Kenno v. Colorado Governor's Office of Information Technology

• Court: District Court, D. Colorado
• Decided: June 30, 2021
• Docket: 1:19-cv-00165
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO

Civil Action No. 19-cv-00165-MEH

YOSEPH YADESSA KENNO,

Plaintiff,

v.

COLORADO’S GOVERNOR’S OFFICE OF INFORMATION TECHNOLOGY, LYUBOV LOGACHEVA, in her individual capacity, BOB MCINTYRE, in his individual capacity, and DON WISDOM, in his individual and official capacities,

Defendants. _____________________________________________________________________________

ORDER _____________________________________________________________________________

Before the Court is Defendants’ Motion for Sanctions (“Motion”). ECF 101. Defendants allege that Plaintiff has fabricated various pieces of evidence in this case. Due to that fabrication, Defendants request dismissal of Plaintiff’s claims and an award of fees and costs. Plaintiff denies any fabrication. The Court held an evidentiary hearing on May 5 and 6, 2021. In light of the material presented both in the briefing and at the hearing, the Court issues the following Findings of Facts and Conclusions of Law. Based on those, Defendants’ Motion is granted. FINDINGS OF FACT 1. Plaintiff worked for Defendant Colorado Governor’s Office of Information Technology (“GOIT”) as a database administrator from January 2017 until GOIT terminated his employment on December 3, 2018. Exh. CCCC, ¶¶ 2–4.1

1 When the Court cites to exhibits, it does so from the evidence admitted at the hearing. These may not be the same exhibit designations as found attached to the parties’ initial briefing on the Motion. 2. Defendant Lyubov Logacheva was Plaintiff’s direct supervisor. ECF 124, Tr., 5:4– 5. Ms. Logacheva was involved in the decision to hire Plaintiff. Id. at 5:6–8. Defendant Bob McIntyre was Ms. Logacheva’s supervisor. Id. at 14:13–18. 3. From June 2018 through mid-2019 Plaintiff filed appeals with the State Personnel

Board and the Unemployment Insurance Division, and charges with the CCRD and EEOC. On January 18, 2019, Plaintiff filed this lawsuit. ECF 1. On February 12, 2019, Plaintiff filed a First Amended Complaint. ECF 5. On March 9, 2020, Plaintiff filed a Second Amended Complaint. ECF 61. On May 6, 2020, Plaintiff filed his Third Amended Complaint. ECF 71. GOIT Email and Litigation Preservation Systems 4. GOIT uses Google Suite applications, including Gmail, Google Drive, and Google Vault. Testimony of Lilo Santos. 5. Between 2017 and 2019, GOIT did not have a mechanism for the automatic deletion or purging of emails after a certain period. Exh. AAAA, ¶ 6; Testimony of Mr. Santos. 6. Google Vault is a platform that, among other things, preserves state email and other

types of accounts and allows for Google Vault administrators to search through users’ accounts. Testimony of Mr. Santos. 7. An administrator cannot delete, alter, change, or send emails from those users’ accounts using Google Vault. Id.; Exh. AAAA, ¶ 7. Only a user can delete emails from his or her GOIT email account. Exh. AAAA, ¶ 7. 8. Google Vault preserves emails through litigation holds. Testimony of Mr. Santos. Once a litigation hold is in place on a user’s account, no one can delete emails from the preserved hold in Google Vault. Id.; Exh. AAAA, ¶ 7. 9. Prior to August 2018, a litigation hold was in place on Plaintiff’s GOIT email account. Testimony of Mr. Santos; Exh. HH, ¶ 5. Oracle Cloud Project 10. In late 2017, Plaintiff volunteered for a project to evaluate Oracle Cloud. ECF 124,

Tr., 5:22–6:2; Exh. 14, 69:16–21. His Caucasian coworker, Curtis Stierwalt, was assigned to the project in a secondary role. ECF 124, Tr., 6:2–11; Exh. 14, 40:23–25, 69:21–70:5. Plaintiff was responsible for meeting the project deadlines. Exh. I, 40–41; Exh. 14, 72:21–73:2, 76:6–10. 11. Ms. Logacheva set a deadline of January 5, 2018 for Plaintiff to deliver a set of guidelines for the team on how to use Oracle Cloud. ECF 124, Tr., 6:19–23. 12. On January 5, 2018, Plaintiff and Mr. Stierwalt spoke on the phone about the document due that day. Exh. MMM.2 Plaintiff recorded the phone call on his personal cell phone. ECF 125, Tr. 224:4–15. Plaintiff stated he did so using an application called “ACR Call Recorder.” Id. at 224:14–16; Exh. A, 17. 13. Ms. Logacheva never directly or remotely accessed Plaintiff’s cell phone. ECF 124,

Tr. 17:1–6. Plaintiff never provided Ms. Logacheva with any audio recordings. Id. at 16:23–25. 14. On January 5, 2018, at 2:31 p.m., Plaintiff emailed Ms. Logacheva a Google Drive link to a document titled “Oracle Cloud – Usage Guidelines(Draft).” Exh. JJJ. In this email, Plaintiff wrote: Lyubov, Thats our initial draft ready. Because its Friday, my suggestion for you to chillax and not be bothered with it til Monday. Fridays are for peace and harmony; no one has got time to open a document and be disappointed. Ya know what mean. Come

2 Exhibit MMM is part of the evidence alleged by Defendants to have been fabricated or manipulated by Plaintiff. Monday, I think you will thoroughly refreshed by it. So, wait until Monday . . . is my suggestion.

Yoseph Kenno Database Administrator

Id. (errors in original). 15. Ms. Logacheva did open the document on January 5, 2018 and found it unsatisfactory. ECF 124, Tr., 6:24–7:4, 10:17–22; 11:17–19. HSA Contribution Problem 16. Sometime in late 2017, Plaintiff discovered an issue with his Health Savings Account (HSA). Exh. BB, 9; Exh. CCCC, ¶ 9. Specifically, GOIT’s portion of the contributions were being accounted for on Plaintiff’s paycheck but were not actually being distributed into his HSA. ECF 124, Tr., 122:15–22. 17. Plaintiff worked with the State Benefits team, which is part of the Department of Personnel and Administration, on this issue. The team used the email address state_benefits@state.co.us to communicate on the problem. Exh. BB, 8–9; Exh. CCCC, ¶ 9. On February 23, 2018, after the issue had not yet been resolved, Plaintiff emailed Ms. Logacheva and Mr. McIntyre, requesting assistance. Exh. BB, 7; Exh. CCCC, ¶ 10. 18. Mr. McIntyre referred Plaintiff to Holly Bruton, GOIT’s Senior Human Resources Coordinator. Exh. BB, 7; Exh. CCCC, ¶ 10. Ms. Logacheva did not respond to Plaintiff’s email at that time, as she was on vacation. ECF 124, Tr., 17:16–18:10. 19. Plaintiff never again emailed Ms. Logacheva directly about his HSA, and Ms. Logacheva never emailed Plaintiff about his HSA. Id. at 18:25–19:14, 19:25–20:5, 39:6–8. 20. On February 27, 2018, Ms. Bruton contacted the State Benefits team about the missing HSA contributions. Exh. BB, 4. 21. On March 2, 2018, State Benefits emailed Plaintiff informing him that the problem had been corrected and the missing contributions would be deposited into his HSA at the end of the month. Id. at 1. Plaintiff replied that day, stating, “Perfect. Thank you.” Id.; Exh. CCCC, ¶ 11. This email appears to be Plaintiff’s last communication with State Benefits. Exh. BB, 1.

22. Plaintiff never met any State Benefits team member face-to-face. Exh. CCCC, ¶ 12; ECF 125, Tr. 192:9–11. 23. Upon returning from vacation, Ms. Logacheva received a request from Mr. McIntyre for her to speak to Plaintiff about his behavior toward, and communication with, a member of GOIT’s HR team. ECF 124, Tr., 22:22–23:11, 35:14–25. Ms. Logacheva understood that Mr. McIntyre stated Plaintiff had been rude to the employee regarding some benefits related issue. Id. at 35:14–36:4. 24. On March 13, 2018, during a one-on-one meeting, Ms. Logacheva complied with Mr. McIntyre’s request and spoke to Plaintiff about his communication with GOIT’s HR. Id. at 22:22–23:11; Exh. 1.

