A Former Employee May Have Sabotaged Your IT System: What Must You Prove?

A company pursuing a DIFC claim for IT sabotage must connect the defendant to the damaging acts and prove the resulting loss. A former employee's knowledge of the system, a difficult departure or an expensive outage does not settle either question. Preserve the technical record, arrange a controlled investigation and distinguish the cost of restoring operations from unrelated improvements.

In the DIFC former-employee IT sabotage decision discussed below, the court awarded substantial recovery costs after examining detailed evidence. It did not decide the case merely because the defendant had once controlled the system. Your first working document should separate what happened, who could have done it and what each recovery expense achieved.

What should you preserve before rebuilding the system?

Ask a suitably qualified incident-response professional to address both containment and preservation. The business may need to resume work quickly, but an undocumented rebuild can make later questions harder to answer. Record who took charge, what systems were affected and which emergency actions occurred. This is an investigation recommendation, not a direction to leave an unsafe system running.

Keep the original incident communications, service tickets, access records and recovery-provider instructions. Ask the technical team to record the source, collection time and handling of material it preserves. Where an export is a working copy or an analyst's reconstruction, label it accordingly. A screenshot of a report and the underlying record are different things, even if they display similar information.

Do not ask an employee to explore another person's private account or device without proper authority. Give the adviser and investigator the relevant ownership, access and employment documents so they can identify lawful ways to obtain evidence. The need to investigate does not justify informal self-help against private systems.

Also preserve ordinary records from before the incident. A current screenshot cannot necessarily show the previous permissions, backup arrangements or system condition. Old handover documents, maintenance tickets and approved changes may explain whether an apparent anomaly was new, authorised or already known. Preserve potentially inconvenient material as well as evidence supporting the initial suspicion.

Why is a difficult departure not enough to prove sabotage?

There may be an obvious suspect: the administrator who resigned, the contractor whose agreement ended or the employee involved in a dispute. That starting point can direct an investigation, but it can also narrow it too early. Separate evidence of a disagreement from evidence of an act affecting the system.

In Graciela Limited v Giacobbe, CFI 027/2014, the judge applied the civil balance of probabilities. Given the serious allegations, the court required convincing evidence and considered alternative explanations. That was not a replacement of the civil standard with the criminal standard of proof.

The eventual conclusion rested on the combined evidence about access, knowledge, activity and the defendant's explanations. The court did not need to establish a motive to find liability. A company's proposed explanation for why someone might want revenge should therefore not substitute for proof of what that person actually did.

Keep your internal chronology neutral at the investigation stage. Identify a confirmed event as confirmed, a witness recollection as a recollection and an inference as an inference. If two employees disagree about a handover, retain both accounts and the underlying documents. Calling a disputed allegation an established fact in repeated internal emails will not strengthen its evidential foundation.

Key takeaway. Build two linked explanations: why the evidence identifies the responsible person, and why each claimed loss resulted from the incident. Neither an angry departure nor a large repair bill proves the missing link.

What evidence persuaded the court in Graciela?

The defendant had been a senior IT employee with extensive knowledge of the company's systems. After his resignation, the company experienced a damaging incident and initially involved him in efforts to restore operations. The later dispute required the judge to distinguish assistance after the event from responsibility for causing it.

The court examined a detailed technical timeline, access arrangements, changes affecting backup recovery, undisclosed system features and the existence of a concealed copy of much of the lost material. It considered who knew about and could use those arrangements. These were connected pieces of evidence, not a checklist under which any former administrator becomes liable.

The judgment also considered other people who had worked on the systems and the suggested possibility of an outside attacker. The court did not dismiss alternative explanations merely because management preferred its original theory. Its conclusion followed a lengthy assessment of the technical and witness evidence.

Importantly, the absence of proof identifying the particular computer used did not prevent the finding on the evidence as a whole. That does not mean device evidence is unnecessary in another case. It means a missing item is assessed in the context of the remaining proof, not treated automatically as decisive in either direction.

