## Bottom line Kestrel should **not** proceed with the CEO’s immediate “for cause” termination of Maya Lin on the current record. The timing, Reid’s text, the sudden warning, the comparator record, the policy departure, and the proposed replacement role create a high retaliation risk. The for-cause theory is very likely to fail the clear-and-convincing “same action” defense. The **only narrow lawful path** for a separation now is: > **If, and only if, the December 18 restructuring is genuine and is implemented exactly as approved before the report**, Kestrel may terminate Maya **as a reduction-in-force/position elimination**, not for cause, and must pay the **eight weeks of severance** promised in the plan. If Kestrel instead retains the other three group members in a new “validation integrity” unit and posts a role with 80% of Maya’s former duties, the RIF path is likely lost. In that case, there is **no defensible termination now**. The most that can be done is a fair, independent, policy-based investigation of the January 28 personal-account transfer and, if supported, a **written warning consistent with policy and comparator treatment**—not termination. --- # 1. Maya’s protected activity and the 90-day causation presumption ## A. Maya engaged in protected activity Under the assumed law, an employee engages in protected activity by reporting conduct the employee reasonably believes violates a safety law, even if the allegations are not all ultimately substantiated. Maya’s January 5 report that Kestrel’s plant had altered three pressure-test entries is clearly protected: - The report concerns **pressure-test integrity**, which is readily within the scope of safety-law concerns. - Maya need not have been ultimately correct on every allegation. - The January 20 audit substantiated two of the three reported issues, which strongly undermines any argument that her belief was unreasonable. - The report was internal, but the rule protects internal whistleblower reports. Maya’s report is therefore protected activity. ## B. The termination would occur within 90 days of protected activity known to the decision-maker Maya reported on **January 5**. Kestrel now wants to terminate her approximately six weeks later. That is well within the 90-day window. The assumed rule presumes causation when: 1. the employee engaged in protected activity; 2. an adverse action occurs within 90 days; and 3. the adverse action occurs after the decision-maker knew of the protected activity. All three elements are satisfied: - **Protected activity:** January 5 report. - **Adverse action:** termination is expressly listed. - **Knowledge:** Reid received the report on January 5 and texted HR the next day. HR and the CEO now know of the report and the desire to terminate. Once the presumption arises, Kestrel avoids liability only by proving by **clear and convincing evidence** that it would have taken the same action for lawful reasons even absent the report. That is a high burden. It is not enough to say the employer had some legitimate reason. It must show that the **same termination** would have occurred absent the protected activity. --- # 2. Reid’s text, the sudden warning, the comparator record, and the proposed cause rationale The proposed for-cause termination is weak on multiple independent grounds. ## A. Reid’s January 6 text is direct evidence of retaliatory motive Reid texted HR: > “She went nuclear. Build the file before she makes herself untouchable.” This is extremely damaging. It shows: - Reid viewed the report as “going nuclear.” - He wanted to “build the file” immediately after the report. - He was concerned that Maya had become “untouchable,” a phrase that directly evokes whistleblower protection. - The text occurred one day after the report. This text will be treated as strong evidence of retaliatory animus. It also supports the inference that later disciplinary steps were part of a plan to manufacture cause. It also creates **manager taint** under rule 7. Even if HR or another official signs the termination notice, the decision may still be tainted because Reid supplied the recommendation and the factual framing. ## B. The January 10 performance warning looks retaliatory and pretextual On January 10, five days after the report, Reid issued Maya’s first performance warning for two late internal reports from the prior year. That warning is a major red flag for several reasons. ### 1. Timing It came five days after Maya’s protected report. That is classic temporal proximity evidence. ### 2. Prior performance history Maya’s prior four reviews rated her “exceeds expectations.” A sudden warning for old, apparently manageable issues does not fit a genuine performance progression. ### 3. Comparator inconsistency Other analysts with two or three late reports received **coaching**, not written warnings. Maya had two late reports. If comparators with equal or worse performance received only