2018 Performance Management Actions and Discrimination Claim 25. On April 13, 2018, Ms. Logacheva released Plaintiff’s written annual performance evaluation to him to review and sign. ECF 124, Tr.,12:4–11; Exh. CC, 2; Exh. CCCC, ¶ 13. Plaintiff was rated overall as “Successful” or “2,” but was rated as “Needs Improvement” or “1” in some areas, including communication and accountability. ECF 124, Tr., 12:21–13:9. 26. Plaintiff’s failure to meet the January 5, 2018 deadline related to the Oracle Cloud project was one reason why Plaintiff was poorly rated as to accountability. Id. at 13:6–18. 27. Ms. Logacheva stated in the performance evaluation that Plaintiff was still not demonstrating appropriate work conduct and not understanding the importance of meeting deadlines. Exh. CC, 1–2. In an email exchange, Plaintiff disagreed with this language and asked for specifics. Id. at 2. 28. Ms. Logacheva replied with examples of unprofessional communication including Plaintiff’s behavior toward GOIT’s HR, on which she counseled him on March 13, 2018. Id. at 1;

ECF 124, Tr., 23:17–24:22. Plaintiff replied, stating, “HR admitted fault in their attempt to discriminate against me by not paying me what I [sic] was rightfully mine.” Exh. CC, 1. 29. After Plaintiff disputed his performance evaluation, Mr. McIntyre asked Ms. Logacheva to change some wording in the review. ECF 124, Tr., 40:24–41:4. 30. On May 18, 2018, Plaintiff complained about a new work requirement (“time- reporting requirement”) he believed was “nakedly unjust.” Exh. LL, 5. This time-reporting requirement applied to Plaintiff and other coworkers who worked on Oracle databases. Exh. I, 42–44. 31. Because Plaintiff’s performance as to his communication and accountability had not improved, on May 31, 2018, Ms. Logacheva, after consulting with Mr. McIntyre, informed

Plaintiff he would no longer be permitted to work from home and that he would be placed on a performance improvement plan (“PIP”). ECF 124, Tr., 13:19–14:2, 26:23–27:11. 32. On June 11, 2018, Plaintiff was placed on a PIP. Exh. CCCC, ¶ 34; Exh. 5. The PIP listed examples of Plaintiff’s inadequate performance, including the missed January 5, 2018 Oracle Cloud project deadline. Exh. 5, 2. Ms. Logacheva also included the manner in which Plaintiff behaved while raising a claim of discrimination against HR on April 13, 2018. Id. 33. On July 10, 2018, Plaintiff sent an email to several GOIT employees, including John Bartley, with the subject “A new low” that contained a Google Drive link to a video. Exh. WWW; Exh. GG, 5; Exh. ZZZ, ¶ 4. 34. That same date, Plaintiff was placed on administrative leave. Exh. CCCC, ¶ 35. As of that date, Plaintiff no longer had access to his GOIT Gmail account or Google Drive. Id. 35. On July 17, 2018, Mr. Bartley forwarded the “A new low” email to the Attorney General’s office. Exh. WWW; Exh. ZZZ, ¶ 4. The video link in the email was a Google Drive

link: https://drive.google.com/open?id=1-jD-smsSFEhY1FiQo-4DDQnDxPNv1A5T. Exh. WWW; Exh. ZZZ, ¶ 4. 36. On July 19, 2018, Plaintiff forwarded the “A new low” email to submit an informal grievance to Mr. McIntyre and to inform Mr. Bartley that Plaintiff had filed a charge of discrimination with the Board. Exh. XXX. The video link in that email is a YouTube link rather than a Google Drive link: https://youtu.be/iL8rk7F6Wgc. Id. 37. On August 2, 2018, Don Wisdom held a pre-disciplinary meeting with Plaintiff. Exh. GG, 2; Exh. VVV, 2. After that meeting, Plaintiff requested GOIT provide him, in a PST file, emails from his GOIT account dated May 18, 2018 to July 11, 2018. Exh. GG, 2; Exh. VVV, 2; ECF 124, Tr., 65:22–66:6. He did not ask for emails from March 2018. Id.

38. OIT’s Active Directory team delivered the requested emails, and Mr. Bartley sent them to Plaintiff via a Google Drive link. Exh. YYY; Exh. TTT; Exh. UUU; Exh. VVV; Exh. ZZZ, ¶¶ 7–9; Exh. CCCC, ¶ 36. GOIT Internal Discrimination Investigation 39. In June 2018, Plaintiff made a claim to HR alleging that the removal of his work- from-home privileges and his PIP were in retaliation for his complaint on May 18, 2018, regarding the time-reporting requirement. Exh. I, 42, 45. Mr. Bartley, then a GOIT HR Business Partner, conducted an investigation into Plaintiff’s claims. Id. at 37. 40. During the investigation, Plaintiff alleged that Ms. Logacheva discriminated against him by citing his failure to meet the Oracle Cloud project deadlines in his performance review, while his Caucasian coworker, Mr. Stierwalt, was not similarly disciplined. Id. at 40 41. On June 28, 2018, Mr. Bartley issued a report of his investigation findings

concluding that GOIT did not discriminate or retaliate against Plaintiff. Id. 37–46. The report noted that only Plaintiff was disciplined for missing the Oracle Cloud project deadlines because Mr. Stierwalt was assigned to the project in a secondary or backup role. Id. at 40–41. 42. Plaintiff received a copy of Mr. Bartley’s report and later submitted it to the CCRD. ECF 124, Tr., 57:1–58:4; Exh. I, 37–46. CCRD Investigation 43. Plaintiff filed three charges of discrimination and retaliation with the CCRD. Exh. CCCC, ¶ 17. Each charge was assigned a case number within CCRD’s case management system, Case Connect. Exh. LL, 1, 7, 10; Exh. EE, ¶ 4; Exh. BBBB, ¶¶ 3, 9. 44. Within Case Connect, documents and files can be uploaded or downloaded. Exh.

BBBB. Only a document’s owner—the person who uploaded it—can view or download the document. Id. at ¶ 12. 45. On June 7, 2018, Plaintiff uploaded a document titled, “State.co.us Executive Branch Mail – Follow-up on our Team meeting.” Exh. LL, 2; Exh. BBBB, ¶ 10. Included in the chain is an email from Plaintiff to Ms. Logacheva dated May 18, 2018 at 9:42 a.m. Exh. LL at 6. In this email, Plaintiff complains about the new time-reporting requirement. Id. Plaintiff did not upload the March 19-20, 2018 HSA emails which are the subject of Defendants’ Motion. 46. CCRD Intake Specialist Anna Hughes assisted Plaintiff with filing the charges. ECF 124, Tr. 142:19–21. Plaintiff’s first charge of discrimination incorrectly stated, as contemporaneously admitted by Plaintiff, that his first protected activity occurred in March 2018. Exh. EE, ¶ 5; Exh. TT. 47. Ms. Hughes and Plaintiff spoke on the phone on June 12, 2018. Exh. KKK; Exh. FFF; Exh. CCCC, ¶ 38. During the call, Plaintiff stated he initially complained of discrimination

on May 18, 2018 based on new work requirements. Exh. KKK, 1. Plaintiff did not mention State Benefits, or anything related to his HSA or the HSA emails. Id. 48. On June 14, 2018, at 3:08 p.m., Ms. Hughes emailed Plaintiff asking him to forward any documentation pertinent to his claims of discrimination. Exh. LLL; Exh. FFF. Plaintiff responded at 3:16 p.m. and attached some “SPD” and EEOC paperwork. Id. 49. On October 31, 2018, Plaintiff submitted numerous files, including several audio files, to the CCRD in support of his claims of discrimination and retaliation. Exh. LL, 1. 50. One of these files was titled “Exhibit-R2 Curtis Stierwalt_7204281698_2018_01_05_14_34_03.mp3.” Id; Exh. MMM. 51. On June 12, 2019, Plaintiff spoke for approximately three hours with CCRD

Investigator Megan Bench regarding his discrimination and retaliation claims. Exh. EE, ¶ 5; Exh. OO; Exh. FFF; Exh. CCCC, ¶ 18. Plaintiff surreptitiously recorded the call and informed Ms. Bench of that fact afterwards. Exh. PP, 1–3; Exh. FFF; Exh. CCCC, ¶ 18. 52. Plaintiff told Ms. Bench he would not provide her with a copy of the recording unless he could review it and then provide it under his “terms.” Exh. PP, 1–3. When GOIT requested a copy of the June 12, 2019 recorded phone call, Plaintiff claimed it was no longer available because the phone on which it was recorded had been sent to Ethiopia. ECF 125, Tr. 199:15–25. 53. During the call, and in a subsequent email exchange, Ms. Bench told Plaintiff that, because he did not raise any discrimination complaints with GOIT prior to being informed of performance problems at least as of April 2018, his retaliation claim did not appear to have merit. Exh. PP, 7–8.

