124th Session, 2017
European Organization for Nuclear Research
Full Judgment Text: EN,
Summary: The complainant challenges the decision to dismiss him on disciplinary grounds.
In disciplinary matters, the burden of proof lies with the employer, which must demonstrate that the employee did indeed engage in the conduct of which she or he is accused. If the facts are disputed and there is no persuasive material evidence, the facts of the dispute must be appraised on the basis of conclusive circumstantial evidence. Thus, the facts may be held to be established when a set of precise presumptions and concurring circumstantial evidence enable the decision-making authority to conclude beyond reasonable doubt that the person concerned is guilty (see, in particular, Judgments 2786, under 9, 2849, under 16, and 3297, under 8).
When a complaint is filed seeking the setting aside of a disciplinary measure or a dismissal ordered at the end of disciplinary proceedings, it is not the Tribunal’s role to reweigh the evidence collected by an investigative body, the members of which have already appraised this evidence, or in particular the reliability of the testimony of persons whom they have directly heard (see, in particular, Judgment 3757, under 6). This is all the more true when the evidence to be appraised comprises extremely complex technical elements such as those inherent to a process of computer hacking of the kind observed in this case. What is essential is that any person under investigation has ample opportunity to adduce and refute evidence, which has manifestly been the case here.
ILOAT Judgment(s): 2786, 2849, 3297, 3757
burden of proof; disciplinary procedure; hacking;
An investigation aimed at identifying the perpetrator of an undisputed incident of computer hacking has no chance of success unless rigorous protective measures are taken immediately, as a first step, in order to put an end to the damage caused by this unlawful action. The evidence in the file shows, firstly, that the conduct of the investigators towards an employee whom they could objectively regard as the prime suspect did not go beyond what was necessary in the circumstances. Had they not seized all the data in his possession, and had he not been removed temporarily from his workplace, it would have been easy for him, if he was the guilty party, to erase any data which might have proved that he was implicated in the hacking which formed the subject of the investigation.