Bedrossian v. Cal. State Personnel Bd. CA2/1

Opinion

Filed 7/28/26 Bedrossian v. Cal. State Personnel Bd. CA2/1 NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for purposes of rule 8.1115.

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

SECOND APPELLATE DISTRICT

DIVISION ONE

SYLVIA BEDROSSIAN, B349445

Plaintiff and Appellant, (Los Angeles County Super. Ct. No. 24STCP00957) v.

CALIFORNIA STATE PERSONNEL BOARD,

Defendant and Respondent;

STATE COMPENSATION INSURANCE FUND,

Real Party in Interest and Respondent.

APPEAL from an order of the Superior Court of Los Angeles County, Theresa M. Traber, Judge. Affirmed. Sylvia Bedrossian, in pro. per., for Plaintiff and Appellant. Michael J. Monteiro for Real Party in Interest and Respondent. No appearance for Defendant and Respondent. Appellant Sylvia Bedrossian filed a writ petition challenging an order of respondent, the State Personnel Board (SPB), affirming Bedrossian’s five-day suspension from work at real party in interest the State Compensation Insurance Fund (the Fund). The trial court denied the petition. We affirm.

FACTUAL BACKGROUND A. Bedrossian’s Employment at the Fund The Fund employed Bedrossian as a staff attorney beginning in March 2004 and ultimately promoted her to attorney IV. In the latter position, she was responsible for litigating worker’s compensation cases involving “confidential and sensitive information.” A “duty statement” Bedrossian signed lists among her responsibilities as an attorney IV “[m]aintain[ing] user mastery over [the Fund’s] computer-based technology” and “communicat[ing] professionally and efficiently.”

B. Cybersecurity Training The Fund “require[s] that all employees take [cyber]security awareness and privacy training annually so that they can recognize external threats such as phishing and other social engineering tactics.” “Phishing” refers to the process of sending emails purporting to be from a legitimate source and encouraging the recipient to “click on . . . a malicious link” or attachment or provide sensitive information. “If a phishing email is successful, [it] can either steal data from the user,” “compromise the user’s account,” or “compromise the entire system” of an organization. Over the course of her employment at the Fund, Bedrossian participated in numerous training sessions on how to identify and handle phishing emails. This training educated employees

2 about “red flags” which should alert the reader that an email is potentially dangerous, such as asking the recipient to click a link to avoid a negative consequence. In 2019, the Fund began automatically adding an “external sender notification” banner on all emails from outside the Fund, which reminded the recipient in yellow highlighted text that the email “was sent from outside [the Fund]” and not to click on links or open attachments “unless you recognize the source and know the content is safe.”

C. Phishing Email Tests 1. Phishing Email Test Campaign In 2018, the Fund security department circulated a memorandum to all employees announcing the Fund was starting “organization-wide security phishing awareness tests . . . on a regular basis to test [employees’] security awareness knowledge.” These tests involved the Fund sending emails “to all 4000 [Fund] employees in a randomized fashion”—that is, in “groups of employees at a time, at different dates and times.” The test emails “mirrored what a real phishing email might look like. When an employee clicked on links contained [therein] . . . , replied to the emails, or opened [an] attachment, [the employee was] deemed to have ‘failed’ the test. Simply opening the phishing test emails did not trigger a failure result, nor did hovering over a link.” The memorandum informed employees that those “who click on a phishing test email [would] receive counseling and reinforcement training,” and that “[r]epeated violations may result in formal disciplinary action.”

3 2. Bedrossian’s Failed Tests Resulting in Additional Training Effort Between December 2021 and December 2022, Bedrossian failed three phishing tests. As a result of the first failed test, she was required to participate in remedial cybersecurity training sessions in the form of both “recorded trainings as well as one-on-one coaching.” These training sessions failed to alleviate the problem; Bedrossian failed two more tests, after which the Fund suspended her for five days. That suspension is the subject of the writ petition ruling before us on appeal. On December 21, 2021, Bedrossian received a phishing test email purporting to be authored by a Fund employee, but from a non-Fund email address. It instructed the recipient to click on a link and enter an email address and password. Bedrossian opened the email with her Fund-issued mobile phone and clicked the link. The Fund issued her a memorandum “remind[ing] [her] of the dangers of phishing attacks” and required her, inter alia, to participate in a one-on-one security awareness training session with a Fund security analyst. At the beginning of that February 2022 training session, the analyst informed Bedrossian that the analyst was “solely there to provide training,” and “[a]ny questions . . . in regards to the personnel actions” should be directed to human resources or Bedrossian’s supervisor. Bedrossian “became very abrupt, very rude, disrespectful, [and] started . . . ask[ing] . . . all kinds of questions that had nothing to do with the training,” “making accusations,” and “being very belittling.” For example, Bedrossian asked the analyst “about the number of employees who received the test emails, and whether specific individuals were targeted to receive them. [Bedrossian]