coaching, then a written warning for Maya is inconsistent treatment. ### 4. Sudden documentation The warning appears to have been issued after the report for prior-year conduct. That fits the “build the file” pattern and is exactly the kind of post-report documentation that undermines a same-action defense. ### 5. It may itself be an adverse action or at least strong evidence The assumed rule expressly lists termination, demotion, material duty removal, reduced pay, and materially adverse investigation as possible adverse actions. A written warning is not automatically listed, but it may be treated as materially adverse if it affects employment conditions, affects future discipline, or is part of a record used to justify termination. Even if the January 10 warning is not independently actionable, it is powerful evidence that the employer began constructing a cause record after learning of the report. **Kestrel should not rely on the January 10 warning.** If it is used in the termination decision, it will likely poison the for-cause defense. ## C. The proposed “data theft and insubordination” rationale is not supported by policy or comparators Maya’s manager recommends termination for “data theft and insubordination” based on the January 28 transfer of an encrypted draft safety spreadsheet to her personal work-from-home account. That characterization is problematic. ### 1. “Data theft” is overstated The facts state: - She transferred a draft spreadsheet. - It was encrypted. - It went to her personal work-from-home account. - No third party received it. - There is no indication that regulated personal data was exposed. That is an unauthorized transfer under policy, but it is not clearly “data theft.” Theft usually implies taking with intent to deprive or appropriate. No third party received the file. The label “data theft” will look inflated. ### 2. “Insubordination” is not shown The facts do not state that Maya refused a lawful order, defied a directive, or acted insubordinately. Transferring a file contrary to policy is a policy violation, but it is not automatically insubordination. ### 3. The policy prescribes a written warning for a first personal-account transfer The policy prescribes a **written warning** for a first personal-account transfer unless regulated personal data is exposed. On these facts: - It appears to be a first personal-account transfer. - No third party received the file. - There is no indication that regulated personal data was exposed. - Two other analysts received written warnings for the same conduct last year. Therefore, termination is not the same consequence that policy and comparators support. ### 4. The comparator record defeats the same-action defense The assumed law requires the employer to investigate fairly and apply the same consequence used for materially similar conduct. Here, materially similar conduct produced written warnings for two other analysts. Terminating Maya for the same conduct, without a material difference, is not the same consequence. The for-cause termination therefore fails the comparator-treatment and policy-consistency requirements. --- # 3. The January 28 personal-account transfer under policy and comparator treatment The January 28 transfer is real misconduct if it violated policy, but it does not support termination on this record. ## A. The conduct Maya forwarded an encrypted draft safety spreadsheet to her personal work-from-home account, contrary to policy. That is a security and data-handling issue. But the severity must be measured by the policy and consistent practice. ## B. The policy consequence The policy prescribes a **written warning** for a first personal-account transfer unless regulated personal data is exposed. The key missing aggravating facts are: - no third-party recipient; - no disclosure; - no indication of regulated personal data exposure; - the file was encrypted. If Kestrel cannot prove that regulated personal data was actually exposed, the policy consequence is a warning. ## C. Comparator treatment Two analysts received warnings for the same conduct last year. If those comparators had similar facts and no prior discipline of the same type, terminating Maya is materially inconsistent. ## D. The transfer does not cure the retaliation problem Rule 5 says protected activity does not immunize independent misconduct, but the employer must investigate fairly and apply the same consequence used for materially similar conduct. The January 28 transfer is independent misconduct only in the sense that it occurred after the report and involved a policy violation. But it does not establish that Kestrel would have terminated her absent the report. On these facts, the same-action defense for termination based on the January 28 transfer is weak. ## E. After-acquired evidence does not save the decision Rule 6 concerns after-acquired evidence discovered only after termination. That rule does not help Kestrel