How do you keep technical evidence understandable and reliable?

A court needs an explanation of the evidence, not simply a large export of technical material. Ask the investigator to identify which records support each important event, what time convention they use and where information is missing. The business witness should explain the operational setting without pretending to supply a technical opinion outside that witness's knowledge.

Graciela contains a useful warning about presentation. An image of a working document was initially mistaken for a raw system record. The expert explained the distinction and corrected the misunderstanding. The court accepted that explanation. The episode shows why draft notes, source records and final conclusions should be visibly separated from the beginning.

Record limitations plainly. A missing category of logs may leave an unanswered question, but hiding the gap makes the report less useful. Ask what can still be established from the available material and what cannot. A report that confidently attributes conduct without describing its evidential basis invites a different dispute about the reliability of the investigation.

Preserve the connection between the technical event and its business effect. If a folder became inaccessible, identify the work it supported and what staff could no longer do. If operations resumed through an interim arrangement, record when and how. These facts later help explain both the incident's significance and the recovery expenditure.

Can your investigator simply tell the court who is guilty?

No expert opinion should be treated as a substitute for the court's decision on liability. In Graciela, the judge expressly placed no reliance on the expert's ultimate conclusion about culpability. The technical evidence remained important, but the judge drew the conclusion about responsibility.

RDC Part 31 requires an expert to assist the court independently and objectively. That duty overrides the obligation to the person instructing or paying the expert. An expert must consider material facts that detract from the opinion and make relevant limitations clear.

Under rules 31.12 and 31.13, expert evidence must be reasonably required to resolve the proceedings, and calling an expert or putting the report in evidence requires court permission. Commissioning a useful technical investigation therefore does not, by itself, settle how that material will be used in the case.

Give the investigator a question that can be answered from professional expertise. What changed? Which records support the timing? Which alternative causes remain plausible? Avoid instructing someone to produce a report proving management's preferred accusation. Discuss the intended litigation use, scope and permissions with the legal adviser before incurring substantial additional report costs.

Does every digital loss fall within wrongful interference with property?

Graciela found wrongful interference with the company's IT system under Article 41 of the DIFC Law of Obligations as applied in that case. The judgment is useful, but its 2015 result should not be turned into a statement that every present-day dispute about software, information or an online asset has the same legal basis.

The published March 2024 Law of Obligations links Article 41 to interference with an interest in property causing loss. Article 42's definition expressly excludes, among other things, Digital Assets and intellectual property. Article 43 addresses the qualifying interest. The asset and right therefore need to be identified, not assumed from the word digital.

Prepare an asset-and-rights list for the adviser. Distinguish company-owned equipment, a hosted service, licensed software, information and any separately claimed intellectual-property interest. Include the documents showing who owned, possessed or had contractual rights over the affected item. This is a factual preparation exercise, not a suggestion that all these categories share one remedy.

The correct claim may require a different or additional legal analysis. A confidentiality promise, service obligation and property interest are not interchangeable labels. Nor does citing a DIFC judgment establish that DIFC law and jurisdiction apply to your particular company, defendant and incident. Have those questions resolved before framing the demand as a settled entitlement.

Which recovery costs did the court actually award?

The damages in Graciela were USD 690,533. They comprised USD 189,750 for investigation and restoration services, USD 20,926 for emergency servers, USD 62,605 for rebuilding work and USD 417,252 for staff time. The total was a compensation calculation based on the evidence in that case, not a standard tariff for an IT incident.

The court's discussion in paragraphs 164 to 172 connected those amounts to restoring the company's position and dealing with the disruption. Costs and interest were addressed separately in a later amended order dated 9 December 2015. Do not include the litigation-cost award in the case's compensatory damages figure.

Your supplier invoices should identify the work performed, not merely carry a broad incident-response description. Obtain the engagement terms, work record and explanation of why the task was needed. If one invoice includes routine maintenance and incident recovery, ask the supplier to distinguish them accurately rather than allocate the entire bill to the defendant.