54. On the call, Plaintiff told Ms. Bench that his first protected activity occurred in May 2018, not March 2018. ECF 125, Tr. 195:19–196:2; Exh. EE, ¶¶ 5, 7; Exh. OO, 2–3; Exh. CCCC, ¶¶ 18–19. In an email dated June 13, 2019, Ms. Bench reiterated Plaintiff’s statement that the first protected activity occurred in May 2018, after he was aware of performance issues. Exh. PP, 6– 7. 55. On July 1, 2019, Ms. Bench stated that Plaintiff had provided edited audio and video recordings to the CCRD. Exh. PP, 2. 56. On June 28, 2019, Plaintiff sent an email from his personal Gmail account, yosephkenno@gmail.com, to Ms. Bench. Exh. H; Exh. EE, ¶ 8. This email contained a Google Drive link to a 432-page PDF document titled “Supplemental Response2 Final,” which was a

fifteen-page rebuttal statement with over 400 pages of exhibits attached. Exh. H; Exh. EE, ¶ 8; Exh. FFF. 57. Plaintiff admits he emailed this document to Ms. Bench via a Google Drive link. ECF 125, Tr., 164:17–21. 58. Ms. Bench accessed the Google Drive link on June 28, 2019 and downloaded a copy of the 432-page document (“Original PDF Document”). Exh. EE, ¶ 8; Exh. I; Exh. BBBB, ¶ 7; Exh. FFF. That day, she uploaded the Original PDF Document to Case Connect. Exh. BBBB, ¶¶ 5–8. 59. Because Ms. Bench uploaded the Original PDF Document to Case Connect, she was the document’s “owner.” Exh. LL, 1, 7, 10; Exh. BBBB, ¶ 6. Only she, as the document’s owner, could view or download the document from Case Connect. Exh. BBBB, ¶ 12. Events Leading to Discovery of Alleged Fabricated and Manipulated Evidence

60. On August 23, 2019, as part of his mandatory disclosures, Plaintiff disclosed several audio and video files and numerous emails in PDF format. Exh. QQ. 61. GOIT investigated Plaintiff’s disclosures and suspected some audio and video files and emails had been fabricated or manipulated. Exh. RR, 10, 13. 62. Exhibit MMM was one file GOIT believed had been manipulated. Testimony of Angela Malley; Exh. FF, 2. 63. Plaintiff’s August 23, 2019 mandatory disclosures included the March 19-20, 2018 email exchange between Plaintiff and Ms. Logacheva concerning Plaintiff’s HSA contributions (“HSA Emails”), Bates labeled Kenno_1282 (“Discovery Version”). GOIT could not locate this email exchange in its preserved emails. ECF 125, Tr. 204:18–205:2; Testimony of Mr. Santos;

Testimony of Sara McDermott; Exh. E; Exh. QQ. 64. The March 19, 2018 email, purportedly sent from Plaintiff to Ms. Logacheva stated: Lyubov, I just got off the phone with these benefits people. After promising to contributing to my HSA, they are now saying they can’t do it. This is maddening because I have been trying to get them to contribution to my HSA for 8 months now. During the call, they told me how their dept doesn’t doll out welfare checks. I wasn’t asking for welfare. They were snickering too after telling me this. They wouldn’t have mentioned welfare if I wasn’t a black guy. I want to be treated fairly, just like everyone else. So, unless these people do the right thing, I’ll submit a discrimination grievance on them. This is so demeaning. Yoseph Kenno Database Administrator Exh. E (errors in original). 65. The email dated March 20, 2018, purportedly Ms. Logacheva’s response to Plaintiff’s March 19th email, read: Yoseph, Your should remember this is a workplace. Your communication should always be respectful to everyone, most importantly, to your supervisor. I am certain they were not discriminating against you. May be you misunderstood? You can contact OIT HR for help. Please follow the OIT Values described in your performance plan when communicating with HR and refrain from making similar accusations going forward. Thank you,

Lyubov Logacheva Database Services Manager For Oracle, Informix, Adabas Id. (errors in original). 66. Mr. Santos conducted a search of Plaintiff’s GOIT email account and Ms. Logacheva’s email account using the keywords “HSA,” “welfare,” and “demeaning.” Exh. HH, ¶ 6. None of these searches returned the HSA emails at issue in this case. Testimony of Mr. Santos; Exh. HH, ¶ 6. A search for just “HSA” did return other emails related to Plaintiff’s HSA contributions, dated January and February 2018. Testimony of Mr. Santos; Exh. HH, ¶ 6; Exh. AAA. 67. Ms. Logacheva also searched her email account for emails containing the term “HSA.” ECF 124, Tr., 20:18–21:1. This search returned emails dated February 2018. Id. It did not return the March 19-20, 2018 HSA email exchange produced by Plaintiff. Id. 68. Though he claimed that his termination was discriminatory, Plaintiff did not submit the HSA Emails as evidence in hearings regarding his unemployment claim. Exh. NN. 69. Instead, Plaintiff repeatedly identified the May 18, 2018 email as his first protected conduct. Exh. CCCC, ¶¶ 14–16; Exh. MM; Exh. NN. An example of this was the timeline made by Plaintiff that he submitted to his unemployment hearing officer. ECF 101-20. He also explicitly stated that Ms. Logacheva first retaliated against him on May 31, 2018 and by issuing the PIP in

response to his May 18, 2018 protected activity. Exh. NN. 70. On December 17, 2019, GOIT retained Forensic Pursuit to forensically analyze Plaintiff’s personal laptop, cell phone, and individual files. Exh. A, 6; Testimony of Ms. McDermott; Testimony of Ms. Malley. 71. Plaintiff retained Cyopsis to perform certain forensic analysis. ECF 124, Tr. 75:9– 76:6. 72. In January 2020, GOIT filed a motion to compel inspection of Plaintiff’s personal Samsung Galaxy S8 cell phone and Dell XPS laptop in the state administrative case, putting Plaintiff on notice that GOIT had concerns that he had fabricated emails. Exh. CCCC, ¶ 21. 73. On February 20, 2020, Plaintiff produced some emails in native format, including

the March 19-20, 2018 email exchange regarding the HSA contributions (“First MSG Version”). Exh. B; Exh. CCCC, ¶ 22. 74. The First MSG Version of the HSA emails has several differences from the Discovery Version, including spacing, grammar, and spelling errors. Compare Exh. B with Exh. E; see Exh. AA. This version also shows that the email purportedly sent from Plaintiff to Ms. Logacheva was sent on Monday, March 18, 2018. Exh. B. March 18, 2018 was in fact a Sunday. 75. In February 2020, GOIT submitted a Colorado Open Records Act (“CORA”) request to the CCRD, requesting the entire case file for Plaintiff’s charges of discrimination. See Exh. WW. The CCRD case file contained another PDF version of the HSA emails (“CCRD Version”). Exh. C. In the CCRD version, the email purportedly sent from Plaintiff to Ms. Logacheva, dated March 19, 2018, showed it was sent from the email address “state_benefits@state.co.us.” Id. 76. The CCRD Version was submitted to the CCRD by Plaintiff on June 28, 2019 as

part of the 432-page PDF document titled “Supplemental Response2 Final.” Exh. I, 61. 77. Plaintiff claims he preserved, or downloaded and saved, the First MSG Version, but not the Discovery or CCRD Versions, to his personal computer. ECF 125, Tr. 166:8–14. 78. In April 2020, GOIT filed a motion to compel inspection of Plaintiff’s personal cell phone and laptop in this Court. Exh. RR. Plaintiff understood at that time that GOIT alleged he had fabricated the HSA Emails specifically. Exh. CCCC, ¶ 24. 79. In February 2020, Forensic Pursuit obtained forensic images of Plaintiff’s laptop and cell phone. Exh. A, 7. In July 2020, Forensic Pursuit reacquired complete forensic images of the laptop. Id. at 19–20, 24. Evidence that the system date and time had been manually changed was found on the laptop. Id. at 29–30.