here. The January 28 transfer occurred before any termination and is known before the termination decision. It is not after-acquired evidence discovered after termination. Even if it were, after-acquired evidence may limit remedy but does not justify the original retaliatory decision. --- # 4. The pre-report restructuring plan The December 18 restructuring plan is the strongest lawful basis available to Kestrel. ## A. The plan is pre-report and contemporaneous The board approved a written restructuring plan on **December 18**, before Maya’s January 5 report. The plan: - eliminates Maya’s four-person pressure-test group; - is effective February 15; - is based on closing a product line; - identifies all four positions by employee number; - provides eight weeks of severance. This is exactly the kind of contemporaneous pre-report plan that can support a same-action defense. Because the plan predates the report, it is not a post-report invention. The board approved the position eliminations before Maya reported. ## B. The plan has objective selection criteria The plan identifies the affected positions by employee number. That is strong evidence that the selection was fixed before the report and was not chosen after the report because of Maya’s status. If the plan is implemented as written, Kestrel can argue: - the product line was closing; - the pressure-test group was eliminated; - Maya’s position was one of the identified positions; - the decision was made before the report; - the severance was part of the approved plan; and - the same termination would have occurred absent the report. ## C. The plan must be implemented genuinely The pre-report plan is helpful, but it is not automatically sufficient. Rule 8 permits a genuine reduction in force fixed before the report, but it prohibits: - relabeling a substantially identical replacement role; and - using “for cause” to avoid promised severance. So Kestrel cannot simply use the December plan as a label while actually retaining Maya’s team or creating a substitute role that performs her former duties. The plan must be real and implemented consistently. --- # 5. Effect of retaining the other group members and reposting substantially similar duties This is the central problem with using the RIF as a cover for removing Maya while keeping the rest of the group. ## A. The original plan eliminated all four positions The board plan identifies all four positions in the pressure-test group. Three other positions are still scheduled for elimination under the plan. But Reid now proposes retaining the other three group members in a new “validation integrity” unit and posting a role with 80% of Maya’s former duties. That changes the reality of the restructuring. ## B. Retaining the other three undercuts “genuine elimination” If the other three members of the group are retained, Kestrel is not genuinely eliminating the pressure-test group as planned. At minimum, the company is altering the pre-report selection criteria after the report in a way that singles Maya out. Rule 4 recognizes consistent comparator treatment and genuine elimination as part of the same-action defense. Retaining scheduled eliminations while removing the whistleblower undercuts that defense. ## C. The new “validation integrity” unit is likely a relabeling A title change does not control. The question is whether the new role is substantially identical to Maya’s former role. The fact that the posted role contains **80% of Maya’s former duties** is very bad. That strongly suggests the position was not truly eliminated. It suggests a relabeled backfill. Rule 8 explicitly prohibits relabeling a substantially identical replacement role. If Kestrel eliminates Maya under the RIF but immediately creates a role performing most of her former duties, a factfinder is likely to infer that the RIF is pretext. ## D. The replacement undermines the same-action defense Rule 4 lists “replacement” as a factor that undermines the same-action defense. The proposed “validation integrity” unit with 80% duty overlap is effectively a replacement structure. Even if Kestrel pays severance, that does not cure the retaliation claim if the RIF is not genuine. ## E. If the new unit is genuinely different, the analysis changes—but the facts as stated make that hard to prove If Kestrel can prove that the validation integrity unit is a genuinely new function with materially different duties, skills, product lines, reporting lines, pay, and business purpose, then the RIF might survive. But with: - retention of the other three scheduled eliminations; - a new unit created after the report; - a role with 80% of Maya’s former duties; - and a manager who said he wanted to “build the file,” the employer would have a very difficult time proving the position was truly eliminated. On the stated facts, the RIF path is compromised if Kestrel implements Reid’s proposal. --- # 6. Manager taint and the need for independent