GRACIELA v GIACOBBE [2015] DIFC CFI 027 — IT sabotage and the civil standard of proof (11 November 2015)

What was the nature of the dispute between Graciela Limited and Mr Giacobbe regarding the IT system sabotage?

The lawsuit centered on a claim of wrongful interference with property under Article 41 of DIFC Law No. 5 of 2005. Graciela Limited, an investment firm, alleged that its former IT employee, Mr Giacobbe, orchestrated a malicious attack on its IT infrastructure on 21 June 2014. The Claimant contended that the Defendant had surreptitiously created a secondary server to copy sensitive data before deleting the original files from the main system, effectively holding the company’s operations hostage.

The stakes involved significant financial losses, with the Claimant seeking damages to cover the costs of emergency IT restoration, the procurement of new hardware, and the loss of productivity caused by the diversion of staff to address the crisis. The Defendant vehemently denied any involvement, asserting that he had no access to the system after his employment concluded, except when he was requested to assist in the recovery efforts following the crash. The court was tasked with determining whether the circumstantial evidence presented was sufficient to attribute the sabotage to the Defendant. As noted in the findings:

I accept Graciela’s expert witness’s opinion that the 21 June 2014 attack was not perpetrated by an outsider (or outsiders) but by an insider.

Which judge presided over the Graciela Limited v Giacobbe proceedings in the DIFC Court of First Instance?

The matter was heard before Justice Sir Richard Field in the DIFC Court of First Instance. The trial took place over three days on 15, 16, and 17 September 2015, with the final judgment delivered on 11 November 2015. This case is part of a broader procedural history involving the same parties, including earlier interlocutory matters such as GRACIELA v GIACOBBE [2014] DIFC CFI 027 — Default judgment and the rejection of a late defence extension (29 October 2014), GABRIEL LIMITED v GIACOBBE [2014] DIFC CFI 027 — Stay of enforcement pending set-aside application (16 November 2014), GABRIEL LIMITED v GIACOBBE [2015] DIFC CFI 027 — Judicial refusal to adjourn Case Management Conference (12 February 2015), GABRIEL LIMITED v GIACOBBE [2015] DIFC CFI 027 — Case Management Order (24 March 2015), and GABRIEL LIMITED v GIACOBBE [2015] DIFC CFI 027 — Procedural order for remote testimony (02 April 2015).

What were the specific legal arguments advanced by Duncan McCall QC and Dr Reyadh Kabban?

Duncan McCall QC, representing Graciela Limited, argued that the technical evidence—specifically the use of the "clsadmin" account and the creation of a secret server—pointed exclusively to the Defendant. He maintained that the sabotage was a calculated act of retribution by Mr Giacobbe for his failure to secure a promotion. The Claimant’s legal team relied heavily on expert testimony to demonstrate that the attack required internal knowledge that only the Defendant possessed, thereby refuting the possibility of an external breach.

Conversely, Dr Reyadh Kabban, appearing for Mr Giacobbe, focused on challenging the reliability of the Claimant’s evidence. The defense argued that the circumstantial nature of the case was insufficient to meet the burden of proof required for such serious allegations of fraud and sabotage. Dr Kabban sought to undermine the credibility of the Claimant’s witnesses and expert reports, suggesting that the technical logs were misinterpreted or that the Claimant had failed to account for other potential vectors of the attack. However, the court found these arguments unpersuasive, noting:

In my judgment, none of Dr Al Kabban’s criticisms undermine the reliability of the sworn factual evidence given by Graciela’s witnesses from the witness box.

What was the precise doctrinal issue regarding the standard of proof for serious allegations in the DIFC?

The court had to determine whether the evidence provided by the Claimant was sufficient to satisfy the civil standard of proof—the balance of probabilities—when the allegations involved serious professional misconduct and potential criminal-like sabotage. The doctrinal challenge lay in applying the principle that the more serious the allegation, the more "cogent" or "strong" the evidence must be to persuade the court, without elevating the standard of proof to the criminal "beyond reasonable doubt" threshold.

Justice Sir Richard Field had to reconcile the circumstantial nature of the digital evidence with the requirement for a high degree of certainty. The court examined whether the "inherent probability" of an employee sabotaging their former employer’s system could be established through a combination of technical logs and the lack of alternative explanations. The issue was not merely whether the Defendant could have done it, but whether the evidence was strong enough to conclude that he did do it, given the gravity of the accusation.

How did Justice Sir Richard Field apply the test for circumstantial evidence in cases of IT sabotage?

Justice Sir Richard Field employed a rigorous assessment of the evidence, emphasizing that while the case was built on circumstantial facts, the cumulative weight of those facts left no room for reasonable doubt. He rejected the Defendant’s denials as dishonest, noting that the Defendant’s secret actions—specifically the creation of a hidden server—were inconsistent with innocent conduct. The judge applied the principle that when an event is highly improbable, the evidence must be commensurately strong.