80. Several emails, including the First MSG Version, were located on the laptop. Id. at 7, 36. The Allegedly Fabricated Audio (Exhibit MMM) 81. Exhibit MMM was found on Plaintiff’s laptop as an .mp3 file. Exh. A, 34; Testimony of Ms. Malley. 82. Ms. Malley forensically analyzed Exhibit MMM and found evidence of fabrication. Exh. FF; Testimony of Ms. Malley. 83. At approximately the 01:03.115 mark, a “blip” can be heard in the audio without the assistance of any forensic or other auditory analysis tools. Exh. FF, 3; Testimony of Ms. Malley. A second blip can be heard at 01:20.636. Exh. FF, 3; Testimony of Ms. Malley. 84. From 01:03.115 to 01:20.636, there are inconsistencies in the timbre and content of

that section. Exh. FF, 3. A shift in the audio spectrum also occurs containing a higher volume of lower frequencies than the rest of the recording. Id.; Testimony of Ms. Malley. The audio spectrum in this section contains changes in the decibels, suggesting it was recorded in a different location or at a different time than the rest of the audio. Exh. FF, 3–7; Testimony of Ms. Malley. 85. The blips can visually be seen using an industry-standard audio analysis tool called Izotope. Testimony of Ms. Malley; Exh. GGG. 86. Additionally, in between the two blips, even without the assistance of any audio analysis tool, it is apparent that there is no background noise, and Mr. Stierwalt makes no sounds whatsoever. Exh. MMM. 87. The EXIF metadata for Exh. MMM indicates an encoder, LAME3.99r, was used

on the file. Exh. FF, 2; Testimony of Ms. Malley. The encoder LAME is also associated with Audacity, an audio editing program that is free to the public. Exh. OOO, 12–17; Testimony of Ms. Malley. LAME is not associated with ACR and does not appear in the metadata of a file created using ACR. Testimony of Ms. Malley; Exh. OOO, 2. 88. Ms. Malley’s forensic analysis indicates that the audible, visual, and forensic difference between the audio section found at 1:03–1:20, coupled with metadata of Exhibit MMM revealing that it was created using an audio editing tool, Audacity, demonstrate to a reasonable degree of scientific certainty that section 1:03–1:20 of Exhibit MMM was recorded on a different date or in a different location than the rest of the audio file. Testimony of Ms. Malley; Exh. PPP. Litigation Regarding Alleged Fabricated and Manipulated Evidence 89. In a Second Supplemental Disclosure dated September 2020, Plaintiff produced multiple versions of the 432-page PDF document, “Supplemental Response2 Final,” that Plaintiff supposedly submitted to the CCRD on June 28, 2019. See Exh. XX.

90. In October 2020, GOIT filed a Motion for Sanctions with the Board seeking dismissal of Plaintiff’s appeals with prejudice and an award of fees and costs. Order Granting Respondent’s Motion for Sanctions; Order of Dismissal and Notice of Appeal Rights (“ALJ Order”). Plaintiff’s Fourth Supplemental Disclosures and Expert Analysis 91. On December 1, 2020, Plaintiff served his Fourth Supplemental Disclosures, including two native emails allegedly sent from Plaintiff to the CCRD. Exh. CCC; Exh. CCCC, ¶ 29. Ms. McDermott, of Forensic Pursuit, forensically analyzed the emails in Plaintiff’s Fourth Supplemental disclosures to determine whether they were authentic. Exh. G, 5–6; Testimony of Ms. McDermott.

92. The first email in Plaintiff’s Fourth Supplemental Disclosures, dated June 28, 2019, 12:02 p.m., purported to be the email Plaintiff sent to Ms. Bench by which he submitted the “Supplemental Response2 Final” PDF document (“Plaintiff’s June 28th Email”). Exh. O; Exh. CCCC, ¶ 30. 93. Plaintiff’s June 28th Email has a PDF attachment titled “Supplemental Response2 Final” and appears to have Google Drink link that connects to a document with the same title. Exh. O. However, the link is broken. Testimony of Ms. McDermott; Exh. A, 103. The only way this link could be broken is through user manipulation. Testimony of Ms. McDermott; Exh. G, 22 94. The header of Plaintiff’s June 28th Email contains four different dates, with the received date falling thirteen months after the email was purportedly sent. Testimony of Ms. McDermott; Exh. G, 18–19; Exh. X. The additional dates are not consistent with an authentic email. Testimony of Ms. McDermott; Exh. G, 19.

95. The email’s header also indicates the email was received by “gmail.api.google.com” or Google API. Testimony of. Ms. McDermott; Exh. G, 19; Exh. X. Google API is a developer mode for programmers and/or coders, allowing for command line instructions to send emails, upload attachments, and modify content. Testimony of Ms. McDermott; Exh. G, 19, 44. Google API can be used to manipulate emails. Testimony of Ms. McDermott. 96. Forensic Pursuit requested that the CCRD directly send it the original email received by Ms. Bench on June 28, 2019. Testimony of Ms. McDermott; Exh. G, 5. Ms. McDermott analyzed this email (hereafter, “Original and Authentic June 28th Email”). Testimony of Ms. McDermott; Ex. G, 5–12. 97. The header of the Original and Authentic June 28th Email contains a sent date and

time of June 28, 2019, 12:02:24 p.m., and a received date and time of June 28, 2019, 12:02:43 p.m. Exh. W. The short time between when this email was sent and when it was received is consistent with an authentic email. Exh. G, 1, 7; Testimony of Ms. McDermott. 98. The header of the Original and Authentic June 28th Email does not contain evidence of Google API. Testimony of Ms. McDermott; Exh. G, 1, 10. 99. The Original and Authentic June 28th Email contains an active Google Drive link to a document titled “Supplemental Response2 Final.” It does not have a PDF attachment. Exh. G, 1-2, 12; Exh. H; Testimony of Ms. McDermott. 100. Forensic Pursuit also compared the original “Supplemental Response2 Final” sent to the CCRD with the one attached to the email in Plaintiff’s Fourth Supplemental Disclosures. Testimony of Ms. McDermott. 101. The version sent to the CCRD contained thirty-nine user comments by the user

“yosep” and an embedded audio file. Testimony of Ms. McDermott; Exh. G, 12. The HSA emails on page 61 matches the CCRD Version and lists the sender’s address as state_benefits@state.co.us. Compare Exh. C with Exh. I, 61. On the other hand, the PDF attached to Plaintiff’s June 28th email had no user comments, no embedded files, and contained the HSA Emails on page 61 showing the March 19, 2018 email was sent by Plaintiff. Testimony of Ms. McDermott; Exh. G, 24–25; Exh. Q. 102. On December 14, 2020, Ms. McDermott accessed the Google Drive link in the Original and Authentic June 28th Email. Testimony of Ms. McDermott; Exh. G, 15. She noted that the document had a recorded owner of Yoseph Kenno and a last modify date of October 22, 2020. Testimony of Ms. McDermott; Exh. G, 15. This date indicates that someone made changes to the

document after it was sent to Ms. Bench on June 28, 2019. Testimony of Ms. McDermott; Exh. G, 15. The HSA email in the Google Drive link PDF document matched the version produced by Plaintiff on December 1, 2020, in that the sender’s email address had been fixed on page 61. 103. On December 29, 2020, Plaintiff’s expert, Cyopsis, sent an email dated June 28, 2019 to Forensic Pursuit in a zip file. Testimony of Ms. McDermott; Exh. G, 6, 26; Exh. R; Exh. CCCC, ¶ 41. Ms. McDermott forensically analyzed this email (“Cyopsis’ June 28th Email”). Testimony of Ms. McDermott; Exh. G, 26–29. 104. Cyopsis’ June 28th Email contained an active Google Drive link and did not have a PDF attachment. Testimony of Ms. McDermott; Exh. G, 29; Exh. R; Exh. CCCC, ¶ 41. 105. Ms. McDermott accessed the Google Drive link in Cyopsis’ June 28th Email. Testimony of Ms. McDermott; Exh. G, 29. The link took her to the same URL as the link contained in the Original and Authentic June 28th Email. Testimony of Ms. McDermott; Exh. G, 29. She analyzed the PDF document found at that URL. Testimony of Ms. McDermott; Exh. G, 29.

106. Ms. McDermott noted the document was 432-pages long, had a recorded owner of Yoseph Kenno, and a last modify date of December 23, 2020. Testimony of Ms. McDermott; Exh. G, 29. The document contained no user comments, had no embedded audio player or file, and contained a version of the HSA emails that matched the Discovery Version. Testimony of Ms. McDermott; Exh. G, 29. 107. The header of Cyopsis’ June 28th Email contains several header dates, including a received date that was thirteen months after the sent date. Exh. Y. The additional dates are not consistent with an authentic email. Testimony of Ms. McDermott; Ex. G, 31. The additional dates are also associated with Google API, in the same way as Plaintiff’s June 28th Email. Exh. Y. 108. The second email contained in Plaintiff’s Fourth Supplemental Disclosures, dated

