Christopher Pable v. CTA

CourtCourt of Appeals for the Seventh Circuit
DecidedJuly 28, 2025
Docket24-2572
StatusPublished

This text of Christopher Pable v. CTA (Christopher Pable v. CTA) is published on Counsel Stack Legal Research, covering Court of Appeals for the Seventh Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Christopher Pable v. CTA, (7th Cir. 2025).

Opinion

In the

United States Court of Appeals For the Seventh Circuit ____________________ No. 24-2572 CHRISTOPHER GEORGE PABLE, Plaintiff-Appellant, and

TIMOTHY A. DUFFY, Appellant,

v.

CHICAGO TRANSIT AUTHORITY and CLEVER DEVICES, LTD., Defendants-Appellees. ____________________

Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:19-cv-07868 — Robert W. Gettleman, Judge. ____________________

ARGUED APRIL 16, 2025 — DECIDED JULY 28, 2025 ____________________

Before SYKES, Chief Judge, and ST. EVE and JACKSON- AKIWUMI, Circuit Judges. JACKSON-AKIWUMI, Circuit Judge. In this appeal, an attor- ney and client seek review of the court order sanctioning both 2 No. 24-2572

of them for discovery misconduct. The case began when Christopher Pable, a software engineer with the Chicago Transit Authority (CTA), discovered a cyber-security vulner- ability. He reported the vulnerability to his supervisor, Mike Haynes, who then tested it on another city’s transit system. These events were brought to the CTA’s attention by Clever Devices, Ltd., a software development company that pro- vided the CTA with real-time transit tracking and updates. Once alerted by Clever Devices, the CTA began the process of terminating Pable and Haynes. At the time, Clever Devices had a multi-million-dollar annual contract with the CTA. After Pable was fired, he sued the CTA and Clever Devices for violating the whistleblower protections in the National Transit Systems Security Act, 6 U.S.C. § 1142. Discovery bat- tles ensued. The CTA and Clever Devices ultimately won— while still in the discovery phase. The district court awarded them six figures in expenses and dismissed Pable’s complaint based on the deletion of evidence and the misconduct of Pable’s attorney, Timothy Duffy. Pable and Duffy appeal that order. Mindful of the considerable deference we afford dis- trict courts in their decisions about discovery sanctions, we affirm. I As a software engineer with the CTA, Christopher Pable supported the agency’s implementation of the BusTime sys- tem, a real-time transit tracking application developed by Clever Devices. On August 17, 2018, Pable discovered a secu- rity vulnerability in the system: a “Skeleton Key” that granted unauthorized access to BusTime systems operated by various transit authorities and enabled the posting of public alerts to those systems. No. 24-2572 3

Pable reported the vulnerability to his supervisor, Mike Haynes, that same day. Then, at Haynes’s direction, Pable configured a test application to see if the Skeleton Key worked on another transit agency’s system. Haynes then used that test application to post a service alert to the Dayton, Ohio, Bus- Time system. The alert, which duplicated a real bridge closure notice, was automatically posted to Dayton Regional Transit Authority’s (RTA) Twitter feed. Haynes disclosed the test to Dayton RTA the next business day, August 20, and accepted full responsibility for initiating it. Dayton RTA officials ex- pressed concern but did not pursue legal action, and one rep- resentative acknowledged the test’s value in exposing the se- curity risk. The same day Haynes disclosed the test to Dayton RTA— August 20—he reported it and the Skeleton Key to Craig Lang of Clever Devices. Lang responded critically and stated that the incident had affected one of the company’s clients. More than a month later, on October 22, Clever Devices sent CTA President Dorval R. Carter Jr. a letter asserting that Haynes and Pable had “exploited” the vulnerability, breached the CTA’s contract with Clever Devices, and possibly violated state and federal laws. Lang and Clever Devices’ legal counsel later admitted under oath that they had no personal knowledge of what Pable had done and could not identify any laws or specific contract provisions that had been vio- lated. The same day CTA officials received the letter from Clever Devices, October 22, they decided to terminate Haynes and Pable. Internal emails ordering the deactivation of their em- ployee badges proved as much, referring to Pable and Duffy as the “employees that [CTA staff] are separating today.” 4 No. 24-2572