4 accused [the analyst] of not being a [Fund] employee and of being improperly supplied with private information about [Bedrossian].” The analyst felt she could not continue the session and ended it “within the first few minutes.” Later that day, Bedrossian emailed the analyst and the analyst’s supervisor accusing the security department of trying to entrap employees and unfairly targeting Bedrossian with the phishing test email.1 On May 11, 2022, Bedrossian received a phishing test email purporting to be from state vehicle registration. It instructed her to click on links to renew her license and registration in order to avoid penalties. Bedrossian opened it on her Fund-issued mobile phone and clicked the link. Bedrossian again received a memorandum from her supervisor admonishing her about this failed test.

1 The following is a representative excerpt from Bedrossian’s February 11, 2022 email: “You are not on the employee list and neither is your boss. You have private information that . . . HR or IT is supplying you with in order to ‘catch the employees’. . . . You would not answer my questions about how many employees you targeted on 12/21/21 at 3:50 p.m. with the phishing email. You indicated that it was not done through the whole 4000 employees. You said it was random and yet you would not give me information how you knew that my computer was having issues with hacking. When I asked about your affiliation with IT or HR and your boss[’s] name you refused to give me an answer and hung up on me. This is not proper procedure. . . . Are you an independent vendor providing services for [the Fund]. Are you hired by IT or HR to conduct these tests on their behalf. I want to know your boss[’s] name. I want to know how many people were on the mailing list on 12/21/21 at 3:50 p.m. How did you designate who will be on the specific targeted email? Who is giving you the private information for you to gear it to those people?”

5 On December 9, 2022, Bedrossian received a phishing test email from wework@invite-workplace.com inviting her to accept an invitation to a new WeWork account by clicking on a link. The Fund does not use WeWork. Bedrossian opened the email and clicked on the link.

D. Bedrossian’s Suspension and Appeal to the SPB On March 1, 2023, the Fund served Bedrossian a notice of adverse action (NOAA) formally notifying her that the Fund was suspending her without pay for five days, effective on March 13, 2023. As the basis for the suspension, the NOAA described Bedrossian’s failed phishing tests and her interactions with the security analyst and Fund personnel about the December 2021 test. (See Gov. Code, § 19572, subds. (b), (d), (e), (o) & (t).) Bedrossian appealed the suspension to the SPB.2 The SPB is charged with reviewing discipline imposed on a state civil service employee, which Bedrossian is. (See Boren v. State Personnel Board (1951) 37 Cal.2d 634, 638.) When a state employee challenges “suspen[sion] without pay for five days or less” the SPB may choose to investigate with or without a hearing. (Gov. Code, § 19576.) The SPB chose to hold an investigatory hearing before an administrative law judge (ALJ). At the hearing, Bedrossian’s counsel provided an opening statement and closing argument, introduced exhibits, and questioned witnesses. Both Bedrossian and the security

2 Bedrossian represents in her briefing—without record support—that the Fund not only suspended her, but also terminated her. Even if the Fund has since terminated Bedrossian, her suspension is the only discipline imposed in the SPB order that is the object of her writ petition and this appeal.

6 analyst testified. The ALJ found Bedrossian not credible and found the analyst credible. It thus resolved the analyst’s and Bedrossian’s conflicting testimony on key points in favor of the analyst’s version of events, finding “that during [Bedrossian’s] training with [the analyst], appellant spoke to her in an accusatory and condescending manner” and that Bedrossian “clicked on the links contained in the phishing test emails sent to her.” (Capitalization omitted.) The ALJ issued a proposed decision upholding Bedrossian’s suspension. The ALJ concluded the Fund had sufficiently proven multiple “cause[s] for discipline” under Government Code section 19572; namely, “inexcusable neglect of duty,” “discourteous treatment of the public or other employees,” “willful disobedience,” and “other failure of good behavior either during or outside of duty hours which is of such a nature that it causes discredit to the appointing authorities or the person’s employment.” The ALJ dismissed the incompetency and insubordination causes for discipline that the Fund had also listed in the NOAA. After considering “the extent to which [Bedrossian’s] conduct resulted in, or if repeated is likely to result in [h]arm to the public service” “the circumstances surrounding the misconduct and the likelihood of its recurrence,” the ALJ found that the five-day suspension was the appropriate penalty. (Skelly v. State Personnel Board (1975) 15 Cal.3d 194, 218 (Skelly) [identifying these as the factors for determining appropriateness of discipline under Government Code section 19572].) The SPB adopted the ALJ’s proposed decision and issued an order upholding the suspension.