review ## A. Reid’s knowledge and motive taint the decision Reid: - received the report on January 5; - texted HR the next day with a retaliatory-sounding instruction; - issued a warning five days later; - now recommends termination for conduct that policy and comparators suggest should be a warning. Rule 7 provides that a manager’s knowledge and retaliatory motive may taint a decision when the manager supplies the facts or recommendation, even if another official signs the notice. Therefore, HR cannot simply sign Reid’s recommendation. If the termination notice is based on Reid’s “data theft and insubordination” framing, the decision is tainted. ## B. Another signature is not enough The fact that HR or the CEO signs the termination notice does not cure the taint. The question is whether the decision-maker relied on a tainted recommendation or on an independent, lawful basis. ## C. Independent review is required Kestrel should immediately remove Reid from the decision chain. The separation decision, if any, should be made through an independent review by someone not involved in Reid’s recommendation, preferably senior HR and employment counsel or outside counsel. The independent reviewer should: 1. confirm the facts of the January 28 transfer without relying on Reid’s characterization; 2. confirm whether the December 18 RIF is genuine and unchanged; 3. compare Maya’s treatment with comparators; 4. determine whether the position is truly eliminated; 5. ensure no reference to the protected report is used as a reason; 6. make the decision based solely on the RIF or, for discipline, on the policy-consistent warning. A written decision memorandum should state that the decision is not based on Maya’s whistleblower report or Reid’s recommendation. ## D. Independent review may help, but it cannot cure a substantively weak cause record For the RIF path, independent review is critical and may be sufficient if the RIF is genuine. For the for-cause path, independent review is unlikely to help because the substantive record still fails: policy prescribes a warning, comparators received warnings, and the proposed labels are overstated. --- # 7. Preservation and communication risks ## A. Preservation is required Rule 9 requires preservation of: - report files; - audits; - texts; - performance records; - comparator discipline; - restructuring documents; - and decision communications. Kestrel should issue an immediate litigation hold covering: 1. Maya’s January 5 report and all routing records; 2. the January 20 audit and all related files; 3. pressure-test entries, logs, and versions; 4. Reid’s January 6 text and all related messages; 5. HR discussions, notes, and emails about Maya; 6. the January 10 warning and the underlying report-timeliness records; 7. Maya’s performance reviews; 8. comparator personnel files and discipline records; 9. the January 28 transfer access logs and related IT records; 10. the data-handling policy and prior enforcement records; 11. the December 18 board plan, board minutes, and related financial/restructuring documents; 12. the proposed “validation integrity” unit documents; 13. job postings, org charts, and replacement-role analyses; 14. CEO communications, including the proposed statement that “whistleblowing does not excuse misconduct.” Kestrel must not alter, delete, or “clean up” any of these materials. The Reid text is adverse, but it must be preserved. ## B. Do not create post-hoc cause documents The employer should not now create new performance memos, incident reports, or discipline summaries designed to justify termination. That would worsen the “sudden documentation” problem. Any new documentation should be: - contemporaneous; - factual; - limited to legitimate business purposes; - not framed around the protected report; - and not used to inflate the January 28 conduct. ## C. Communication risks are severe The CEO wants to announce that “whistleblowing does not excuse misconduct.” Kestrel should not do that. That statement would be treated as evidence of retaliatory motive and could chill other employees. It would also undermine any claim that the separation is based solely on a lawful, non-retaliatory reason. ## D. If the RIF path is used, communications must be neutral If Kestrel proceeds under the RIF, the termination communication should say, in substance: > “Your position has been eliminated pursuant to the board-approved restructuring plan dated December 18. The elimination is effective February 15. You will receive eight weeks of severance in accordance with the plan.” The communication should not: - mention the January 5 report; - mention whistleblower protection; - mention the January 10 warning; - mention the January 28 transfer as a reason for termination; - use the phrase “for cause”; - or suggest that the decision is related to her report. If Maya raises the report, the response should be neutral: > “This decision is based solely on the elimination of your position under the December restructuring plan.” ## E. Do not mix RIF and cause If the separation is a RIF, it must be treated as a RIF. Kestrel may separately address the January 28 policy violation, but it should not be included as part of the termination rationale. Mixing the two will make the separation look like a pretextual for-cause termination. --- # 8. Whether any termination may proceed now, on what basis, and with what severance ## A. For-cause termination now: no Kestrel should not terminate Maya for cause now. The for-cause path fails because: 1. The termination is within 90 days of protected activity. 