it was improper for him to use his privileged access to install unapproved software to his work computer.
4. The Commission has concluded that the respondent has not discharged the onus on it to establish the facts of the misconduct alleged insofar as that misconduct is constituted by the installation of unauthorised software.
5. It was not in dispute that when the installation of WeChat was first raised directly with the applicant that he said things that he later conceded were not true. The applicant challenged the use of the word "lie", categorising his lack of accuracy and candour as, variously, a nervous response to being confronted by uniformed and armed police, a lack of recollection and general confusion.
6. The Commission does not consider that these categorisations are accurate, and has concluded that while the applicant may have been nervous and stressed, it was fundamentally because he realised he had been exposed as doing the wrong thing. There is no question that the evidence before the Commission demonstrates that "lies" is a correct categorisation of the applicant's actions over several meetings.
7. Unfortunately for the applicant, his evidence to the Commission demonstrated the same lack of candour as the respondent accused him of demonstrating during the investigation and show cause process.
8. Variously, the applicant denied installing the software, denied recalling installing the software, denied that the software had worked, asserted that the software had not worked particularly well, asserted that he had installed the software to test the respondent's information security systems, and asserted that he installed the software to communicate with his elderly parents in China because they did not use the telephone.
9. There is a logical progression through which, as further information comes to light, the applicant concedes that his previous statements have been incorrect, but only to the extent to which further information has demonstrated his earlier inaccuracies. At no point did the applicant sit down and get ahead of the investigation such that he volunteered any information which had not been discovered separately by the respondent.
10. It is difficult to comprehend that a person employed in a senior role, the essence of which role is to protect their employer's information security system, and one who has occupied that role for the best part of two decades, could have taken such a blasé approach to installing software which was not central to his role. The Commission is not persuaded by the half-hearted evidence of the applicant that he installed the software for a legitimate work purpose, being to test the security of the respondent's information security system.
11. In light of the credit findings, contrary to the interests of the applicant and set out above, the Commission has concluded that the applicant lied repeatedly to the respondent in the course of the investigation and the show cause process, and that the lies were the product of a guilty mind. The applicant knew he had done the wrong thing in that installation, whether or not prohibited by a policy.
12. The Commission accepts that the applicant was stressed and nervous when he was called on to respond to the allegation he had installed WeChat, but given the foregoing does not accept that this is a reasonable basis for him to have been anything less than candid, and certainly not to have lied to the respondent.
13. The applicant was not a sworn officer of the New South Wales Police Force, but it is abundantly clear that the position of trust in which he was employed, even before there is consideration of the identity of the respondent, should have required him to be absolutely candid and honest in any dealings with his colleagues about the installation of software.
14. The Commission cannot be satisfied that the applicant would be candid and truthful in future dealings with the respondent if he were reinstated. This is consistent with the respondent's determination at the conclusion of the show cause process.
15. To this point, the Commission has concluded that the applicant's dismissal was harsh and unjust insofar as it relied on the applicant breaching the policy by installing WeChat. This is because it there was not a proper basis to have dismissed the applicant.
16. To this point, the Commission has also concluded that the applicant's dismissal was not harsh or unjust insofar as it relied on the applicant's dishonesty and lack of candour. There was both a proper basis for the dismissal, and one which was not harsh as being disproportionate to the misconduct.
17. In support of the dismissal being unreasonable, because of the process followed, there is some force to the applicant submission that during the initial meeting he was "confronted" with the allegation that he had installed on authorise software being WeChat. To this is added the apparent lack of a support person for the various meetings.
18. Having already concluded the first allegation cannot be sustained, it is unnecessary to further consider the procedural adequacy of that allegation.
19. In respect of the second allegation, the Commission has determined that, in the context of the applicant's ongoing lack of candour, indeed ongoing dishonesty, any unreasonableness arising from that initial meeting does not rise to a level warranting a finding that the dismissal was unreasonable. This is because the process continued for a considerable period after that initial meeting. The applicant had several subsequent opportunities to candidly, and ahead of the game, disclose openly and fully his conduct.
20. There is little about the process after the first meeting which could be criticised. The applicant had the allegations in writing, had an opportunity to consider and respond to them, had his response considered by the respondent and was provided reasons for the respondent's decision.
21. Turning finally to whether the dismissal was harsh for its impact on the applicant personally it is relevant to consider the applicant's length of service and his personal circumstances.
22. On the face, several factors raised by the applicant would tend to support a finding that dismissal was harsh for it impact on him personally. These factors would include the applicant's age, his not being a native English speaker, and his length of service with the applicant, together with his lengthy periods of service solely in the public sector.
23. The Commission has concluded that these have been overstated, and less weight should be given to them than the submissions of the applicant suggested.
24. It was clear, as is set out above, that the applicant's grasp of English is strong, and in particular his written English is strong. He was able to engage directly with counsel for the respondent, clearly understood the questions, and had no difficulty in forming nuanced answers to those questions.
25. From cross examination of the applicant as to his efforts to find alternative employment it was clear that his prospects of obtaining other employment were not as limited as he submitted. From the small number of applications reported as having been made by the applicant, a high proportion of them had resulted in secured interviews.
26. His length of service with the respondent is a factor that supports the applicant's case that his dismissal was harsh.
27. The same can be said for the economic consequences suffered by the applicant as a result of his dismissal, although most employees being dismissed for misconduct will effectively suffer similar consequences.
28. Against the dismissal being harsh for the personal circumstances of the applicant are the reasons for which the dismissal has otherwise been upheld as not unfair, being the dishonesty of the applicant. This makes it difficult for the Commission to conclude that there are circumstances specific to the applicant which would make his dismissal harsh.
29. Overall, the Commission concludes that the dismissal was not harsh for reasons related to the personal circumstances of the applicant.

1. The Commission would have concluded the dismissal was unjust and harsh, and likely unreasonable, if restricted to the installation of WeChat software.
2. The Commission concludes the dismissal of the application was not unfair for being harsh, unreasonable or unjust as to the separate allegation of dishonesty.
3. The Commission is therefore required to dismiss the application.