June 14, 2018, 3:22 p.m., purported to be an email Plaintiff sent to Ms. Hughes (“June 14th Email”). Exh. DDD; Exh. CCCC, ¶ 32. 109. The June 14th Email was not located on Plaintiff’s laptop. Exh. A, 107. This email is not located in CCRD’s case files for Plaintiff’s charges of discrimination. Exh. LLL. 110. Attached to the June 14th Email was a zip file containing two additional native format (MSG) emails, one of which is another version of the HSA emails (“Second MSG Version”). Exh. DDD; Exh. U. 111. The header of the Second MSG Version indicates the email was addressed “To” lyubov.logacheva@state.co.us but was “Delivered To” yoseph.kenno@state.co.us. Exh. Z. This discrepancy is not consistent with an authentic email. Testimony of Ms. McDermott; Exh. G, 32. 112. Based on her analysis of several versions of the HSA emails, Ms. McDermott

concluded to a reasonable degree of scientific certainty that Plaintiff fabricated the HSA email and manipulated the June 28th Emails that Plaintiff had produced. Testimony of Ms. McDermott. 113. Plaintiff’s expert, Francis Brackin of Cyopsis, concluded that the First MSG Version was authentic. ECF 124, Tr., 85:22–86:1. However, Mr. Brackin did not analyze any other version of the HSA Emails and could not explain why the versions differed. Id. at 76:11–19, 104:18–105:5. Mr. Brackin’s methods of authentication cannot determine whether the First MSG Version was actually sent. Testimony of Ms. McDermott. 114. As to the wrong date in the First MSG Version, Mr. Brackin’s report suggested that Ms. Logacheva could have changed the date of the email supposedly sent by Plaintiff when she replied on March 20, 2018. But Mr. Brackin admitted that this theory cannot explain why the PDF

versions of this email produced to the CCRD and in discovery have the corrected date. Nor could he explain the error in the sender’s email address in the CCRD Version. Testimony of Mr. Brackin. 115. Mr. Brackin could not explain how Cyopsis’ June 28th Email could be authentic and have four dates in the header. ECF 124, Tr., 103:12–18. He also could not explain why Plaintiff’s version differed from the Original and Authentic June 28th Email. Id. at 104:8–17. 116. Emails that appear authentic both visually in native format and forensically from analysis of their headers can be easily manipulated using free software that comes preinstalled on Windows computers. Testimony of Ms. McDermott; Exh. A, 93; Exh. III. A fabricated email will even pass traditional email authentication tools, making it appear as though the email was sent and received. Testimony of Ms. McDermott; Exh. III. Alleged Fraudulent Google Emails 117. On November 18, 2020, a domain titled “internal-gsuites-recovery.co” was created.

See Exh. KK; Exh. QQQ. An email address named gmail_recovery_admin@internal-gsuites- recovery.co was also created. See Exh. KK; Exh. QQQ. 118. Although the domain name and email address appear to be a Google administrative recovery account, Google LLC verified neither was associated with any Google corporate accounts. Exh. JJ, ¶¶ 2–3; Exh. KK. 119. From November 18 through November 23, 2020, Plaintiff, through his former counsel, requested that GOIT run live searches of his state email account. Exh. ZZ, 1, 12. 120. Defendants’ counsel discussed this with Mr. Santos and confirmed that searches could be run. Mr. Santos did not receive confirmation that the searches would be run until December 7, 2020. Testimony of Mr. Santos; Exh. HH, ¶ 8. Mr. Santos was not told the specific

search terms and date parameters that would be used until December 9, 2020. Exh. HH, ¶ 8. 121. On December 9, 2020, Plaintiff, his former counsel, and GOIT’s counsel remotely observed Mr. Santos conduct the searches of Plaintiff’s GOIT email account via Google Vault based on the agreed upon parameters. Exh. AAA; Exh. CCCC, ¶ 40. The remote searches were recorded. Exh. AAA; Exh. CCCC, ¶ 40. 122. During the searches, Plaintiff objected to the timeframe parameters and requested the searches include emails through the present date. Exh. AAA; Exh. CCCC, ¶ 40. 123. Plaintiff terminated the remote live searches when Defendants refused to deviate from the agreed upon search parameters. Exh. AAA. That day, GOIT searched Plaintiff’s email account with no time limitations. Testimony of Mr. Santos; Exh. HH, ¶ 11. This searched returned a large number of emails from 2020. Id. 124. Between November 30, 2020 and December 3, 2020, over 1,700 emails were sent from gmail_recovery_admin@internal-gsuites-recovery.co to Plaintiff’s state email. Testimony of

Mr. Santos; Exh. HH, ¶ 11. Each email contained a subject beginning with “Email Archive Recovery” and purported to be “recovering” an email supposedly previously deleted. E.g., Exh. II. 125. The header of some of these emails indicated they were sent using Google API. Exh. KK, 4. 126. One of the “recovery” emails was the purported March 19-20, 2018 HSA email exchange. Exh. II. 127. Google LLC verified it does not have a process for recovering emails in this manner. Exh. JJ, ¶¶ 2–3. 128. Defendants subpoenaed Google LLC for information related to the internal-gsuites- recovery.co domain created on November 18, 2020. Testimony of Mr. Santos; Exh. HH, ¶ 13.

Google’s responsive documents indicated Mr. Santos was identified as the creator of the domain, and registered it using the email address lilosantaanagelo@gmail.com, which was also created on November 18, 2020. Exh. QQQ; Exh. RRR; Exh. SSS. 129. Mr. Santos does not have an email address lilosantaangelo@gmail.com and his last name is not “Santaangelo.” Testimony of Mr. Santos; Exh. HH, ¶ 14. Mr. Santos did not create the domain internal-gsuites-recovery.co or the email addresses gmail_recovery_admin@internal- gsuites-recovery.co and lilosantaangelo@gmail.com. Id. State Personnel Board Hearing 130. On April 7-9, 2021, a State Personnel Board ALJ presided over an evidentiary hearing on GOIT’s Motion for Sanctions. ALJ Order. 131. On May 3, 2021, the ALJ concluded that Plaintiff fabricated the HSA emails and

created the fraudulent Google recovery emails in an attempt to cover up his initial fabrication. Id. at 7, 9. The ALJ dismissed Plaintiff’s case with prejudice and awarded GOIT its reasonable attorney fees and costs related to the fabrication. Id. at 9–11. ANALYSIS A. Preliminary Matters Before the Court proceeds to the merit of Defendants’ Motion, it is necessary to address two preliminary matters. First, Defendants requested this Court take judicial notice of the State Personnel Board ALJ’s proceedings and decision in this matter. Second, Plaintiff has moved to strike a portion of Ms. McDermott’s testimony regarding the June 14th Email. The Court will address these in turn.

1. Judicial Notice At the conclusion of the evidentiary hearing, the Court directed the parties to file cross briefs on what preclusive effect, if any, the State Personnel Board’s proceedings would have on this case. The parties filed their briefs on May 26, 2021. ECF 122, 123. Both parties agreed that there would need to be a final judgment in the state proceedings in order for there to be any preclusive effect on this Court’s factfinding. Further, the parties agreed that the ALJ’s order was not a final judgment. Defendants argued that the ALJ’s order would become final when the State Personnel Board adopted it, but if Plaintiff appealed that adoption to the Colorado Court of Appeals, Defendants conceded “that the Board’s Order will not be entitled to preclusive [e]ffect until such appeal is complete.” ECF 122 at 2. In Plaintiff’s Proposed Findings of Facts and Conclusions of Law, “Plaintiff’s counsel represents that the matter is now on appeal.”3 ECF 131 at 1. Accepting this proffer, and noting no dispute from Defendants on the law, the Court finds that there is no preclusive effect by the ongoing state proceedings.

However, in Defendants’ brief on the issue, Defendants requested that the Court take judicial notice of the ALJ’s Order. ECF 122 at 6. This was not the first time Defendants made this request, since Defendants moved for the Court to take judicial notice of the ALJ’s Order at the conclusion of the evidentiary hearing. Plaintiff objected to this request. The Court directed the parties to include a discussion of judicial notice in their briefing on the preclusive effect. Plaintiff did not address the issue of judicial notice in his brief. Fed. R. Evid. 201(b) provides that the Court may take judicial notice of a fact that is “not subject to reasonable dispute” because it “can be accurately and readily determined from sources who accuracy cannot reasonably be questioned.” Under Rule 201(c), the taking of judicial notice is mandatory if a party requests it and provides the court with the necessary information. Fed. R.

Evid. 201(c). Here, Defendants want the Court to take notice of a decision from a state administrative body. The Court may take notice of “facts which are a matter of public record.” Tal v. Hogan, 453 F.3d 1244, 1264 n.24 (10th Cir. 2006). Moreover, it is both common and proper for a court to take judicial notice of orders of other courts and administrative agencies. See Papai v. Harbor Tug and Barge Co., 67 F.3d 203, 208 n.5 (9th Cir. 1995); Rivera-Bottzeck v. Ortiz, 241 F. App’x 485, 487 (10th Cir. 2007). Finally, while the ultimate outcome of the state proceedings will be

3 In either case, if the matter is on appeal to the State Personnel Board or to the Colorado Court of Appeals, the outcome at this stage is the same. determined after appeal, the fact that the ALJ made a decision and what that decision is are not subject to reasonable dispute. Accordingly, the Court takes judicial notice of the ALJ’s order.4 2. Motion to Strike At the evidentiary hearing, Plaintiff made an oral motion to strike the testimony of Ms.