2. Causation is presumed. 3. The clear-and-convincing same-action defense is weak. 4. The January 10 warning is suspicious and comparator-inconsistent. 5. The January 28 conduct, under policy and comparators, supports a warning, not termination. 6. The proposed labels “data theft” and “insubordination” are overstated. 7. Reid’s text shows retaliatory motive. 8. Reid’s recommendation taints the process. 9. The proposed replacement role undermines any claim that the separation is based on a genuine position elimination. The CEO’s desire to pay no severance and announce that “whistleblowing does not excuse misconduct” would make the retaliation risk even higher. ## B. RIF termination now: only if the December plan is genuine and unchanged Kestrel may terminate Maya now **only** on the following basis: > The position was eliminated under the board-approved December 18 restructuring plan. The termination must be: - non-for-cause; - based on the position elimination; - implemented as part of the approved restructuring; - consistent with the pre-report plan; - not based on the protected report; - not based on the January 10 warning; - not based on the January 28 transfer as a termination cause; - and accompanied by the promised **eight weeks of severance**. If the RIF is genuine, the termination may be defensible even though it occurs within 90 days of the report, because the employer would have eliminated the position regardless. ## C. Severance If the RIF is used, Kestrel must pay the **eight weeks of severance** promised in the plan. It may not: - label the termination “for cause” to avoid severance; - condition severance on a waiver tied to a false cause theory; - or withhold severance because of the January 28 policy violation. Rule 8 expressly prohibits using “for cause” to avoid promised severance in a genuine RIF. --- # 9. The narrow lawful path if the product-line elimination is genuine If the product-line elimination is genuine, the narrow lawful path is as follows. ## Step 1: Reject the for-cause termination Kestrel should abandon the immediate for-cause termination. The CEO’s proposal should not be implemented. ## Step 2: Verify that the December 18 RIF is real and unchanged Before proceeding, Kestrel should confirm: - the product line is actually closing; - the board plan was approved before the report; - the plan was not altered after the report to single out Maya; - all four pressure-test positions are actually being eliminated; - no substantially identical replacement role is being created; - the “validation integrity” unit, if any, is genuinely different and not a backfill; - the severance terms are being honored. If the other three group members are being retained in a role performing 80% of Maya’s former duties, this path is not available unless Kestrel can prove the new role is genuinely different and not a replacement. On the stated facts, that is very difficult. ## Step 3: Conduct an independent review Reid should be excluded. Senior HR or outside employment counsel should prepare a short written memorandum confirming: - the decision is based solely on the December 18 RIF; - the position is eliminated; - the same decision would have been made absent Maya’s report; - no reliance is placed on the report, the January 10 warning, or Reid’s recommendation; - severance will be paid. ## Step 4: Implement the RIF on the planned basis The separation should be processed as a position elimination under the December 18 plan. It should not be accelerated in a way that deviates from the pre-report plan. If the plan says February 15, Kestrel should generally wait until that date unless there is a genuine, documented, non-retaliatory business reason to accelerate. Acceleration after the report creates additional timing risk. ## Step 5: Pay the promised severance Pay eight weeks of severance under the plan. Do not characterize the separation as for cause. ## Step 6: Use neutral communications Communicate only that the position is being eliminated under the December restructuring. Do not discuss the report, misconduct, or whistleblower status. ## Step 7: Handle the January 28 issue separately, if at all If Kestrel decides to address the January 28 transfer, it should do so through an independent investigation and, if supported, issue only