The court systematically dismantled the defense’s alternative theories, finding that no third party could have possessed the specific credentials required to execute the attack. The reasoning was anchored in the following judicial assessment:

Justice Sir Richard Field adopted an approach whereby strong and convincing evidence would be required for serious allegations to be proved on the balance of probabilities. The case was based on circumstantial evidence.

Furthermore, the court emphasized the necessity of clear evidence when dealing with improbable events:

“The more improbable the event, the stronger must be the evidence that it did occur before, on the balance of probability, its occurrence will be established.”

Which statutes and precedents were central to the court’s decision in Graciela Limited v Giacobbe?

The court relied on Article 41 of DIFC Law No. 5 of 2005, which governs wrongful interference with property, as the primary cause of action. For the quantification of damages, the court looked to Articles 23, 24, and 25 of DIFC Law No. 7 of 2005. These provisions allowed the Claimant to recover costs associated with the restoration of the IT system and the disruption of business operations.

In terms of judicial precedent, the court cited In re H (Minors) (Sexual Abuse: Standard of Proof) [1996] AC 563 and In re B (Children) (FC) [2008] UKHL 35 to clarify the application of the civil standard of proof. These cases were instrumental in guiding the court on how to weigh the seriousness of the allegations against the available circumstantial evidence. Additionally, the court referenced Aerospace Publishing Ltd & Anr v Thames Water Utilities Ltd [2007] Bus L.R. 726 to establish the criteria for recovering costs related to the diversion of employee time during the incident response.

How did the court utilize the cited precedents to reach its conclusion?

The court used In re H (Minors) to establish that the civil standard of proof is flexible and that the "seriousness of the allegation" is a factor to be weighed, rather than a reason to change the standard itself. This allowed Justice Sir Richard Field to demand "strong and convincing" evidence without departing from the balance of probabilities.

The Aerospace precedent was utilized to validate the Claimant’s claim for damages related to internal staff time. By satisfying the requirements set out in Aerospace, the Claimant successfully demonstrated that the diversion of its employees to fix the IT system caused significant business disruption and that the cost of this diversion was a recoverable loss. The court found that the Claimant had produced the best evidence reasonably available to quantify this loss, thereby meeting the threshold for compensation.

What was the final disposition and the amount of damages awarded to Graciela Limited?

The court found in favor of the Claimant, Graciela Limited, and held the Defendant, Mr Giacobbe, liable for the sabotage of the IT system. The court concluded that the Defendant’s denials were "knowingly and dishonestly false." Consequently, the court awarded the Claimant compensatory damages totaling USD 690,533.

This award covered several heads of loss, including:
* Costs incurred by an external company for system restoration and forensic investigation.
* Expenses related to the purchase and configuration of emergency servers.
* The value of employee time diverted from revenue-generating activities to address the IT crisis.

The court also invited the parties to submit further written arguments regarding the final determination of costs and interest.

What are the wider implications of this judgment for IT-related employment disputes in the DIFC?

This judgment serves as a critical reference for employers dealing with internal IT sabotage. It confirms that the DIFC Courts will not shy away from finding liability in cases of professional misconduct, even when the evidence is primarily circumstantial, provided that the evidence is "strong and convincing." The ruling clarifies that the civil standard of proof remains the benchmark, but the court will apply a heightened level of scrutiny to the quality of evidence when the allegations are serious.

Furthermore, the case provides a clear roadmap for recovering damages in IT incidents, particularly regarding the recoverability of internal staff costs. By following the Aerospace test, claimants can successfully recover the value of diverted employee time if they can demonstrate that such diversion caused measurable business disruption. Practitioners should note that the court places significant weight on expert testimony and the credibility of witnesses when digital logs are at the heart of the dispute.

Where can I read the full judgment in Graciela Limited v Giacobbe [2014] DIFC CFI 027?

The full judgment can be accessed via the official DIFC Courts website at: https://www.difccourts.ae/rules-decisions/judgments-orders/court-first-instance/graciela-limited-v-giacobbe-2014-difc-cfi-027 or via the CDN link: https://littdb.sfo2.cdn.digitaloceanspaces.com/litt/AE/DIFC/judgments/court-first-instance/DIFC_CFI_Graciela_Limited_v_Giacobbe_2014_DIFC_CFI_027_20151111.txt.

Cases referred to in this judgment:

Legislation referenced:

• DIFC Law No. 5 of 2005 (Law of Obligations), Article 41
• DIFC Law No. 7 of 2005 (Employment Law), Articles 23, 24, and 25