McDermott regarding the authenticity of the June 14th Email. Plaintiff’s counsel argued that Ms. McDermott’s conclusion that the June 14th Email was not authentic was not contained in her report and thus should be stricken. “A party seeking to introduce expert testimony at trial must disclose to the opposing party a written report that includes ‘a complete statement of all opinions the witness will express and the basis and reasons for them.’” TDN Money Sys., Inc. v. Everi Payments, Inc., No. 2:15-cv-02197 JCM (NJK), 2017 WL 5148359, at *4 (D. Nev. Nov. 6, 2017) (quoting Fed. R. Civ. P. 26(a)(2)(B)). As part of this rule, “[a]n expert witness may not testify to subject matter beyond the scope of the witness’s expert report unless the failure to include that information in the report was ‘substantially justified or harmless.’” Rembrandt Vision Techs., L.P. v. Johnson & Johnson Vision Care, Inc., 725 F.3d 1377, 1381 (Fed. Cir. 2013). The purpose of this rule is to

“provide opposing parties reasonable opportunity to prepare for effective cross examination and perhaps arrange for expert testimony from other witnesses.” Id. The Court finds that the failure to include Ms. McDermott’s conclusion in a supplemental report was neither substantially justified nor harmless. Defendants’ counsel proffered that they had asked Ms. McDermott to conduct additional analysis following the hearing before the ALJ. Assuming testimony at that hearing understandably created the need for additional expert testimony, Defendants still had the obligation to supplement their expert disclosures. Fed. R. Civ.

4 Although the Court takes judicial notice of the order, the Findings of Fact and the Conclusions of Law in this order are not reached because the ALJ may have reached a similar conclusion but are based on the evidence presented to this Court. P. 26(e). Doing so would have allowed Plaintiff’s counsel to reasonably prepare for Ms. McDermott’s testimony. Therefore, the Court grants Plaintiff’s motion to strike that portion of Ms. McDermott’s testimony. B. Legal Standards Concerning Sanctions

District courts have the “ability to fashion an appropriate sanction for conduct which abuses the judicial process.” Chambers v. NASCO, Inc., 501 U.S. 32, 44–45 (1991). “A district court has inherent equitable powers to impose the sanction of dismissal with prejudice because of abusive litigation practices during discovery.” Garcia v. Berkshire Life Ins. Co. of Am., 569 F.3d 1174, 1179 (10th Cir. 2009). Because dismissal is a harsh remedy, “due process requires that the discovery violation be predicated upon ‘willfulness, bad faith, or [some] fault of petitioner.’” Archibeque v. Atchison, Topeka and Santa Fe Railway Co., 70 F.3d 1172, 1174 (10th Cir. 1995). While dismissal is among the harshest remedies, it is warranted in cases where a party has fabricated evidence. Id. at 1175. The party seeking dismissal must demonstrate the sanctionable conduct by clear and convincing evidence. Xyngular v. Schenkel, 890 F.3d 868, 873–74 (10th Cir.

2018). C. Fabrication of Evidence Defendants have shown by clear and convincing evidence that Plaintiff fabricated Exhibit MMM, and the March 19-20, 2018 HSA Emails, and created a fraudulent Google Domain, all in an attempt to strengthen the merits of his case or hide prior fabrication. 1. Exhibit MMM: The Audio Recording Defendants’ expert, Angel Malley, conducted an analysis which demonstrates that the audio is not authentic. There are blips at roughly the 1:03 and 1:20 minute marks which can be heard with the naked ear, indicating a change in the audio. It is clear that the change occurs when only Plaintiff is speaking and all other background noise disappears. Ms. Malley’s testimony and report, which confirmed the change in audio through visual representation of the sound, showed that the audio in between the blips was recorded in a different place and time than the other audio. Ms. Malley also analyzed the metadata contained in Exhibit MMM, and through this analysis

determined that Exhibit MMM was not created using a program called ACR, as Plaintiff alleged, but instead was made using Audacity, a common tool used to edit audio recordings. Importantly, Plaintiff does not dispute that the audio file is not authentic, but rather he denies manipulating the file. As way of explanation, Plaintiff testified that he believed his supervisor, Ms. Logacheva, manipulated the audio. This strains all credulity. The change in the audio is only as to statements made by Plaintiff. For Ms. Logacheva to alter this audio, she would have to have access to Plaintiff’s voice in a way that would allow her to reconstruct the full statement made by Plaintiff in the audio. There is no evidence (or explanation) as to how Ms. Logacheva could have obtained Plaintiff’s voice in this manner. Furthermore, Plaintiff testified the call was recorded on his personal cell phone. Yet, Ms. Logacheva never accessed Plaintiff’s

phone, nor did Plaintiff ever provide her with any recordings. Notably, the audio in between the blips only benefits Plaintiff. In other words, Exhibit MMM is material to Plaintiff’s case and, had it been authentic, would strengthen the merits. Exhibit MMM pertains to the Oracle Cloud assignment for which Plaintiff was cited for missing deadlines. Only Plaintiff was reprimanded for missing the Oracle Cloud project deadlines. Mr. Stierwalt was not reprimanded because he was assigned to the project in a secondary capacity. The manipulated audio is Plaintiff’s attempt to demonstrate pretext by showing that Mr. Stierwalt was equally responsible for the project and still needed to make changes to the draft document sent to Ms. Logacheva. Plaintiff provided no credible explanation for why anyone other than him would have any reason to create a file that establishes pretext for Ms. Logacheva’s action. Lastly, the evidence reveals that this would not be Plaintiff’s first manipulation of audio files. Plaintiff previously edited other audio files sent to the CCRD, demonstrating his capability and propensity to manipulate files.

Therefore, the Court finds that the record demonstrates by clear and convincing evidence that Plaintiff fabricated this audio file. 2. HSA Emails a. Evidence of Fabrication As an initial matter, there are at least four versions of what should be the same two-email exchange. Plaintiff alone produced each different version. The visual differences between the various versions could only be caused by user manipulation. The visual differences and the timing of Plaintiff’s disclosure of the varying versions give rise to a clear progression of events consistent with Plaintiff creating the versions at different stages to respond to the external developments of the moment. For example, in June 2019, Ms. Bench alerted Plaintiff to a flaw in his retaliation

claim, namely that he was told of performance concerns before engaging in protected conduct. Plaintiff created the first PDF version of the email exchange with the erroneous sender (the CCRD Version) to remedy this potential problem in his claim. Then, probably anticipating that no one else would learn of the CCRD Version, Plaintiff corrected his mistake in the Discovery Version. Subsequently, in February 2020, Plaintiff was ordered to immediately turn over native email files. At this point, he created the First MSG version. The First MSG version contains differences to both PDF versions. In November 2020, the Board ALJ warned Plaintiff that she had serious concerns about GOIT’s allegations and that his case could be dismissed and GOIT could be awarded a large amount of fees and costs. In response, Plaintiff created the Second MSG Version and attached it to an email purportedly sent to Ms. Hughes in June 2018, long before Ms. Bench had expressed a problem with his retaliation claim. But the header of the Second MSG Version demonstrates that it is not authentic, namely that the “Delivered To” and “To” sections of the header do not match.