the policy-prescribed written warning. But it should not be used as part of the termination rationale. In practice, if the separation is a RIF, the cleanest approach is to avoid mixing discipline into the separation process. --- # 10. Alternative if the product-line elimination is not genuine If the product-line elimination is not genuine, or if Kestrel changes the plan after the report to retain the other three group members and create a substantially similar role, then the RIF path is unavailable. In that case, Kestrel has **no lawful basis for termination now**. ## A. Do not terminate for the January 10 warning The January 10 warning should not be used. It is comparator-inconsistent, temporally suspicious, and appears part of a post-report file-building effort. ## B. Do not terminate for the January 28 transfer The January 28 transfer, under the stated policy and comparator facts, supports a written warning, not termination. Termination for that conduct would not be the same consequence used for materially similar conduct. ## C. Conduct a fair, independent investigation of the January 28 transfer Kestrel should investigate the January 28 transfer independently of Reid. The investigation should determine: - whether the transfer occurred; - what data was transferred; - whether it was encrypted; - whether any regulated personal data was exposed; - whether any third party received the data; - whether any prior policy violations exist; - how comparators were treated. If the facts match the prior comparator cases, the appropriate consequence is a written warning. ## D. At most, issue a policy-consistent written warning If the investigation confirms the policy violation, Kestrel may issue a written warning. But this warning must be: - based on independent facts; - consistent with policy; - consistent with comparator treatment; - not framed as part of a retaliation-driven cause file; - and not used as a stepping stone to a pretextual later termination. Even a warning may be scrutinized because it occurs within 90 days of protected activity. The defense would be that the same warning would have been issued absent the report. The policy and comparator record support that, but the process must be independent from Reid. ## E. Do not wait until after 90 days and then terminate for the same conduct Waiting until after 90 days does not create a safe harbor. If Kestrel waits two or three months and then terminates Maya for a first-offense, warning-level policy violation, the delay itself would be strong evidence of pretext. Any future termination would need to be based on new, independent, lawful conduct or a genuine future RIF, not on the current record. ## F. Avoid the CEO’s announcement Kestrel should not announce that “whistleblowing does not excuse misconduct.” That statement would be direct evidence of retaliatory motive and would damage any later defense. --- # 11. Final risk assessment | Proposed action | Retaliation risk | Main problem | |---|---:|---| | Immediate for-cause termination with no severance | Very high | Timing, Reid text, sudden warning, comparator inconsistency, policy departure, inflated misconduct labels | | For-cause termination based on January 10 warning | Very high | Pre-existing excellent reviews, comparator coaching, post-report timing | | For-cause termination based on January 28 transfer | High | Policy prescribes warning; comparators received warnings; no third-party exposure; “data theft/insubordination” overstated | | RIF termination if December plan is genuine and unchanged | Low to moderate, if handled cleanly | Must be real, unchanged, with no replacement and with severance | | RIF termination while retaining other three and creating 80%-similar role | Very high | Not genuine elimination; replacement; relabeling; post-report alteration | | No termination; independent written warning for January 28 | Moderate, if independent | Still within 90 days, but policy and comparators support warning; process must be independent | --- # Conclusion The only narrow path by which a separation can proceed **without relying on a manufactured cause record** is a genuine, pre-report RIF. That path requires: 1. the December 18 restructuring to be real; 2. the position elimination to be implemented as approved before the report; 3. no substantially identical replacement role; 4. no reliance on the protected report; 5. no reliance on Reid’s recommendation; 6. no for-cause label; 7. neutral communications; 8. full eight weeks of severance; and 9. preservation of all relevant records. If Kestrel retains the other three group members and posts a role with 80% of Maya’s former duties, the RIF is likely a pretext, and Kestrel should not terminate Maya now. In that case, the only defensible course is to preserve the records, conduct an independent investigation of the January 28 transfer, and, if supported, issue only a policy-consistent written warning—not termination.