E. Bedrossian’s Writ Petition

7 Bedrossian filed a petition for a writ of administrative mandamus with the Los Angeles County Superior Court challenging the SPB’s decision upholding the suspension. She argued the SPB “proceeded without or in excess of its jurisdiction,” that she was “deprived of a fair trial” and that the SPB decision reflected “a prejudicial abuse of discretion.” The court denied the petition. The court stated Bedrossian had forfeited some of her arguments as to how the SPB abused its discretion—specifically, those based on “her First Amendment right to free speech; federal phishing law; wire fraud; California Penal Code section 502 (larceny); and entrapment”—because she did not raise these before the SPB. It fully addressed all other arguments Bedrossian raised in her petition. The court went on to consider the merits of some of Bedrossian’s forfeited arguments as well. It found them unpersuasive, explaining that “ ‘entrapment is recognized as a defense to criminal charges in order to discourage illegal police conduct’ (In re Foss (1974) 10 Cal.3d 910, 932 . . . ) . . . not a defense to the workplace misconduct alleged against [Bedrossian][, and] [t]here are similar defects in [Bedrossian’s] other newly raised defenses.” This appeal followed.

DISCUSSION A. Code of Civil Procedure Section 10853 Governs Bedrossian’s Petition Bedrossian sought writ relief under section 1094.5. That section permits writ review of a state or local administrative agency disciplinary decision made “after a proceeding in which,”

3 Unless otherwise indicated, all further statutory references are to the Code of Civil Procedure.

8 inter alia “by law, . . . a hearing is required to be given.” (Taylor v. State Personnel Board (1980) 101 Cal.App.3d 498, 502–503 (Taylor), italics omitted; see § 1094.5.) Because controlling law permits, but did not require, the SPB to hold a hearing on Bedrossian’s claims (see Gov. Code, § 19576; Taylor, supra, at pp. 502–503), she could not seek recourse under section 1094.5. (See Taylor, supra, at pp. 503–504; see also Keeler v. Superior Court (1956) 46 Cal.2d 596, 599 [that an agency chose to hold a hearing the law did not require it to hold does not support entitlement to section 1094.5 review].) “When a party petitions for a writ of administrative mandamus, and such review is not applicable, it is the court’s duty to” consider whether “traditional writ of mandate” review is available under section 1085. (Taylor, supra, 101 Cal.App.3d at p. 505.) Section 1085 provides for writ relief “ ‘to compel the performance of an act which the law specifically enjoins.’ . . . Ordinarily, mandamus does not lie to compel the doing of an act in a particular manner where an agency has discretion to decide on the manner of its performance.” (Taylor, supra, at p. 505; Common Cause v. Board of Supervisors (1989) 49 Cal.3d 432, 442 [“[m]andamus will not lie to control an exercise of discretion”].) Rather, “[m]andamus will lie to correct an abuse of discretion only where a petitioner clearly establishes his right to have discretion exercised in a particular manner.” (Taylor, supra, at p. 505, italics omitted; Mannheim v. Superior Court (1970) 3 Cal.3d 678, 685.) The trial court concluded section 1085 writ review was appropriate because if, as Bedrossian argued in her petition, “the evidence was insufficient to justify disciplinary sanctions against [her], the [SPB] had a legal duty to revoke the adverse action.”

9 (Coelho v. State Personnel Bd. (1989) 209 Cal.App.3d 968, 971.) Similarly, if, as Bedrossian’s argued, the SPB lacked jurisdiction to review her challenge, or if she did not receive due process, the SPB could not legally issue the order, and traditional writ relief may be available. Accordingly, the trial court reviewed the petition as a traditional writ under section 1085. “In reviewing a judgment granting or denying a writ of mandate petition [under section 1085], ‘ “we apply the substantial evidence standard of review to the court’s factual findings . . . . ” ’ [Citations] . . . [Citation.] . . . [Citation.] On questions of law, including statutory interpretation, the appellate court applies a de novo review and makes its own independent determination.” (Hayes v. Temecula Valley Unified School Dist. (2018) 21 Cal.App.5th 735, 746.)