Keep an expenditure register from the start. Record the supplier, task, dates, invoice, payment or liability, approving person and supporting explanation. If the figure is still an estimate, call it an estimate. If a credit note arrives later, update the schedule instead of leaving an outdated gross demand in circulation.

Keep insurance correspondence in a separate section of the file. Tell the adviser about any payment, proposed settlement or reservation of rights, and obtain advice on its effect on recovery and who may pursue the claim. Do not assume that insurance answers the liability question, or silently omit a payment because it came from someone other than the proposed defendant.

Can you claim replacement equipment and system improvements?

Separate restoration from a broader technology upgrade. A company may reasonably decide to replace an old platform while recovering, but the business decision does not establish that the entire new project was caused by the incident. Ask the technical team what was needed to restore functionality and what provided a separate improvement.

In Graciela, the court did not deduct a hardware value because the expenditure had simply restored the company's pre-incident position on the facts. That conclusion is not a universal right to replace old equipment with a better system at someone else's expense. The explanation for the expenditure mattered.

Keep the pre-incident upgrade plan, if one existed. A budget approved before the outage can help distinguish a planned investment from emergency replacement. Equally, a purchase already contemplated may have been accelerated or changed by the incident. Explain the actual sequence and obtain advice on the recoverable consequence rather than concealing the earlier plan.

Where there were several recovery options, retain the reasons for the choice made at the time. Relevant practical considerations may include availability, compatibility and the urgency of restoring particular functions. Do not rewrite those reasons after seeing the final bill. A contemporaneous decision note is easier to evaluate than a later assertion that every purchase was unavoidable.

When can diverted employee time form part of the loss?

The staff-time award is one of Graciela's most useful features for a business handling a disruption internally. The company calculated relevant employees' remuneration and the proportion of time diverted from their ordinary work. The court accepted reasonable estimates on the evidence and found substantial business disruption.

That finding does not make every salary paid during an outage an additional loss. Identify the employee, recovery task, period and ordinary work displaced. A person who briefly attended an update meeting and a person who spent days reconstructing operational records should not be assigned the same disruption percentage without a factual basis.

Ask staff to retain task records while the work is still recent. Where precise time records do not exist, describe how an estimate was reached and what documents support it. Calendar entries, work tickets and project records may help reconstruct the period, but should not be presented as exact timesheets if they are not.

The Graciela calculation expressly excluded management time devoted to preparing the court case. Keep incident-recovery work separate from litigation preparation. Also check whether the same labour appears in another claimed item, such as a supplier charge or an asserted trading loss. The schedule should make potential overlaps visible for legal and accounting review.

Common mistake. Adding every salary, supplier invoice and business-loss estimate together without identifying the task, causal connection or overlap. A large total is not a substitute for a traceable calculation.

How do causation, certainty and mitigation affect the calculation?

The Law of Damages and Remedies addresses full compensation, the position without the breach, reasonable certainty and foreseeability in Articles 24 to 28. Article 30 concerns reasonable avoidance of loss and mitigation expense. These provisions do not make an unsupported commercial projection recoverable merely because an incident occurred.

For each item, ask what would have happened without the damaging act. Would the expense have arisen anyway? Did another event prolong the interruption? Did a particular recovery step address this incident or an unrelated defect? Keep the answers and supporting documents beside the calculation rather than burying them in a lengthy narrative.

The mitigation question also deserves a contemporaneous record. Note practical steps taken to limit disruption and why an apparently available alternative was unsuitable. This is not a demand for hindsight perfection. It is a way to show what information and options the company had when it made the decision.

Do not assume that weak internal security either defeats liability or produces an automatic percentage reduction. Graciela considered the access arrangements in reaching its findings. The applicable legal consequences of a claimant's conduct require analysis of the particular cause of action, not a generic statement that every security weakness cancels part of the claim.

How should the company communicate while responsibility is disputed?