Plaintiff also had the motive, ability, and opportunity to fabricate the emails. Plaintiff seized on a mistake in the charge of discrimination stating he was discriminated against on or around March 18, 2018 instead of May 18, 2018, and he played off real events concerning problems with contributions into his HSA that were resolved on March 2, 2018. Specifically, on February 23, 2018, Plaintiff had emailed Ms. Logacheva about the contribution issue and never received a response because she was on vacation, which Plaintiff claimed to be a lack of care— something he referenced in his April 13, 2018 email. He was also able to shift his real accusation against GOIT’s HR to an accusation about the Department of Personnel and Administration’s State Benefits team. The fact that Plaintiff never mentioned the HSA Emails before June 28, 2019 also supports

the conclusion that he fabricated them after the fact. First, Plaintiff spoke to Ms. Hughes on June 12, 2018. Her notes do not mention anything about HSA contributions, State Benefits’ making a comment about “welfare,” Ms. Logacheva dismissing a complaint of discrimination, or anything occurring in March 2018. Plaintiff likewise submitted documents to the unemployment hearing officer in early 2019, including a detailed timeline and explanation of events he created, as well as other exhibits, all of which identify May 2018 as the first relevant event and first instance of protected conduct. Finally, Plaintiff spoke to Ms. Bench on the phone for three hours and, as her notes and testimony show, he did not mention the HSA issue or emails and specifically stated his first protected activity occurred in May 2018.5 Other supporting evidence includes multiple witnesses’ testimony that the emails do not exist in GOIT’s system, despite a litigation hold that captured other emails from around the same

time concerning Plaintiff’s HSA contributions. Ms. Logacheva testified that she did not send or receive the HSA Emails, did not have access to Plaintiff’s email account, did not delete the HSA Emails, and did not delete any emails relevant to Plaintiff’s claims. She also testified that she would not have used the language in her purported March 20, 2018 response. Contrary to Ms. McDermott, Mr. Brackin concluded that the First MSG Version was authentic because the header indicates it passed through certain authentication paths, such as DMARC and DKIM. But Ms. McDermott testified that these authentication paths pertain to spam and spoofing and do not determine whether an email was actually sent. Ms. McDermott demonstrated how a fabricated email could be created in a video, and that email passed through all authentication paths Mr. Brackin relied on to conclude the First MSG Version is authentic.

b. Plaintiff’s explanations Like with the audio recording, all of Plaintiff’s attempts to account for the differences in the various emails are implausible. Plaintiff claims that, even though he produced every version of the HSA Emails, he had nothing to do with their creation. Instead, he claims, the CCRD Version, Discovery Version, and First MSG Version all originated from a Google Drive link Mr. Bartley sent to him on August 3, 2018. The Court finds this claim is not credible for several reasons. First, Plaintiff asked Mr. Bartley to send him emails from a specific date range, which

5 It is also noteworthy that Plaintiff recorded this conversation, provided edited portions to Ms. Bench, but then never fully produced it in this litigation. The proffered explanation for this is that the phone was sent to Ethiopia and is unrecoverable at this point. did not include March 2018. GOIT provided only those from the date range requested. Second, even assuming the August 3, 2018 Google Drive link did contain emails outside the requested date range, Plaintiff has no explanation for where the CCRD and Discovery Versions came from. If, as Plaintiff claims, only the First MSG Version is authentic and he did not create the other two

versions, someone else must have done it and then inserted them into his email account as native emails. Plaintiff presented no evidence to suggest how or why this happened sometime prior to August 2018. Third, Plaintiff testified that he saved the First MSG Version to his laptop, but he failed to explain how he produced two different PDF versions at two different points in time, once to the CCRD and once to GOIT in discovery. He also fails to explain how these two PDF versions can possibly differ from each other and from the native MSG versions absent fabrication. Fourth, Plaintiff testified he was aware of GOIT’s concerns regarding fabrication in January 2020, that he knew there were multiple versions of the HSA Emails in August 2020, and that he saw all three versions in native format in the Google Drive link in August and September 2020. Yet, he failed to download much less disclose the three native versions. Plaintiff’s claim that three versions

originated from the August 3rd Google Drive link is not plausible. Plaintiff next insinuates, as with the audio file, that Ms. Logacheva had a role in the inconsistencies or in deleting the emails. Plaintiff tries to account for the incorrect date on the First MSG Version through the expert testimony of Mr. Brackin, suggesting that Ms. Logacheva could have changed the date to March 18, 2018, when she replied back on March 20, 2018. However, Mr. Brackin admitted that this could not explain how the PDF versions produced by Plaintiff then had the correct date. As for Plaintiff’s claim that Ms. Logacheva could have deleted emails, he has presented no evidence to support this. Ms. Logacheva testified that she did not access Plaintiff’s email account nor delete any emails relevant to Plaintiff’s claims. Multiple witnesses testified that only Plaintiff could have deleted emails in his state account prior to the litigation hold taking place. Jim Karlin, the Enterprise Active Directory and Messaging Administrator for GOIT, provided testimony that demonstrated that GOIT had no email purge policy in place from 2017 to 2019, indicating that these emails were not automatically deleted.

And Mr. Santos testified that a litigation hold was in place at least as of August 2018, when Plaintiff first claims to have seen the emails in the Google Drive link. Once this hold was in place, no one could have deleted the emails from Google Vault. Plaintiff also argues that circumstantial evidence suggests that the March 19-20, 2018 HSA email exchange occurred. Specifically, Plaintiff claims that when, on April 13, 2018, Ms. Logacheva wrote that a “communication with [GOIT] HR on some benefits” was an example of Plaintiff’s unprofessional communications, she was referring to the HSA Emails. Plaintiff also claims that Ms. Logacheva referred to the HSA Emails during a May 31, 2018 one-on-one meeting, within the PIP, and during her deposition. But the weight of the evidence demonstrates that Ms. Logacheva was instead referring to Plaintiff’s allegation of discrimination against GOIT’s HR,

first raised to her on April 13, 2018, in response to Ms. Logacheva providing Plaintiff with a poor performance review. Next, Plaintiff suggests that he failed to mention the HSA Emails before June 28, 2019 because he did not consider Ms. Logacheva’s March 20, 2018 email response to be discrimination. Rather, he claims that Ms. Logacheva retaliated against Plaintiff in May for his March 2018 complaint of discrimination. However, Plaintiff claimed in June 2019 that the time-reporting requirement was retaliation for something another coworker had previously said, not for any email he sent in March 2018. Similarly, Plaintiff specifically told the unemployment hearing officer in written submissions that the next action Plaintiff challenged as discriminatory—the removal of his work from home privileges—was in retaliation for Plaintiff’s May 18, 2018 protected conduct. Likewise, to the extent Plaintiff asserts that the PIP was retaliation for his supposed March 2018 HSA email, the record belies that assertion. Plaintiff told the hearing officer that the PIP was in retaliation for the May 18, 2018 protected activity. In other words, the record shows Plaintiff

believed Ms. Logacheva was retaliating for his May emails, not any March emails, necessarily including the HSA Emails. Moreover, Plaintiff explicitly stated to Ms. Bench that his first protected activity occurred on May 18, 2018. Thus, even accepting Plaintiff’s distinction between Ms. Logacheva’s actions as discriminatory or retaliatory as true, both the HSA Emails and the May 18th email cannot be Plaintiff’s first instance of protected activity. Plaintiff also insinuates that GOIT’s email system simply has issues and implies that these issues could have caused multiple versions of the HSA Emails to occur but then later disappear. But the email issues Plaintiff raised at the hearing have rational explanations other than fabrication. Plaintiff presented emails that, at first glance, appear to have been sent multiple times with different content or different attachments, but, unlike the HSA Emails, these emails are drafts being

repeatedly saved as evidenced by the fact that they have slightly different times. The HSA Emails all have the exact same time and thus cannot be drafts. Plaintiff’s last attempt to show issues with GOIT’s system was Exhibit 15, a compilation of separate GOIT document productions. In discussing this exhibit, Plaintiff testified that he did not change the link from Google Drive to YouTube. Yet, the link remained a Google Drive link up until Plaintiff sent an email from his personal Gmail account on July 19, 2018. One reasonable explanation for this is that Plaintiff changed the link to YouTube because he no longer had access to his state Google Drive. Because the change occurred after the email chain was sent from a personal Gmail account, the changed link cannot be attributed to GOIT’s system. Thus, the Court finds that Plaintiff has not provided evidence sufficient to rebut the clear and convincing evidence that he fabricated these initial versions of the March 19-20, 2018 HSA email exchange. 3. June 14th Email, June 28th Emails, and PDF Document

Plaintiff claims he sent the Second MSG Version to Ms. Hughes on June 14, 2018, definitively proving that he did not fabricate the CCRD Version a year later. The evidence, however, demonstrates that Plaintiff fabricated the June 14th Email in an attempt to legitimize the HSA Emails, and manipulated Plaintiff’s and Cyopsis’ June 28th Emails, and associated PDF documents, in an attempt to prove that the version he sent to Ms. Bench had the correct email address, not the State Benefits’ email address. a. June 14th Email Plaintiff produced this email nearly a year after Defendants first raised concerns of fabrication. The eleventh-hour disclosure alone is highly suspicious, given that Plaintiff asserts this email conclusively proves the HSA Emails are real. More likely, Plaintiff fabricated the June

14th Email after the ALJ stated that she had serious concerns about Plaintiff’s fabrication and warned Plaintiff of potential consequences. As the Court mentioned earlier, Ms. McDermott’s testimony regarding the Second MSG Version not being authentic is stricken. However, the circumstantial evidence surrounding this email, coupled with the other findings in this Order, establish by clear and convincing evidence that Plaintiff fabricated the email. The suspicious timing of the disclosure, evidence showing how easy one can fabricate an email, Ms. Hughes’ notes indicating that Plaintiff described events beginning in May, not March, 2018, the Second MSG Version not being found on Plaintiff’s laptop, and the fact that Plaintiff was unable to explain where he obtained it from all convincingly point to Plaintiff’s fabrication of the June 14th Email. b. June 28th Emails and PDF Document Plaintiff also manipulated the June 28th Emails and the associated PDF document.