B. Bedrossian Has Not Met Her Burden To Show the Court Erred in Denying Her Petition Bedrossian here challenges the court’s order on numerous bases, none of which we find persuasive.

1. Sufficiency of the Evidence Bedrossian appears to be contending that substantial evidence does not support the SPB’s factual findings.4 To support such an argument, she must cite evidence in the record and

4 Bedrossian’s briefing does not expressly challenge the sufficiency of the evidence to support the ALJ’s findings. Rather, it contains several factual assertions that are contrary to the ALJ’s factual findings, claims there is “no evidence of harm” without addressing the evidence presented, and argues that substantial evidence supports her version of events. (Boldface & capitalization omitted.)

10 explain its insufficiency. (See Verrazono v. Gehl Co. (2020) 50 Cal.App.5th 636, 652 [“ ‘[a]n appellant who fails to cite and discuss the evidence supporting the judgment cannot demonstrate that such evidence is insufficient’ ”].) Because Bedrossian does not cite any record support for her arguments, she has forfeited any challenge to the sufficiency of the evidence. (See ibid.; see also Shenouda v. Veterinary Medical Bd. (2018) 27 Cal.App.5th 500, 514 [“ ‘ “The appellate court is not required to search the record on its own seeking error.” [Citation.] Thus, “[i]f a party fails to support an argument with the necessary citations to the record, . . . the argument [will be] deemed to have been waived” ’ ”].)

2. Harm to Public Service Citing Skelly, supra, 15 Cal.3d 194, Bedrossian argues we must reverse and grant her petition because her failed phishing tests did not harm, or create a risk of harm to, public service. Skelly identifies “ ‘[h]arm to the public service’ ” from an employee’s conduct, or risk thereof, as a key factor in assessing whether discipline imposed for that conduct was excessive and thus an abuse of discretion. (Id. at p. 218.) We need not consider whether her actions actually resulted in harm, because we agree with the trial court that Bedrossian’s clicking links in emails containing red flags, “if repeated[,] is likely to result in, ‘[h]arm to the public service . . . ’ ” by compromising data the Fund has a fiduciary obligation to protect. (Ibid.) In addition, because “[c]ooperation among public employees is essential to the smooth functioning of public service,” Bedrossian’s discourteous behavior toward the security analyst harms the Fund’s public service efforts as well. (Caveness v. State Personnel Board (1980) 113 Cal.App.3d 617, 632; id. at pp. 631–632 [dismissal

11 for repeated discourteous behavior not an abuse of discretion because, inter alia, “refusing instruction in proper public service [is] [an] obvious example[ ] of harm” and “[d]iscourtesy to a supervisor generally injures the supervisor-employee relationship and is thus harmful to the public service”].)

3. Arguments Bedrossian Failed To Raise Before the SPB Bedrossian next argues the discipline imposed was unlawful because it was the result of fraud, entrapment, and larceny, and constitutes an unconstitutional restriction on free speech. We agree with the court below that Bedrossian forfeited these arguments by not raising them before the SPB. (See Moore v. City of Los Angeles (2007) 156 Cal.App.4th 373, 383 [agency must have an opportunity to decide the issues, and issues not raised before the agency are forfeited]; Dobos v. Voluntary Plan Administrators, Inc. (2008) 166 Cal.App.4th 678, 688 [court cannot properly grant relief on legal theory not presented in administrative proceeding].) Bedrossian contends the February 2022 email she wrote the analyst and the analyst’s supervisor accusing them of entrapping her was in evidence before the SPB, and that this is tantamount to raising the issue before the SPB. We do not agree. To avoid forfeiting a contention, a litigant must explicitly bring it to the attention of the forum.5

5 We also do not address her related argument that “[t]he ALJ . . . struck the evidence about” these forfeited arguments because she does not identify what that evidence is or provide any record support for this contention.

12 DISPOSITION The order is affirmed. Respondent State Compensation Insurance Fund shall recover its costs on appeal. NOT TO BE PUBLISHED.

ROTHSCHILD, P. J. We concur:

WEINGART, J.

M. KIM, J.