Limit communications to the people who need the information and use language appropriate to the evidence. An operational notice can describe a service interruption without publicly accusing a named former employee. Ask the legal adviser to review any proposed allegation or demand that goes beyond the established record.

A request to a former employee may seek clarification of handover material or the location of company records. Preserve the response accurately, including anything that supports an alternative explanation. Do not attempt to manufacture an admission through a misleading summary of what the investigator found.

Keep business recovery decisions moving through an identified decision-maker. Otherwise, several departments may separately authorise overlapping work or communicate inconsistent explanations to suppliers. A simple record of who can approve emergency expenditure and who maintains the chronology makes the later account more coherent.

Have appropriate advisers assess any separate criminal, regulatory, personal-data, insurance or contractual notification issues promptly. This article addresses the civil proof and loss calculation illustrated by the DIFC judgment. It does not determine whether a particular incident is reportable or supply a notification deadline for every business.

What should the first legal-review file contain?

Prepare a focused file rather than sending an unsorted server export. Include the incident chronology, people with relevant knowledge, asset-and-rights list, key employment or service contracts, technical report and loss schedule. Keep links to the underlying evidence so an important conclusion can be tested.

1. Stabilise and preserve. Coordinate authorised technical recovery with a documented preservation plan.
2. Test attribution. Separate confirmed events from assumptions and examine realistic alternative explanations.
3. Identify the legal right. Establish the affected asset, relevant obligation, applicable law and forum.
4. Explain each loss. Record restoration work, reasonable estimates and staff diversion without duplicate items.
5. Review urgency and remedies. Ask about preservation, continuing interference, time limits and any separate notification obligations.

If access or interference may still be continuing, say so at the outset of the legal consultation. A question about stopping further harm is different from calculating completed loss. Give the adviser the current technical assessment and explain what protective steps have already been taken, without assuming that a particular court order will be available.

Sources checked on October 1, 2026. The statutory references are the officially published March 2024 consolidations. Graciela is a 2015 merits judgment, read with its later costs order. Public searches found later costs and anonymisation orders, not a merits reversal, but are not a complete docket check. Asset classification and the law applying to the incident require individual assessment.

Frequently Asked Questions

Is former administrator access enough to prove sabotage? No. It is a fact to investigate. Graciela assessed access alongside the technical chronology, other explanations and the full evidence.

Does the company need to prove a revenge motive? Graciela did not require proof of motive. A proposed motive is not a substitute for proving responsibility for the damaging acts.

Must a particular attacking computer always be identified? The absence of that identification did not prevent the finding in Graciela. Whether a similar gap matters depends on the other evidence.

Can the expert decide who is legally responsible? No. In Graciela, the judge did not rely on the expert's ultimate culpability opinion. The court assessed responsibility.

Can staff time spent restoring operations be claimed? Graciela allowed supported diverted staff time on its facts. Identify the tasks, period and displaced work rather than claiming all salaries indiscriminately.

Was litigation preparation included in that staff-time award? No. The judgment expressly excluded management time spent preparing the court case from the damages calculation.

Does Article 41 cover every kind of digital property? Do not assume that. Article 42's current published definition excludes categories including Digital Assets and intellectual property. Identify the relevant asset and right.

Does the USD 690,533 award predict the value of my claim? No. It was the proved compensation in one case. Your loss must be calculated from your evidence and the applicable legal basis.

This article is general information and does not constitute legal advice. For advice on a particular dispute, consult a qualified advocate.

Related Guides

See the Dubai and DIFC commercial-contracts section and these related guides.

• When an expert report reads like advocacy
• The other side is withholding documents
• New evidence changes the claim

Related Guides

Our DIFC employment page sets out which employment regime applies, the requirements on final pay and deductions, and the time limits on a claim.

• You Copied Employer Files for Your DIFC Claim: What Happens Now?
• Your Former Employee Kept Company Devices and an Unpaid Salary Advance
• Your DIFC Employer Did Not Provide Health Insurance: Who Pays the Medical Bill?