Plaintiff’s June 28th Email, disclosed on December 1, 2020, purports to be what he actually sent Ms. Bench on that date. But Plaintiff’s version does not match the Original and Authentic Version, and there is no evidence to suspect the Original has been manipulated. In fact, both experts agree it is authentic. By contrast, substantial evidence supports the notion that Plaintiff’s and Cyopsis’ June 28th Emails are manipulated. Ms. McDermott concluded as such based on 1) the numerous dates in the headers; 2) the presence of Google API, which could have been used to accomplish the manipulations; 3) the broken Google Drive link in Plaintiff’s version, which could only have occurred through user manipulation; 4) the PDF attachment added to Plaintiff’s version; and 5) the modify date of December 23, 2020 in Cyopsis’ version. Cyopsis did not rebut these conclusions

and failed to even analyze Plaintiff’s June 28th Email. Also, Plaintiff offered no explanation as to why Cyopsis’ June 28th Email differs from what Plaintiff produced when they are supposed to be the same email. Because Plaintiff produced both versions, and because no one else has any reason to manipulate the emails, it is reasonable to conclude that he manipulated each email in different ways. As for the PDF document, the only tenable explanation for the several versions of the PDF document is that Plaintiff manipulated them. Ms. Bench testified that she downloaded the document from the Google Drive link in the Original and Authentic Email on June 28, 2018. Mr. Andrews testified that the only document titled “Supplemental Response2 Final” was uploaded by Ms. Bench, which was uploaded to Case Connect shortly after the email was sent. Exhibit I, containing the incorrect “state_benefits” sender, is the document by which Plaintiff sent the CCRD version of the HSA Emails to the CCRD. The evidence shows the document attached to Plaintiff’s June 28th Email was manipulated.

Plaintiff admitted that he sent the document to Ms. Bench via a Google Drive link, not a PDF attachment. Because Ms. Bench immediately accessed the document via that link, Plaintiff had no reason to send her a duplicative PDF attachment. Importantly, the PDF attachment does not match what Ms. Bench downloaded. Unlike Exhibit I, the PDF attachment has no user comments, has no embedded audio file or player, and has the correct email address in the HSA Emails. Although Plaintiff claims that he was optimizing the PDF document to make it smaller and that process removed the comments and audio file, that explanation does not fit with the documentary evidence. Ms. McDermott testified that the PDF attachment, without the comments and audio file, was a bigger file than the PDF downloaded by Ms. Bench, with the comments and audio file. Ms. McDermott also testified that optimization would have reduced a file’s size, not increased it. Thus,

optimizing a PDF cannot account for the changed email address on the HSA Email. Plaintiff also manipulated the PDF document found in the Google Drive link contained in the Original and Authentic June 28th Email on October 22, 2020 and December 23, 2020. The document Ms. Bench downloaded showed State Benefits as the sender of the HSA Email, whereas the document more recently edited in the Google Drive link showed Plaintiff as the sender. Only Plaintiff had any motive to change the email address in the PDF document and he provided no explanation why the document currently found in the link differed from what was in the link on June 28, 2019. 4. Fraudulent Google Domain and Email Address The evidence shows that Plaintiff created the fraudulent Google domain and sent the recovery emails to his GOIT email account. Google LLC verified that the domain and email are fraudulent and that Google has no method to restore or recover emails in the way Plaintiff

attempted to do here. Plaintiff’s motive was clear: this scheme, had it been believed, would demonstrate that the HSA emails existed in GOIT’s email system. Although Google LLC returned documents showing that Mr. Santos registered the domain with Google, Mr. Santos did not have the relevant knowledge (much less motive) to do this. He was only aware of Plaintiff through this litigation and had no reason to assist Plaintiff by inserting these emails into Plaintiff’s account. And there is no disputing that the emails are meant to help Plaintiff’s argument that the HSA Emails are real. Moreover, Mr. Santos did not know what the search terms would actually be until several days after the fraudulent domain had been created. Lastly, the email address used to register the fraudulent Google Domain did not list Mr. Santos’ real name or email address.

Most damning, however, is the evidence that proves that only Plaintiff knew the fake recovery emails existed in his account. Plaintiff requested the live searches be run. Plaintiff determined the search terms. The video recording of the searches shows that Plaintiff demanded the searches be run through the present, meaning only he knew the emails were there, because there would be no reason to believe emails from December 2020 would be in his account when the HSA Emails were supposedly sent in March 2018. The clear and convincing evidence is that Plaintiff created the fraudulent Google domain and sent the recovery emails to his account in an attempt to help cover up his other fabrications. D. Dismissal of Plaintiff’s Claims and an Award of Fees and Costs Are Warranted.

In determining whether dismissal is appropriate, a Court evaluates five factors: (1) the degree of actual prejudice to the defendant; (2) the amount of interference with the judicial process; (3) the culpability of the litigant; (4) whether the court warned the party in advance that dismissal of the action would be a likely sanction for non-compliance; and (5) the efficacy of lesser sanctions. Garcia, 569 F.3d at 1179. Fabricating evidence and willfully providing false answers during discovery are without doubt abusive litigation practices that justify the sanction of dismissal with prejudice. Archibeque, 70 F.3d at 1175. Indeed, “[s]ubmitting a false discovery document—or fabricating evidence—has been referred to as ‘the most egregious misconduct which justifies a finding of fraud upon the Court.’” Salgam v. Advanced Software Sys., Inc., No. 118CV00029AJTTCB, 2020 WL 6322857, at *4 (E.D. Va. July 2, 2020) (citing Davis v. Crescent Elec. Co., No. CIV 12-5008, 2016 WL 1625291, at *3 (S.D. Apr. 21, 2016) (citations omitted)). Here, the degree of actual prejudice to Defendants is apparent and substantial. Defendants

have had to essentially fight two battles: one based on the merits of Plaintiff’s allegations and the other based on Plaintiff’s fabrication of evidence. Defendants have had to engage experts specifically to combat Plaintiff’s production of manipulated documents. Surely, the time and expense Defendants have devoted to fraudulent evidence has been significant. The Court finds a large degree of actual prejudice to Defendants. Similarly, Plaintiff’s actions have caused unnecessary interference with the judicial process. While seeking relief in this lawsuit (with his otherwise potentially legitimate claims), Plaintiff engaged in conduct that has now cast “doubt on the veracity of all of [his] submissions throughout [the] litigation.” Garcia, 569 F.3d at 1180. Indeed, even after the evidentiary hearing, Defendants continue to find evidence they believe has been fabricated, including a June 10, 2018 video recorded by Plaintiff. The true scale of Plaintiff’s fabrication in this case may never be known. But what is known is the significant degree of fraud on the Court and interference with the judicial process.

The remaining three factors also warrant dismissal with prejudice and an award of fees and costs. The Court has found that Plaintiff has fabricated the evidence at issue in Defendants’ Motion; hence, the culpability of Plaintiff is self-evident. Moreover, Plaintiff has been warned that such a finding could lead to the dismissal of his claims. Finally, a lesser sanction would not do in this case. Plaintiff has demonstrated a continued pattern of fabricating evidence and then fabricating more evidence to conceal or explain away his prior actions. The Court has no indication that such behavior would stop given the chance. Dismissal of Plaintiff’s case is warranted based on his conduct alone, but, given the egregious nature of his manipulation of evidence, dismissal will also serve as a deterrent to others who may think about trying what Plaintiff did here.

CONCLUSIONS OF LAW I. By clear and convincing evidence, Plaintiff fabricated the audio file, submitted as Exhibit MMM, between him and Mr. Stierwalt.

II. By clear and convincing evidence, Plaintiff fabricated all submitted versions of the March 19-20, 2018 HSA Emails.

III. By clear and convincing evidence, Plaintiff created a fraudulent Google domain and sent fake recovery emails to his account.

IV. Defendants are entitled to an award of their reasonable costs and fees. CONCLUSION In light of clear and convincing evidence of egregious fraud and fabrication of evidence, Defendants’ Motion [filed January 20, 2021; ECF 101] is granted. Plaintiff’s claims are dismissed with prejudice and judgment shall be entered in favor of Defendants. Defendants shall be awarded their reasonable fees and costs associated with litigating this case. SO ORDERED. Dated at Denver, Colorado, this 30th day of June, 2021. BY THE COURT: Michele Mega Michael E. Hegarty United States Magistrate Judge