Despite this, both employees initially were told only that they were being placed on administrative leave, with no reference to the Clever Devices letter or the Skeleton Key incident. Sus- pecting that the forced leave might be related to an antici- pated Family and Medical Leave Act claim, Pable contacted two attorneys on October 29. At some point after placing Pable and Haynes on leave, the CTA notified them that they would be interviewed at CTA headquarters. On November 2, Pable and Haynes met at a Starbucks to discuss the impending interviews. Haynes testi- fied that during this meeting he decided to delete his entire conversation thread with Pable on Signal, an encrypted mes- saging application, because he thought the messages were personal and the CTA had not asked him to preserve them. Pable testified that he did not ask Haynes to delete the mes- sages, and his own messages disappeared after Haynes de- leted the thread. At the November 2 interview at CTA headquarters, notes show, Pable consistently denied conducting the Dayton test himself and said that Haynes had made that decision against his advice. In a deposition taken later, one of the interviewers, Marie Marasovich from CTA Human Resources, revealed that the CTA had already decided to terminate Pable and Haynes before the interviews commenced. She further testi- fied that, after the interview, she recommended that Pable not be fired, but she was not the final decisionmaker. Pable later sued the CTA and Clever Devices (together “the defendants”) under the National Transit Systems Secu- rity Act, 6 U.S.C. § 1142, alleging that he was terminated in retaliation for reporting a security vulnerability. The CTA re- sponded by filing a counterclaim under the Computer Fraud No. 24-2572 5

and Abuse Act, alleging that Pable had configured a “dooms- day” feature on his work computer that allowed him to wipe it remotely. 1 From there, the parties quickly descended into a protracted discovery battle that produced limited, but nota- ble, evidence. Most importantly, the parties learned that Pable and Haynes had used Signal to communicate about “what to do next” after the Dayton test. Pable testified that he used the ap- plication because it was more secure than text messaging and saved storage space on his phone. The record is silent on whether the CTA knew that Pable and Haynes were using Signal to communicate about their work or whether the CTA approved the use of Signal generally. Pable’s explanations for the deletion of his Signal mes- sages on November 2 evolved over time. Initially, Pable testi- fied that the pre-November 2 messages vanished because Haynes deleted them from Haynes’s device. The CTA dis- puted this, providing an affidavit from Signal’s Chief Operat- ing Officer stating that, at that time, one user’s deletion of spe- cific messages did not remove those same messages from an- other user’s device. Confronted with this affidavit and a re- quest for sanctions, Pable filed his own affidavit to explain that he had specially configured the Signal application on his device to delete threads when other users, like Haynes, de- leted the entire thread. He added that he enabled that

1 The district court later dismissed this counterclaim on Pable’s mo-

tion for judgment on the pleadings because it was foreclosed by Supreme Court precedent. Specifically, the district court concluded that Van Buren v. United States,

Related

Pierce v. Underwood
487 U.S. 552 (Supreme Court, 1988)
Cooter & Gell v. Hartmarx Corp.
496 U.S. 384 (Supreme Court, 1990)
Aldridge v. Forest River, Inc.
635 F.3d 870 (Seventh Circuit, 2011)
Adrianna Brown v. Columbia Sussex C
664 F.3d 182 (Seventh Circuit, 2011)
Johnson v. Gudmundsson
35 F.3d 1104 (Seventh Circuit, 1994)
United States v. Frederick J. Morgan, Sr.
384 F.3d 439 (Seventh Circuit, 2004)
Dal Pozzo, Kevin A. v. Richards Brick Co.
463 F.3d 609 (Seventh Circuit, 2006)
Goodyear Tire & Rubber Co. v. Haeger
581 U.S. 101 (Supreme Court, 2017)
Vicki Barbera v. Pearson Education, Inc.
906 F.3d 621 (Seventh Circuit, 2018)
Catherine Wanko v. Board of Trustees of Indiana U
927 F.3d 966 (Seventh Circuit, 2019)
Michael Needle, P.C. v. Cozen O'Connor
950 F.3d 481 (Seventh Circuit, 2020)
Dallas McIntosh v. Wexford Health Sources, Inc.
987 F.3d 662 (Seventh Circuit, 2021)
Van Buren v. United States
593 U.S. 374 (Supreme Court, 2021)
Houston v. C.G. Security Services, Inc.
820 F.3d 855 (Seventh Circuit, 2016)
In re TCI Ltd.
769 F.2d 441 (Seventh Circuit, 1985)
Alyssa Jones v. Riot Hospitality Group LLC
95 F.4th 730 (Ninth Circuit, 2024)

Cite This Page — Counsel Stack

Bluebook (online)
Christopher Pable v. CTA, Counsel Stack Legal Research, https://law.counselstack.com/opinion/christopher-pable-v-cta-ca7-2025.